Security and Insecurity of HTTP Headers
summary
The talk analyzes concrete HTTP header failures where servers and proxies leak version and topology information, enabling attackers to fingerprint infrastructure; a live test across proxied and SSL‑terminated sites produced 27 distinct fingerprints that revealed webserver and application versions and sometimes private IP addresses. It presents a small web‑based fingerprinting service that uses plain requests and captured browser traffic to demonstrate the issue, and shows that Content Security Policy in report‑only misconfigurations often fails to stop real exploits in Chrome, Firefox and IE; tools and test cases are published and reproducible.
AI-written summary · about
chapters (4)
related talks
38mWhy Do We Need Security Headers?
31mHTTP Security Headers: A Technology History Through Scar Tissue
21mSecurity with HTTP headers: overview of attacks and defenses
24mTurn Your Browser into a Hacker Trap with HTTP Security Headers
45mHeaders for hackers
21mSecurity is Everyone's Responsibility
30mSecurity with HTTP Headers: Overview of Attacks and Defenses
50mEnhancing Application Security: Understanding and Utilizing Browser Security Features