51–60 of 178 posts
HTTP Headers are user-input for the recipient. I delivered a few security-related talks where my website sends XSS payloads in its HTTP headers. There are many "HTTP Headers checker" websites that fail to sanitize HTTP headers, and they make a good punchline for the talk about sanitizing user-input.
The same goes for DNS records too.
Just telling people to apply to domain.com/jobs is pretty lame. So, basically the same door that anyone else goes through when they click the "Careers" link in your site's footer? Reminds me of when I solved one of the CTF challenges for a website only for my reward to be "We're hiring! Apply at jobs.example.com!" Real "be sure to drink your Ovaltine" moment.
Just telling people to apply to domain.com/jobs is pretty lame. So, basically the same door that anyone else goes through when they click the "Careers" link in your site's footer? Reminds me of when I solved one of the CTF challenges for a website only for my reward to be "We're hiring! Apply at jobs.example.com!" Real "be sure to drink your Ovaltine" moment.
The mug is round. The jar is round.
They should call it Roundtine.
Just telling people to apply to domain.com/jobs is pretty lame. So, basically the same door that anyone else goes through when they click the "Careers" link in your site's footer? Reminds me of when I solved one of the CTF challenges for a website only for my reward to be "We're hiring! Apply at jobs.example.com!" Real "be sure to drink your Ovaltine" moment.
Why do they call it Ovaltine? The mug is round. The jar is round. They should call it Roundtine.
'Ovaltine was developed in Bern, Switzerland, where it is known by its original name, Ovomaltine (from ovum, Latin for "egg", and malt, which were originally its key ingredients).' [1]
Well, maybe not super likely in absolute terms but still infinitely more likely than a random person reading a dev job board.
How did you find quirky headers on other websites? Did you use a script?
$ curl -s -o /dev/null -D - https://frenxi.com/http-headers-you-dont-expect/ HTTP/1.1 200 OK Content-Type: text/html Content-Length: 47608 Connection: keep-alive Last-Modified: Fri, 15 May 2020 01:35:43 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Via: 1.1 ddaf46a95abcfc80e8eae76235e2127c.cloudfront.net (CloudFront), 1.1 37d64bca4c93552139fb3a85c9c4a119.cloudfront.net (CloudFront) St…
curl -I https://frenxi.com/http-headers-you-dont-expect/
https://www.tripadvisor.com/robots.txt
Hi there, If you're sniffing around this file, and you're not a robot, we're looking to meet curious folks such as yourself. Think you have what it takes to join the best white-hat SEO growth hackers on the planet? Run - don't crawl - to apply to join TripAdvisor's elite SEO team Email seoRockstar@tripadvisor.com Or visit https://careers.tripadvisor.com/search-results?keywords=seo
https://repl.it/jobs might be relevant here.
Is anyone else annoyed this is being publicized? It pretty much destroys any value that noticing the header might have as a signal. Granted the signal strength was probably pretty low already, as other commenters have pointed out, but blog posts like this must decrease it even further.
It's not like the sites are offering you a job, they're saying you should interview with them. I have not heard of anyone getting hired because of this.