citricsquid on HTTP Headers For Fun & Profit

Comment on HTTP Headers For Fun & Profit

curl -I www.reddit.com

    HTTP/1.1 200 OK
    Content-Type: text/html; charset=UTF-8
    Server: '; DROP TABLE servertypes; --
    Date: Fri, 07 Dec 2012 10:30:26 GMT
    Connection: keep-alive

cpsales 13y

Haha, brilliant!

Selfcommit 13y

I don't get it - What am I missing?

citricsquid 13y

    Server: '; DROP TABLE servertypes; --

It's a mysql injection. If someone was scraping headers and logging them and wasn't validating the input -- and their database was named "servertypes" -- it would delete the database.

Comments