> -----Original Message----- > From: Thor Larholm [mailto:[EMAIL PROTECTED] > Sent: Thursday, June 10, 2004 6:10 PM > To: Drew Copley; [EMAIL PROTECTED]; > [EMAIL PROTECTED] > Cc: [EMAIL PROTECTED] > Subject: RE: COELACANTH: Phreak Phishing Expedition] > > You can't replicate this with most other servers because the > Host header > is set to a non-existant site on most servers. > > Whenever IIS or Apache receives a request it will first locate the > proper site based on the IP adress being used, after which it will > lookup based on the Host header. In the case of e-gold, they > have simply > not specified a Host header for the IIS website that they configured. > You can send a HTTP request to e-gold.com with "Host: foobar" > and their > site still comes up, even though you should only get their site with a > header such as "Host: e-gold.com" or "Host: www.e-gold.com". > > HTTP 1.1 requires the use of a Host header and it is bad practice to > accept HTTP requests without a Host header that corresponds > to a locally > configured site.
<snip> I use no host header and munged ones all the time, using custom clients and servers for testing. No one has a problem with this, not Apache, nor IIS, anyway. (I won't get on the subject of RFC compliancy except to say it is something quite often ignored...) I believe the bitlance solution this morning is correct. It is a magic dns issue. "whatevercraphere.com.yourmagicdnssite.com" being allowed is the problem. Very amusing situation in an academic kind of way... _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
