Host of Troubles - Multiple Host Ambiguities in HTTP Implementations
Explore a conference talk from CCS 2016 examining multiple host ambiguities in HTTP implementations. Delve into the intricacies of multiparty interactions in the current Internet, focusing on the critical HTTP Host field. Learn about techniques like multiple Host headers and absolute-URI as request-target, and how different implementations handle these scenarios. Discover potential attacks exploiting host ambiguity, including cache poisoning and firewall bypass. Examine the prevalence of upstream/downstream vulnerabilities through measurement results and discuss mitigation strategies. Gain insights from authors representing Tsinghua University, University of California, Berkeley, International Computer Science Institute, and Huawei Canada as they present their findings on this crucial aspect of web security.