Skip to content

Add fetch.header sink #292

@TAI-ing

Description

@TAI-ing

A new sink fetch.header (similar to fetch.url and fetch.body) would widen the possibilities to detect request hijacking.

Currently Foxhound doesn't recognize a possible request manipulation on the following page:

<html lang="en">

<head>
    <meta charset="UTF-8">
    <title>Request Hijacking Vulnerability</title>
</head>

<body>
    <script>
        let payload = decodeURIComponent(location.hash.substring(1));

        fetch('http://localhost:8000', {
            headers: {
                'Content-Type': 'application/json',
                // use payload as header value
                'Auth': payload
            }
        })
            .then(response => response.text())
            .then(data => {
                console.log('Response:', data);
            })
            .catch(error => {
                console.error('Error:', error);
            });

    </script>
</body>

</html>

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions