MIME and Media Type sniffing explained and the type of attacks it leads to

Any content served through HTTP “should” include meta data about its type. This is so the browser/client knows what to do with the content it receives. For example, if the content type header is an image the browser will preview it, if it is HTML it will render the markup and execute any javascript code.

Content type however is optional and web masters sometimes don’t set it, which leave the browsers wondering about the content type it is consuming. So browsers had to implement parsing and “sniffing” techniques to detect the type of content when a content type header was not served.

However, this caused security problems and attacks that we explain in this video! So to prevent sniffing, web servers can return X-Content-Type-Options: nosniff which opts out browsers from sniffing the content.

Cheers!
Hussein Nasser

[crown-is]

Hey thanks for the video!
So for example: An attacker uploads a malicious html file with a jpg extension, essentially targeting users with older browsers. These olders browsers like IE6 are vulnerable to this attack because they make use of content sniffing. Content sniffing is a browser feature that tries to guess a file's MIME type by reading it's content.

There's two problems now: First of all, the server has been a target of an attack and now hosts a malicious file. Second, users with old browsers become victims when they open the file.

In order to mitigate the situation, we as web developers can set the X-Content-Type-Options header on our responses so old browsers won't try to guess the mime type (solving only problem 2). Correct?

Only browsers honoring the X-Content-Type-Options header are safe. When was this header introduced? Was IE6 for example updated by Microsoft to honor this header?

So what I'm saying is that the suggested mitigating solution is only an attempt to solve this problem right? I'm trying to understand, as I'm researching some common alerts the OWASP ZAP tool gives me.

[NS-yjfx]

wow someone actually knows how explain things finally

[kenzotenma]

I felt a little confusion in your explanation (or maybe I didn't understand what you meant well enough).
You could have a "Content-Type" header and still notice MIME sniffing, we prevent that with the X-Content-Type-Options header (that you mentioned at the end).
Therefore, MIME sniffing doesn't occur only when the header "Content-Type" is not present.

Resource: developer.mozilla.org > Content-Type

Paragraph:
"In responses, a Content-Type header tells the client what the content type of the returned content actually is.
Browsers will do MIME sniffing in some cases and will not necessarily follow the value of this header; to prevent this behavior, the header X-Content-Type-Options can be set to nosniff."

[athangbachhav]

Thank You SO Much Buddy !
It was fun learning mime Sniff !!
Looking forward to learn more exciting things from you !
Cheers !

[Marclisek]

That's the damn best explanatory video I have ever seen. Subscribed and hope for more content in the future.

[nemesisc]

THANK YOU VERY MUCH!
Helps for CTFs which you should do a walk through on!

[georgenam]

Awesome stuff, and nice job keeping it entertaining. Really broke it down eli5 style and helped me out!

[dineshsharma]

Great stuff Buddy, You really cleared my doubt. Thaks for this great video.

[palaniappanrm]

Nice video again 👌 Does common web servers such as node http-server and apache web server adds the content-type automatically while serving the static files?

[shayansec]

Thanks for explaining in such a great way.

[salsalsal]

Great explanation, Thank you very much

[Davidepalte]

Great video, you explain very well! I just think it would be much better for the listener if you had a proper microphone.
The use of gliffy could be improved using powerpoint but it's rather amusing to see your interaction with the material.

Thank you!

[tyrrelldavis]

I'm having trouble with this in an SSR app, particularly getting images to show in my views/*.ejs files. Or loading any static resource like css, javascripts, images .

Resource from was blocked due to MIME-Type ("text/html") mismatch (X-content-type-options: nosniff)

I am using helmet with express, could that be the reason?

Is it because my /views/ directory is behind or on the same level as my /public/ directory in terms of relative paths.

Appreciate the vids my dude, every time I have a weird problem, you always have a video explaining it, props.

[age]

So You Told Tht It Run Badjs but where is the Badjs file (script file) located?? in your server right???

[yadusolparterre]

Nice video! But you siad devs don't want to create a MIME-Type for each of their files. So what happens if they activate the No-Sniffing header, that means they need to set the MIME-Type for each file they serve, no?

[sundaramjha]

Nice video, i have read lot of documents but i didnt understand what it is exactly. But now i understood. Could u please make more video on security point like x-frame-option, x-xss-protection etc.So it will beneficial for us. Thank you.

[abe]

i really like your video fun way to learn