A new sink fetch.header (similar to fetch.url and fetch.body) would widen the possibilities to detect request hijacking.
Currently Foxhound doesn't recognize a possible request manipulation on the following page:
<html lang="en">
<head>
<meta charset="UTF-8">
<title>Request Hijacking Vulnerability</title>
</head>
<body>
<script>
let payload = decodeURIComponent(location.hash.substring(1));
fetch('http://localhost:8000', {
headers: {
'Content-Type': 'application/json',
// use payload as header value
'Auth': payload
}
})
.then(response => response.text())
.then(data => {
console.log('Response:', data);
})
.catch(error => {
console.error('Error:', error);
});
</script>
</body>
</html>
A new sink fetch.header (similar to fetch.url and fetch.body) would widen the possibilities to detect request hijacking.
Currently Foxhound doesn't recognize a possible request manipulation on the following page: