How to get the http headers for asp.net requests from a dump file

  • Artigo

So, you have a managed dump and you want to find out the request headers. Here’s one of the methods I use to find this information. I use it especially when I want to view the session ID or cookies.

  • Load SOS
  • Run !aspxpages and note down the HttpContext address you are interested in. Eg:

0x120bea74 54000 Sec yes XXX 200 GET /default.aspx
0x14244228 54000 Sec no 284 Sec XXX 200 GET /default.aspx
0x1426f4c0 54000 Sec no 101 Sec XXX 200 GET /default.aspx
0x163a3038 54000 Sec no 193 Sec XXX 200 GET /default.aspx
0x1e0c360c 54000 Sec no 376 Sec 39 200 GET /default.aspx

  • Dump the HttpContext noted in Step 2: !do 0x1426f4c0
  • Dump the _wr field which is HttpWorkerRequest object.
  • Dump the _basicServerVars field: !dumparray <address of _basicServerVars>
  • Dump the last entry: !do <address of last entry in the list>
  • You should get the output like:

String: Connection: Keep-Alive
Cookie: ASP.NET_SessionId=5kwvjlzd3ksgii45ephn00aq; HTTP_REFERER::6841=
Host: Skyraider
User-Agent: DebugDiag Service HTTP Pinger

Hopefully this is what you wanted.