HTTPoxy Vulnerability


Status
Not open for further replies.
mustafaramadhan

mustafaramadhan

Hosting Guru
Setahu saya hanya litespeed yang melalukan patch. Sedangkan web server lain tidak ada tapi cukup dengan menyesuaikan file konfigurasi.
 
mustafaramadhan

mustafaramadhan

Hosting Guru
FluidaWeb said:
saya sudah melakukan patch webserver nginx saya, apa bisa dibantu pak @mustafaramadhan untuk cek web di signature sya apa masih vulnerable
Click to expand...
Ini perbandingan punya saya dan punya anda:
Code: 
> cd /tmp; wget -S --header="Proxy: 1.2.3.4:8080" https://mratwork.com/
--2016-07-21 12:12:48--  https://mratwork.com/
Resolving mratwork.com... 62.210.181.21
Connecting to mratwork.com|62.210.181.21|:443... connected.
HTTP request sent, awaiting response...
  HTTP/1.0 403 Forbidden
  Date: Fri, 22 Jul 2016 12:10:21 GMT
  Server: Hiawatha v10.3
  Accept-Ranges: bytes
  Connection: keep-alive
  X-Hiawatha-Cache: 5
  Strict-Transport-Security: max-age=2592000;preload
  X-Supported-By: Kloxo-MR 7.0
  Access-Control-Allow-Origin: *
  X-Frame-Options: SAMEORIGIN
  X-XSS-Protection: 1;mode=block
  X-Content-Type-Options: nosniff
  Content-Length: 857
  Content-Type: text/html
2016-07-21 12:12:49 ERROR 403: Forbidden.
Code: 
> cd /tmp; wget -S --header="Proxy: 1.2.3.4:8080" https://www.shehoster.com/
--2016-07-21 12:13:01--  https://www.shehoster.com/
Resolving www.shehoster.com... 108.61.223.152
Connecting to www.shehoster.com|108.61.223.152|:443... connected.
HTTP request sent, awaiting response...
  HTTP/1.1 200 OK
  Date: Fri, 22 Jul 2016 12:29:42 GMT
  Content-Type: text/html; charset=utf-8
  Content-Length: 32100
  Last-Modified: Sat, 16 Jul 2016 12:05:24 GMT
  Connection: keep-alive
  Vary: Accept-Encoding
  ETag: "578a2304-7d64"
  Server: Google Webserver
  Expires: Sat, 23 Jul 2016 12:29:42 GMT
  Cache-Control: max-age=86400
  Strict-Transport-Security: max-age=31536000
  Accept-Ranges: bytes
Length: 32100 (31K) [text/html]
Saving to: `index.html.3'

     0K .......... .......... .......... .                    100%  210K=0.1s

2016-07-21 12:13:02 (210 KB/s) - `index.html.3' saved [32100/32100]
 
PusatHosting

PusatHosting

Hosting Guru
Pakai ini
Code: 
<?php

if (!function_exists('getallheaders'))  {
    function getallheaders()
    {
        if (!is_array($_SERVER)) {
            return array();
        }

        $headers = array();
        foreach ($_SERVER as $name => $value) {
            if (substr($name, 0, 5) == 'HTTP_') {
                $headers[str_replace(' ', '-', ucwords(strtolower(str_replace('_', ' ', substr($name, 5)))))] = $value;
            }
        }
        return $headers;
    }
}



if (isset($_GET['check']) && $_GET['check'] == 'yes')
{
    $hs = getallheaders();

    if (isset($hs['Proxy']) || isset($hs['proxy']))
        echo "bad";
    else
        echo "good";
    exit(0);
}


$http='http';
if ($_SERVER['HTTPS'] == 'on')
    $http='https';

$url = "$http://".$_SERVER['HTTP_HOST'].$_SERVER["SCRIPT_NAME"]."?check=yes";

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_HTTPHEADER, array("Proxy: evil"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$r = curl_exec($ch);
if ($r === false)
    echo curl_error($ch);

if ($r == 'good')
{
    ?><b>Good!</b>  Proxy has been filtered out.  No need to do anything<?php
}
elseif ($r == 'bad')
{
    ?><b>Bad!</b> You'll need to filter out the proxy header in your configs.<?php
}
else
{
    ?>No idea.. something went wrong:<br><textarea cols=80 rows=10><?=$r?></textarea><?php
}


curl_close($ch);


?>

Upload dan akses, Kalau keluarnya good artinya sudah di patch.
 
mustafaramadhan

mustafaramadhan

Hosting Guru
GPLHosting said:
Om @mustafaramadhan .. yg forum.mratwork.com dan hostspectra.com ngga sekalian di mitigasi ?
Click to expand...
Sudah dimitigasi. Berbeda hasil karena pakai hiawatha--proxy sedangkan mratwork.com pakai hiawatha (ingat Kloxo-MR 7.0 memungkinkan setiap website memilih pure hiawatha atau hiawatha-proxy jika server dipilih hiawatha-proxy sebagai webserver; ini juga berlaku untuk nginx-proxy dan lighttpd-proxy).

Pada pure hiawatha, hasil dari wget akan 'forbidden'. Sedangkan pada hiawatha-proxy hasilnya berupa proses donwload yang tidak selesai-selesai.
 
mustafaramadhan

mustafaramadhan

Hosting Guru
GPLHosting said:
Om @mustafaramadhan .. yg forum.mratwork.com dan hostspectra.com ngga sekalian di mitigasi ?
Click to expand...
Ternyata ada logic untuk bagian reverseproxy di hiawatha-proxy yang perlu di-fixed. SIlahkan periksa lagi hostspectra.com (pakai hiawatha-proxy) dan mratwork.com (pakai pure hiawatha).:16:
 
Status
Not open for further replies.

Top