某些客户端的 HTTP 标头的字符被随机替换
正在进行网络流量和日志分析，但有很多从客户端传递的格式错误的标头。这些字符被转调或替换为“x”。
有谁知道它们来自哪里或为什么？ 这是某种安全尝试，还是更邪恶的行为？
示例：
xroxy-connection: Keep-Alive cneoction: close nncoection: close ocpry-connection: Keep-Alive pxyro-connection: close proxy-~~~~~~~~~~: ~~~~~~~~~~ x-xorwarded-for: 000.00.00.000 Referer: http://www.example.xom/nxws/article/2009-1x-21/?cid=4xxx00x2-0x60x3x0
Doing web traffic and log analysis, but there are a lot of malformed headers being passed from clients. These have characters transposed or replaced with "x"'s.
Does anyone know where they come from or why?
Is this some kind of attempt at security, or something more nefarious?
Examples:
xroxy-connection: Keep-Alive cneoction: close nncoection: close ocpry-connection: Keep-Alive pxyro-connection: close proxy-~~~~~~~~~~: ~~~~~~~~~~ x-xorwarded-for: 000.00.00.000 Referer: http://www.example.xom/nxws/article/2009-1x-21/?cid=4xxx00x2-0x60x3x0
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
查看 HTTP 标头的乐趣。笔者认为：
Check out the Missed Cneonctions section of Fun With HTTP Headers. The author thinks:
Google 搜索“xroxy-connection” 会出现安全性关于 Kerio Winroute Firewall 的建议，该防火墙将标头中的第一个字符替换为 X原因。
如果我不得不猜测的话，字母换位可能是一个类似的代理问题。
A Google search for "xroxy-connection" turns up a security advisory on Kerio Winroute Firewall which replaces the first character in a header with an X for some reason.
The letter transposition is probably a similar proxying issue, if I had to take a guess.