Incorrect Host Field Redirection Detection

fuzz.py

# BUG: Incorrectly configured proxy servers can inadvertently redirect web
# traffic to the wrong hosts.
# This script tests for bad redirection against a CSV list of sites in the
# format:
#     <index:int>,<host:string>
#
# Usage Instructions:
# 1. Alexa Top 1m: 'http://s3.amazonaws.com/alexa-static/top-1m.csv.zip'
# 2. `echo [] > seen.json`
# 3. `python fuzz.py >> results.txt`
# 4. `cat results.txt | grep True`

import httplib
import json


# Number of hosts to test from the list.
# Previously seen hosts are ignored.
LIMIT = 50


def json_load_set(path):
    with open(path, 'r') as f:
        res = json.load(f)
    return set(res)


def json_write_set(theset, path, indent=0):
    with open(path, 'w') as f:
        json.dump(list(theset), f, indent)


def is_handled_incorrectly(host, port, value):
    headers = {
        'Host': value
    }
    conn = httplib.HTTPConnection(host, port)
    conn.request('GET', '/', '', headers)
    resp = conn.getresponse()
    conn.close()
    # We expect a 200. 4XX could mean that the host in the data source is
    # corrupt. 302 indicates a proxy misconfiguration.
    return resp.status == 302


def main():
    count = 0
    incorrect = []
    seen = json_load_set('seen.json')
    with open('top-1m.csv', 'r') as f:
        while count < LIMIT:
            line = f.readline()
            if not line.strip():
                continue
            index, host = line.split(',')
            index = int(index)
            host = 'www.' + host.strip()  # Change to test other subdomains.
            if index in seen:
                continue
            # The following server responds 'success' to any given Host.
            result = is_handled_incorrectly('54.64.35.200', '80', host)
            if result:
                incorrect.append(host)
            print index, host, result
            seen.add(index)
            count += 1
    json_write_set(seen, 'seen.json')


if __name__ == '__main__':
    main()