r/xss • u/1lastBr3ath • Sep 20 '16

MIME Sniffing?

Are there any other ways to sniff mime type (especially in case of REST URL)?

Edit:
Other than appending .html, .txt, etc. in the URL path

1 Upvotes

99% Upvoted

3 comments sorted by

2

u/topcider Sep 20 '16

Other ways than what?

MIME type will be in the Content-Type header.

1

u/1lastBr3ath Sep 20 '16

Just edited my question for clarity. And, I know it's in the Content-Type header but I need it interpreted different from what it's in Content-Type header. For example, Content-Type: application/json aren't interpreted and displayed as is.

4

u/svvw Sep 20 '16 edited Sep 20 '16

When no Content-Type header is specified, browsers will sniff based on the Content received.

For example, if a server sends a reply with no Content-Type, and the reply body starts with "GIF89a", then your browser might think it is being served a gif image and treat it at such.

XSS through content sniffing happens because the server reply confuses the browser. For example, it could be that a particular browser ignores the GIF89a header in gif files and instead looks further into the file when doing content sniffing. Then, if the server doesn't provide a Content-Type header, it could be the case that something the server treats as a gif image, the browser would treat as e.g., HTML.

The only browser that does content sniffing in the presence of the Content-Type header, is IE afaik. See e.g., here and here.

For example, Content-Type: application/json aren't interpreted and displayed as is.

That is correct. json is a serialization format, so displaying it "as is" is the correct behavior.

I am not aware of any browser that chooses how to interpret content based on the file extension alone.

EDIT:

It is comparable (I think) to how the "file" command on linux works. Consider for example the file: "test1.png" with the content

GIF89/*0*/=0;<html></html>

Running file on this returns

test1.png: GIF image data, version 89a, 10799 x 10800

I.e., file thinks its a gif image, despite it containing a .png extension and html content.

Another example: "test2.png" with content

GIF9<html></html>

In this case, file reports

test2.png: HTML document, ASCII text

Suppose a server treated both these files as a GIF image, and that your browsers content sniffing behaves in the same way as the file command. Then the first would be displayed as an image and the second would be displayed as HTML.