X-Request-Purpose: Identifying "research" and bug bounty related scans?, (Thu, Oct 30th)
Source SANS ISC Handlers Diary
Description
This week, I noticed some new HTTP request headers that I had not seen before:
Impact
For European organizations, the impact of these headers is primarily operational rather than technical. Legitimate bug bounty scans identified by these headers can help organizations prioritize and manage vulnerability reports, improving their security posture. However, if attackers spoof these headers, they may attempt to bypass security controls that trust such signals, potentially increasing the risk of undetected malicious activity. Misinterpreting these headers could lead to either ignoring malicious scans or unnecessarily blocking legitimate research traffic, both of which can negatively affect security operations and incident response. Since these headers do not introduce a direct vulnerability, the risk lies in how organizations handle and interpret them. European organizations with active bug bounty programs or those targeted by researchers using these headers should ensure their security monitoring and filtering systems do not rely solely on these headers for decision-making. Proper handling supports compliance with responsible disclosure practices and helps maintain good relationships with the security research community. The presence of these headers in honeypots within corporate networks suggests that some European enterprises may see increased scanning activity labeled as research, requiring careful analysis to distinguish benign from malicious traffic.
Defensive guidance
1. Do not rely solely on the presence or absence of these headers to allow or block HTTP requests; instead, analyze the full request context, including IP reputation, request behavior, and payload content. 2. Implement comprehensive logging and monitoring to detect anomalous scanning or probing activity regardless of headers. 3. Publish a /.well-known/security.txt file on public-facing websites to provide clear security contact information and encourage responsible vulnerability disclosure. 4. Educate security teams about the voluntary nature of these headers and the potential for spoofing to avoid misplaced trust. 5. Incorporate threat intelligence feeds and behavioral analytics to better differentiate legitimate research from malicious activity. 6. Review and update web application firewalls (WAF) and intrusion detection/prevention systems (IDS/IPS) rules to avoid false positives or negatives based on these headers. 7. Engage with bug bounty platforms and researchers to understand their scanning practices and coordinate on scope and communication channels. 8. Regularly audit honeypots and corporate network segments to identify unexpected scanning activity and investigate its origin.
Summary
Recently, new HTTP request headers such as X-Request-Purpose: Research, X-Hackerone-Research: plusultra, X-Bugcrowd-Ninja: plusultra, and X-Bug-Hunter: true have been observed in network traffic. These headers are voluntarily added by security researchers participating in bug bounty programs to identify their scanning or testing activities. The intent behind these headers is to allow organizations to recognize legitimate security research traffic, differentiate it from malicious scans, and facilitate communication with researchers if their activities cause issues. For example, Web.com requests such headers as part of their Bugcrowd engagement. However, these headers are not standardized or enforced and can be easily spoofed by any actor, including malicious ones attempting to masquerade as researchers to evade detection or gain trust. The presence of these headers in honeypots, including those within corporate networks, indicates that bug bounty scans may be in scope for some corporate environments or that attackers are attempting to exploit this trust mechanism. From a defensive perspective, relying solely on these headers for filtering or blocking is ineffective and potentially risky. Instead, organizations should analyze the full context of requests, including behavior, origin, and payload, to make access decisions. Additionally, publishing a /.well-known/security.txt file as per RFC 9116 is recommended to provide a standardized way for researchers to find security contact information and report vulnerabilities. Overall, these headers represent a voluntary signaling mechanism within the security research community but do not constitute a vulnerability or threat by themselves.