Skip to content
HackIndex logo

HackIndex

HTTP Header Analysis

4 min read Apr 24, 2026

HTTP response headers reveal security posture, server stack, and configuration mistakes without any active exploitation. Missing security headers directly lower the bar for XSS, clickjacking, and CSRF attacks. Permissive CORS headers enable cross-origin data theft. Weak cookie flags enable session hijacking over non-HTTPS connections. This analysis runs after tech fingerprinting and feeds findings directly into misconfiguration scanning and CORS misconfiguration testing.

Full Header Dump

Pull all response headers from the main page and any authenticated endpoints you have access to:

┌──(kali㉿kali)-[~]
└─$ curl -skI https://$DOMAIN/ 
HTTP/2 200
server: nginx/1.18.0
strict-transport-security: max-age=31536000
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
set-cookie: session=abc123; Path=/; HttpOnly
content-type: text/html; charset=utf-8
Explain command
-s Silent mode; suppresses progress and error messages.
-k Allow insecure connections; skip SSL/TLS certificate verification.
-I Send HEAD request; fetch response headers only.
https://$DOMAIN/ Target URL with variable domain placeholder over HTTPS.
┌──(kali㉿kali)-[~]
└─$ curl -skI https://$DOMAIN/ | grep -iE 'content-security-policy|x-frame-options|strict-transport-security|x-content-type-options|permissions-policy|referrer-policy|cross-origin' 
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allows insecure TLS connections by skipping certificate verification.
-I Sends a HEAD request and retrieves only response headers.
https://$DOMAIN/ Target URL with variable placeholder for the domain to inspect.
-iE Case-insensitive matching with extended regex pattern support.
'content-security-policy|x-frame-options|strict-transport-security|x-content-type-options|permissions-policy|referrer-policy|cross-origin' Regex pattern matching common HTTP security response headers.

Security Header Assessment

Check which security headers are present and assess their configuration:

Header

Missing enables

Content-Security-Policy

XSS execution without bypass

X-Frame-Options

Clickjacking attacks

Strict-Transport-Security

SSL stripping, downgrade attacks

X-Content-Type-Options

MIME type sniffing attacks

Referrer-Policy

Credential leakage in referrer

Permissions-Policy

Unrestricted browser API access

Cookie flags control how browsers handle session tokens. Weak flags are findings even without active exploitation:

┌──(kali㉿kali)-[~]
└─$ curl -skI https://$DOMAIN/ | grep -i 'set-cookie' 
set-cookie: session=abc123; Path=/; HttpOnly
set-cookie: tracking=xyz; Path=/
Explain command
-s Silent mode; suppresses progress and error output.
-k Allow insecure TLS connections, skipping certificate verification.
-I Send HEAD request, fetching headers only.
https://$DOMAIN/ Target URL using variable placeholder for the domain.
-i Case-insensitive matching for the grep pattern.
'set-cookie' Filter output to show only Set-Cookie response headers.

Flag analysis:

  • HttpOnly missing: JavaScript can read the cookie — XSS leads to session theft

  • Secure missing on a session cookie: cookie sent over HTTP — interceptable on mixed networks

  • SameSite missing or set to None: CSRF attacks are viable

  • SameSite=None without Secure: rejected by modern browsers but indicates misconfiguration

CORS Header Check

A permissive CORS configuration allows attacker-controlled pages to make authenticated requests to the API. Test by sending an Origin header and examining the response:

┌──(kali㉿kali)-[~]
└─$ curl -skI https://$DOMAIN/api/v1/users -H 'Origin: https://attacker.com' | grep -i 'access-control' 
access-control-allow-origin: https://attacker.com
access-control-allow-credentials: true
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allows insecure TLS connections by skipping certificate verification.
-I Sends a HEAD request, fetching only response headers.
https://$DOMAIN/api/v1/users Target URL with variable domain pointing to a users API endpoint.
-H 'Origin: https://attacker.com' Injects a custom Origin header to test CORS policy responses.

access-control-allow-origin reflecting your supplied origin combined with access-control-allow-credentials: true is a critical CORS misconfiguration. It means any origin you control can make authenticated cross-origin requests to this API using the victim's cookies. Move to CORS misconfiguration testing to confirm exploitability.

┌──(kali㉿kali)-[~]
└─$ curl -skI https://$DOMAIN/api/v1/users -H 'Origin: null' | grep -i 'access-control' 
access-control-allow-origin: null
access-control-allow-credentials: true
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allows insecure TLS connections by skipping certificate verification.
-I Sends a HEAD request and fetches HTTP headers only.
https://$DOMAIN/api/v1/users Target URL with variable domain pointing to users API endpoint.
-H 'Origin: null' Sets Origin header to null to test CORS null origin handling.

A null origin reflection is also exploitable via sandboxed iframes. Test both a random origin and the null origin before concluding.

Server and Technology Leakage

Server version disclosure gives attackers version-specific CVE targets without any active scanning:

┌──(kali㉿kali)-[~]
└─$ curl -skI http://$TARGET_IP:$PORT/ | grep -iE 'server|x-powered-by|x-aspnet|x-aspnetmvc' 
Server: Apache/2.4.18 (Ubuntu)
X-Powered-By: PHP/7.2.3
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allows insecure SSL connections by skipping certificate verification.
-I Sends a HEAD request to fetch HTTP headers only.
http://$TARGET_IP:$PORT/ Target URL composed of dynamic IP and port variables.
-iE Case-insensitive match using extended regular expressions.
'server|x-powered-by|x-aspnet|x-aspnetmvc' Regex pattern to filter common server/tech-disclosure response headers.

Apache 2.4.18 and PHP 7.2.3 are both end-of-life with multiple known CVEs. Cross-reference immediately with searchsploit and nuclei CVE templates. Exact version disclosure in headers makes vulnerability targeting trivial for an attacker.

References