Exploiting vulnerabilities through HTTP headers

When it comes to input validation and sanitization, some developers focus on URL and body parameters, overlooking the fact that the whole request can be manipulated in the client side and allow for malicious payload to be included in cookies and header values.

In this recipe, we will identify and exploit a vulnerability in a header whose value is reflected in the response.

How to do it...

We now came back to Mutillidae. This time, we will use the OWASP 2013 | A1 - Injection (SQL) | Bypass Authentication | Login exercise:

1. First, send a request with any non-existent user and password so the login fails
2. Send the request to Burp Suite's Repeater and submit it so we can have a reference response.
3. Once in Repeater, we will test SQL Injection vector in the User-Agent header and append '+and+'1'=' to the header's value.
4. If we compare the responses of both requests, we will see that the one with the injection is a few bytes bigger than the original one, as...