# HTTP Header Analysis

> Analyze HTTP response headers to identify server technologies, security misconfigurations, and information disclosure vulnerabilities during web enumeration.

- **URL:** https://hackindex.io/services/web/enumeration/http-header-analysis
- **Path:** HTTP/HTTPS > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/web/enumeration.md)
- **Published:** 2026-03-28
- **Updated:** 2026-04-24

HTTP response headers reveal security posture, server stack, and configuration mistakes without any active exploitation. Missing security headers directly lower the bar for XSS, clickjacking, and CSRF attacks. Permissive CORS headers enable cross-origin data theft. Weak cookie flags enable session hijacking over non-HTTPS connections. This analysis runs after [tech fingerprinting](https://hackindex.io/services/web/enumeration/http-tech-fingerprinting) and feeds findings directly into [misconfiguration scanning](https://hackindex.io/services/web/vulnerability-discovery/misconfiguration-scan) and [CORS misconfiguration testing](https://hackindex.io/services/web/vulnerability-discovery/cors-misconfiguration).

## Full Header Dump

Pull all response headers from the main page and any authenticated endpoints you have access to:

```bash
curl -skI https://$DOMAIN/
# HTTP/2 200
# server: nginx/1.18.0
# strict-transport-security: max-age=31536000
# x-frame-options: SAMEORIGIN
# x-content-type-options: nosniff
# set-cookie: session=abc123; Path=/; HttpOnly
# content-type: text/html; charset=utf-8
```

```bash
curl -skI https://$DOMAIN/ | grep -iE 'content-security-policy|x-frame-options|strict-transport-security|x-content-type-options|permissions-policy|referrer-policy|cross-origin'
# x-frame-options: SAMEORIGIN
# x-content-type-options: nosniff
```

## Security Header Assessment

Check which security headers are present and assess their configuration:

| Header | Missing enables |
| --- | --- |
| Content-Security-Policy | XSS execution without bypass |
| X-Frame-Options | Clickjacking attacks |
| Strict-Transport-Security | SSL stripping, downgrade attacks |
| X-Content-Type-Options | MIME type sniffing attacks |
| Referrer-Policy | Credential leakage in referrer |
| Permissions-Policy | Unrestricted browser API access |

## Cookie Flag Analysis

Cookie flags control how browsers handle session tokens. Weak flags are findings even without active exploitation:

```bash
curl -skI https://$DOMAIN/ | grep -i 'set-cookie'
# set-cookie: session=abc123; Path=/; HttpOnly
# set-cookie: tracking=xyz; Path=/
```

Flag analysis:

- `HttpOnly` missing: JavaScript can read the cookie: XSS leads to session theft
- `Secure` missing on a session cookie: cookie sent over HTTP: interceptable on mixed networks
- `SameSite` missing or set to `None`: CSRF attacks are viable
- `SameSite=None` without `Secure`: rejected by modern browsers but indicates misconfiguration

## CORS Header Check

A permissive CORS configuration allows attacker-controlled pages to make authenticated requests to the API. Test by sending an Origin header and examining the response:

```bash
curl -skI https://$DOMAIN/api/v1/users -H 'Origin: https://attacker.com' | grep -i 'access-control'
# access-control-allow-origin: https://attacker.com
# access-control-allow-credentials: true
```

`access-control-allow-origin` reflecting your supplied origin combined with `access-control-allow-credentials: true` is a critical CORS misconfiguration. It means any origin you control can make authenticated cross-origin requests to this API using the victim's cookies. Move to [CORS misconfiguration testing](https://hackindex.io/services/web/vulnerability-discovery/cors-misconfiguration) to confirm exploitability.

```bash
curl -skI https://$DOMAIN/api/v1/users -H 'Origin: null' | grep -i 'access-control'
# access-control-allow-origin: null
# access-control-allow-credentials: true
```

A null origin reflection is also exploitable via sandboxed iframes. Test both a random origin and the null origin before concluding.

## Server and Technology Leakage

Server version disclosure gives attackers version-specific CVE targets without any active scanning:

```bash
curl -skI http://$TARGET_IP:$PORT/ | grep -iE 'server|x-powered-by|x-aspnet|x-aspnetmvc'
# Server: Apache/2.4.18 (Ubuntu)
# X-Powered-By: PHP/7.2.3
```

Apache 2.4.18 and PHP 7.2.3 are both end-of-life with multiple known CVEs. Cross-reference immediately with searchsploit and nuclei CVE templates. Exact version disclosure in headers makes vulnerability targeting trivial for an attacker.

## References

- [OWASP Secure Headers Project](https://owasp.org/www-project-secure-headers/) - Security header reference including recommended values and attack scenarios
- [MDN: Cross-Origin Resource Sharing](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) - CORS header specification and access-control-allow-credentials behavior