HTTP: HTTP Version 1.0 with Host Header

This signature detects HTTP version 1.0 requests which include a "Host" header. RFC-1945 defines the HTTP 1.0 protocol, which does not support host headers. Most HTTP servers will accept host headers from a version 1.0 request regardless. Some poorly-written HTTP clients, including malware and DDOS programs, will attempt to send a host header with a version 1.0 request. This request is technically incorrect, however, it is not inherently malicious.

References

URL: http://www.ietf.org/rfc/rfc1945.txt

Short Name

HTTP:AUDIT:HTTP-1.0-HOST-HEADER

Severity

Warning

Recommended

False

Recommended Action

None

HTTP: HTTP Version 1.0 with Host Header

References

Found a potential security threat?