Re: [hybi] Handshake was: The WebSocket protocol issues.

[Scott Ferguson <[e-mail]>]

Bjoern Hoehrmann wrote:
> * Scott Ferguson wrote:
>   
>> The target is pre-compromised because it has an open DELETE (point #6) 
>> and the target is pre-compromised because it's on the same machine as 
>> the attacker (point #1).
>>     
>
> You are misunderstanding the example trace I gave. The DELETE is sent to
> the attacker, not the target. The server 1.2.3.4 needs to think that the
> client is still talking HTTP, and if the first thing it sees is "ħ<" or
> something like that, it might respond with an error message and close
> the connection. "DELETE..." in US-ASCII looks like a Websocket text
> frame and like HTTP, so I am using that as an example. If the attacker
> manages to create the initial frames such that the web server keeps the
> connection open, then he can send pretty much arbitrary HTTP requests to
> the target server.
>   

The "DELETE" represents the HTTP request that a normal browser cannot 
produce but the WebSocket request supposedly can.

The point is, a server cannot rely on browser restrictions to protect 
their HTTP site. It must defend itself against arbitrary clients which 
are perfectly capable of sending arbitrary, perfectly valid requests.

The attempt to avoid that server-side responsibility by using an IP 
restriction to a foreign site (the office) is not any kind of real defense.

-- Scott