2

I tried following command openssl s_client -connect google.com:443 and was able to connect with google.com over SSL.

But when I tried to get some resource using GET /?q=cats HTTP/1.1 <enter> Host google.com <enter><enter> then I got below message:

HTTP/1.1 400 Bad Request
Date: Wed, 19 Aug 2015 21:12:02 GMT
Server: Apache
Content-Length: 307
Connection: close
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>400 Bad Request</title>
</head><body>
<h1>Bad Request</h1>
<p>Your browser sent a request that this server could not understand.<br />
Request header field is missing ':' separator.<br />
<pre>
Host google.com</pre>
</p>
</body></html>
closed

If I do not specify any HTTP version and use GET /?q=cats <enter> then I get below response. In the response I can see correct URL https://www.google.co.in/?q=cats&gws_rd=cr&ei=yPPUVYeVApGzuATIkpuQCw and if I use same in browser then it works.

Am I missing some headers or something else?

HTTP/1.0 302 Found
Location: https://www.google.co.in/?q=cats&gws_rd=cr&ei=yPPUVYeVApGzuATIkpuQCw
Cache-Control: private
Content-Type: text/html; charset=UTF-8
P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
Date: Wed, 19 Aug 2015 21:23:20 GMT
Server: gws
Content-Length: 273
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Set-Cookie: PREF=ID=1111111111111111:FF=0:TM=1440019400:LM=1440019400:V=1:S=fdzyHaeMMBcBYPPy; expires=Fri, 18-Aug-2017 21:23:20 GMT; path=/; domain=.google.com
Set-Cookie: NID=70=Xxap0a_fYjPIwnvwUuyUqKaT6UH6ZjttA6zv6CYv8qVGMCuOEyNRc8hR2JCi1X_8522QMF2OpsG9dDrWphQh-df0orBmG-DC0WCTF9A_YVJYp3YSgQyap5GlL11EBjff; expires=Thu, 18-
Feb-2016 21:23:20 GMT; path=/; domain=.google.com; HttpOnly
Alternate-Protocol: 443:quic,p=1
Alt-Svc: quic=":443"; p="1"; ma=604800

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>302 Moved</TITLE></HEAD><BODY>
<H1>302 Moved</H1>
The document has moved
<A HREF="https://www.google.co.in/?q=cats&amp;gws_rd=cr&amp;ei=yPPUVYeVApGzuATIkpuQCw">here</A>.
</BODY></HTML>
read:errno=0

Another kind of 302 response.

**GET / HTTP/1.1
Host: www.google.com**

HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Location: https://www.google.co.in/?gfe_rd=cr&ei=7_3UVfDeCuPI8AeMkZzwDQ
Content-Length: 262
Date: Wed, 19 Aug 2015 22:06:39 GMT
Server: GFE/2.0
Alternate-Protocol: 443:quic,p=1
Alt-Svc: quic=":443"; p="1"; ma=604800

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>302 Moved</TITLE></HEAD><BODY>
<H1>302 Moved</H1>
The document has moved
<A HREF="https://www.google.co.in/?gfe_rd=cr&amp;ei=7_3UVfDeCuPI8AeMkZzwDQ">here</A>.
</BODY></HTML>
4
  • Why do you think this is related to infosec? To me it looks like the problem is related to the API and not your use of SSL. Aug 19, 2015 at 21:31
  • @NeilSmithline Then which SO site you think would be right to put up this question? This is where folks will know more about SSL communication and all ...
    – hagrawal
    Aug 19, 2015 at 21:35
  • I was just asking why you think this is related to security. It sounds like you think that SSL is the problem. I was just asking why. Aug 19, 2015 at 21:36
  • Ok. Problem is not SSL but related to SSL communication.
    – hagrawal
    Aug 19, 2015 at 21:38

1 Answer 1

7

When Google says

Request header field is missing ':' separator.

What they actually mean is that the header field in the request needs to use a ':' separator.

So instead of sending this:

GET /?q=cats HTTP/1.1<enter> 
Host google.com<enter>
<enter>

You need to send this:

GET /?q=cats HTTP/1.1<enter> 
Host: google.com<enter>
<enter>

(Note the : separating "Host" and "google.com")

Once that's out of the way, you get a 302:

HTTP/1.0 302 Found
Location: https://www.google.co.in/?q=cats&gws_rd=cr&ei=yPPUVYeVApGzuATIkpuQCw

I actually get a 301 on the same request:

HTTP/1.1 301 Moved Permanently
Location: https://www.google.com/?q=cats

These are not error responses, they are redirection responses. Google has heard our request, and would like us to re-request it differently. In my case, it told me I shouldn't ask "google.com", I should ask "www.google.com", and I should keep that in mind for next time. In your case it wanted you to go to www.google.co.in and to use a different query string - presumably you're in India and they want you to hit a local version of Google. As for wanting you to use a different query string, well, those are normal looking Google query string (gws_rd, ei) parameters; they're just neatening up your query for you.

This is normal web application behavior. You crafted a query by hand. The Web App (Google) didn't like certain aspects of your query, and rewrote it to be more compliant with what would have happened had you gone in a regular browser and searched for "cats". They then handed this new URL to your client (openssl in this case) and told it to go ask again. But since you're doing this by hand, you didn't ask again, and instead you misconstrued it as an error condition.

If I do as they ask and repeat my query but with Host: www.google.com instead of Host: google.com, I get the results you would expect if you were searching for cats.

4
  • Good catch, thanks. But still it doesn't work. I get 302 error, similar to which I put in last part of my question. Aug 19, 2015 at 22:07
  • @hagrawal, updated to address - basically, 302 isn't an error, it's a helpful hint from the application.
    – gowenfawr
    Aug 19, 2015 at 23:06
  • Thanks buddy. However I was able to get the response with Host: google.co.in, no need to www because I think if domain name is resolved then it is presumed by openssl that it would be world wide web request. Aug 19, 2015 at 23:16
  • @hagrawal: No, OpenSSL doesn't have anything with "world wide web requests", and the web doesn't care if a domain has www or not. Aug 20, 2015 at 7:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .