| #!/usr/bin/perl |
| # Script to generate a 304 HTTP status with (illegal) X-XSS-Protect headers. |
| # Relies on its nph- filename to invoke the CGI non-parsed-header facility. |
| |
| $protocol = $ENV{'SERVER_PROTOCOL'}; |
| $software = $ENV{'SERVER_SOFTWARE'}; |
| $if_modified = $ENV{'HTTP_IF_MODIFIED_SINCE'}; |
| $nonce = int(rand(100000)); |
| |
| if ($if_modified) { |
| print "$protocol 304 Not Modified\r\n"; |
| print "Server: $software\r\n"; |
| print "X-XSS-Protection: 0\r\n"; |
| print "Connection: close\r\n"; |
| exit(0); |
| } |
| |
| print "$protocol 200 OK\r\n"; |
| print "Server: $software\r\n"; |
| print "Content-type: text/html\r\n"; |
| print "Expires: Wed, 21 Nov 2037 19:19:13 +0000\r\n"; |
| print "Last-Modified: Mon, 08 Nov 2010 19:19:13 +0000\r\n"; |
| print "X-XSS-Protection: 1\r\n"; |
| print "\r\n"; |
| print "<!DOCTYPE html>\r\n"; |
| print "<html>\r\n"; |
| print "<body>\r\n"; |
| print "<input id=\"rand\" type=\"text\" value=\"$nonce\"/>\r\n"; |
| print "<script>alert(/XSS/);</script>\r\n"; |
| print "</body>\r\n"; |
| print "</html>\r\n"; |
