HTTP Headers For Fun & Profit • Hacker News Board

Re: HTTP Headers For Fun & Profit

#41

Post by xyzzyb » Fri, Dec 07, 2012, 2:28 PM UTC

Slashdot used to have x-fry and x-bender (Futurama) but it looks like even those headers are gone from slashdot now.

Re: HTTP Headers For Fun & Profit

#42

Post by JonnieCache » Fri, Dec 07, 2012, 2:34 PM UTC

Another great place for job adverts is deep inside your minified JS code or binary packages.

Re: HTTP Headers For Fun & Profit

#43

Post by notzach » Fri, Dec 07, 2012, 2:39 PM UTC

I set this one up a while ago. The header is on most of our sites.

curl -I webmaster.appstate.edu

    X-Robot-3: Which of the following would you most prefer? A: a puppy, B: a pretty flower from your sweetie, or C: a large properly formatted data file?

Re: HTTP Headers For Fun & Profit

#44

Post by philbarr » Fri, Dec 07, 2012, 2:53 PM UTC

Joyfield wrote: post #38

Some thought from a developer (me) : curl -I www.rendip.com

Some "though" from a developer by the looks of it.

Re: HTTP Headers For Fun & Profit

#45

Post by Selfcommit » Fri, Dec 07, 2012, 3:14 PM UTC

cpsales wrote: post #26

citricsquid wrote: post #3

curl -I www.reddit.com HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Server: '; DROP TABLE servertypes; -- Date: Fri, 07 Dec 2012 10:30:26 GMT Connection: keep-alive

Haha, brilliant!

I don't get it - What am I missing?

Re: HTTP Headers For Fun & Profit

#46

Post by citricsquid » Fri, Dec 07, 2012, 3:29 PM UTC

Selfcommit wrote: post #45

cpsales wrote: post #26

Earlier quoted context omitted.

Haha, brilliant!

I don't get it - What am I missing?

    Server: '; DROP TABLE servertypes; --

It's a mysql injection. If someone was scraping headers and logging them and wasn't validating the input -- and their database was named "servertypes" -- it would delete the database.

Re: HTTP Headers For Fun & Profit

#47

Post by hiddenfeatures » Fri, Dec 07, 2012, 4:58 PM UTC

Boldewyn wrote: post #36

buttscicles wrote: post #19

Earlier quoted context omitted.

From reddit.com: User-Agent: bender Disallow: /my_shiny_metal_ass User-Agent: Gort Disallow: /earth

Better still: http://www.last.fm/robots.txt Disallow: /harming/humans Disallow: /ignoring/human/orders Disallow: /harm/to/self

OMFG. That is hilarious!

Made my day

Re: HTTP Headers For Fun & Profit

#48

Post by rmccue » Fri, Dec 07, 2012, 5:10 PM UTC

mapleoin wrote: post #28

mokash wrote: post #20

I know Wordpress.org sends a header called X-Hacker or something, telling people who see the header to look at their jobs page and tell them about the header.

It's not that hard to check and it seems they don't. But they have this other X-nc header: $ curl -I wordpress.org HTTP/1.1 200 OK Server: nginx Date: Fri, 07 Dec 2012 12:15:43 GMT Content-Type: text/html; charset=utf-8 Connection: close Vary: Accept-Encoding X-nc: HIT luv 139

The X-nc header is related to the cache. The GP is correct in that these headers used to be sent on wordpress.org and wordpress.com, but it appears they are now only sent on automattic.com

Re: HTTP Headers For Fun & Profit

#49

Post by [deleted] » Fri, Dec 07, 2012, 6:07 PM UTC

jasonkostempski wrote: post #39

dfc wrote: post #7

Am i getting too old? When I see "for fun and profit" I don't think I'm going to read about some easter eggs hiding in http headers.

But it's true in this case, there's a job posting in Interstate's headers.

[deleted]

Re: HTTP Headers For Fun & Profit

#50

Post by mahmoudimus » Fri, Dec 07, 2012, 11:20 PM UTC

My favorite is Zappos.com

    % curl -I www.zappos.com
    HTTP/1.1 200 OK
    Server: nginx/1.1.17
    Content-Type: text/html; charset=utf-8
    X-ZFC-Metadata: KiMIExILCgNuaWQSBDU5NjQSEgoGbGF5b3V0Eghob21lcGFnZQ==
    X-Powered-By: Ponies!
    X-Varnish-TTL: 60m
    X-Varnish: 251047185 251045936
    X-Cache-Hits: 87
    X-Varnish-Host: varnish04.zappos.net
    X-Varnish-ID: drupal
    X-Core-Value: 1. Deliver WOW Through Service
    X-Recruiting: If you're reading this, maybe you should be working at Zappos instead.  Check out jobs.zappos.com
    X-UUID: ecbb72d2-40c0-11e2-b1b3-0010184bda34
    Cache-Control: max-age=2004
    Date: Fri, 07 Dec 2012 23:19:43 GMT
    Connection: keep-alive

"Powered by Ponies!"