3

With my current interest in the CRIME attack, I am currently trying to check if there actually exits a way to "fingerprint" a server that supports SPDY?

My research lead me to believe only that the response header "X-Firefox-SPDY" can help. Is there another way?

Gilles 'SO- stop being evil'
  • 50,912
  • 13
  • 120
  • 179
Metahuman
  • 493
  • 1
  • 5
  • 12
  • Do you have malicious intent? – Lucas Kauffman Sep 23 '12 at 09:20
  • Nope. None what so ever. My question stemmed from the fact that I could only detect SPDY existence on Twitter, GMail, etc. by means of the response header. So I wanted to know if you have a way to detect it. That is all. – Metahuman Sep 23 '12 at 09:52
  • 2
    Try to connect to it using SPDY protocol, one would soon find out if there is SPDY there or not... – ewanm89 Sep 24 '12 at 00:53

1 Answers1

5

The answer to your question would depend on the context in which you're interested.

If you're interested in detecting SPDY servers while browsing the web you'll first need a browser that supports SPDY (e.g. Firefox 11+ or Chrome). In this scenario the best way to detect SPDY is browser dependant.

For Chrome there are a couple of ways:

  • You can browse to chrome://net-internals/#spdy for a list of all currently open SPDY connections (because SPDY connections are persistent - every tab that contains a document from a server which supports SPDY should be present).
  • If you're interested only in the current tab you might examine the window.chrome.loadTimes().wasFetchedViaSpdy DOM property.

For Firefox, the only way I'm aware of is to look for the presence of X-Firefox-Spdy response header. Do note that for this to work, you must enable SPDY support (it is on by default as of Firefox 13, otherwise - set network.http.spdy.enabled to true.

All this depends on using a SPDY enabled browser, and manually checking servers. If you'll want to automate this, use a browser that doesn't support SPDY, or just plainly skip the browser - you'll need another strategy. As I see you have two options in this case:

  • SPDY servers can be configured to advertise their support of SPDY when sending HTTP responses. This would require you to inspect the presence of the appropriate Alternative-Protocol headers (outlined in the SPDY draft).

  • Simply establish a TCP connection to the server an send it a SETTIGNS (HELLO) or a SYN_STREAM frame and see if it responds according to the SPDY protocol.

Drag0nR3b0rn
  • 261
  • 1
  • 3