Almost there, tomorrow I will publish the last but probably less serious tips then we can unroll it 🎅 hopefully others will do a similar short-continues note sharing in the future so we can see overlooked/secret stuffs.
From now until Christmas, I will try to share something from my notes / research every day - most of them are old but might still be useful to remember #XMas2020#AppSec#Web#HTTP
"max-forwards" http header:
- limit the number of proxies a request can traverse.
- not hop-by-hop
- can't go in the Trailer header
In something like JS
/*/ comment /*/
is the same as
/* comment */
, makes sense, right? But MSSQL sees it as
/* comment /*...
more interestingly, if you want to close it, you need 2 */
This is important when injections go into multiple places and newline is involved!