Listen to this Post
Introduction:
Directory listing vulnerabilities expose sensitive server files to attackers, often due to misconfigurations. A lesser-known technique involves manipulating the HTTP “Range” header to force directory listings, potentially revealing critical data like config files, logs, and private keys. This article explores the exploit, mitigation strategies, and tools to test your servers.
Learning Objectives:
- Understand how the “Range” header can be abused for directory traversal.
- Learn to test servers for this vulnerability using cURL and other tools.
- Implement hardening measures to prevent unauthorized file exposure.
1. Testing for Directory Listing with cURL
Command:
curl -H "Range: 10000" http://target_domain
Explanation:
This command sends an HTTP request with a malformed “Range” header, tricking some servers into returning directory contents instead of a specific file. If successful, the response may list files like config.ini, logs/, or backup.zip.
Steps:
1. Run the command against your target domain.
- Analyze the response for directory listings or file disclosures.
- Check for sensitive data like SSH keys or database credentials.
2. Automating Detection with Nmap
Command:
nmap --script http-directory-listing -p 80,443 target_domain
Explanation:
Nmap’s `http-directory-listing` script detects open directory listings. While not specific to the “Range” header, it helps identify misconfigured servers.
Steps:
1. Install Nmap if not already present.
2. Run the script against web servers.
3. Review output for exposed directories.
3. Mitigating the Vulnerability (Apache/Nginx)
Apache Fix:
<Directory "/var/www/html"> Options -Indexes Header unset Range </Directory>
Nginx Fix:
location / {
autoindex off;
add_header X-Content-Type-Options "nosniff";
}
Explanation:
Disabling `Indexes` prevents directory listings, while `Header unset Range` (Apache) or `autoindex off` (Nginx) hardens against header manipulation.
4. Scanning for Exposed Files with Gobuster
Command:
gobuster dir -u http://target_domain -w /path/to/wordlist.txt -x .php,.bak
Explanation:
Gobuster brute-forces directories and files. Combine with the “Range” header technique to uncover hidden files.
Steps:
1. Use a wordlist (e.g., `common.txt`).
2. Specify extensions like `.bak` or `.conf`.
3. Review discovered files for sensitive data.
5. Monitoring and Logging Suspicious Requests
Command (Fail2Ban Rule):
[http-range-exploit] enabled = true filter = http-range logpath = /var/log/apache2/access.log maxretry = 3 bantime = 86400
Explanation:
Fail2Ban bans IPs repeatedly sending malformed “Range” headers.
Steps:
1. Add the rule to `/etc/fail2ban/jail.local`.
2. Restart Fail2Ban: `systemctl restart fail2ban`.
6. Cloud Hardening (AWS/Azure)
AWS S3 Bucket Policy:
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Deny",
"Principal": "",
"Action": "s3:ListBucket",
"Resource": "arn:aws:s3:::your-bucket",
"Condition": {"StringNotLike": {"aws:UserAgent": "Your-Allowed-Agent"}}
}]
}
Explanation:
Restricts bucket listing to specific User-Agents, reducing exposure.
7. API Security: Blocking Malformed Headers
OWASP ModSecurity Rule:
SecRule REQUEST_HEADERS:Range "@gt 100" \ "id:1000,phase:1,deny,msg:'Abusive Range Header'"
Explanation:
Blocks requests with abnormally large “Range” values.
What Undercode Say:
- Key Takeaway 1: The “Range” header exploit is a low-hanging fruit for attackers—test and patch servers proactively.
- Key Takeaway 2: Layered defenses (logging, WAF rules, and hardening) are critical to mitigate such flaws.
Prediction:
As HTTP/2 and cloud storage adoption grows, novel header manipulation techniques will emerge. Organizations must adopt zero-trust configurations and automate vulnerability scanning to stay ahead.
Final Word:
This vulnerability underscores the importance of secure defaults. Regular audits, proper server configurations, and threat modeling can prevent such exposures. For deeper dives, explore OWASP’s Secure Configuration Guide.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Aaandrei %F0%9D%90%83%F0%9D%90%A2%F0%9D%90%AB%F0%9D%90%9E%F0%9D%90%9C%F0%9D%90%AD%F0%9D%90%A8%F0%9D%90%AB%F0%9D%90%B2 – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
