Tagged Questions
4
votes
4answers
161 views
Security risk of adding a HTTP Header with server identifier
We are about to deploy a web application to a web farm of quite a few web servers. During our testing we have found issues happening in one of the servers but not in others. Most of them because of ...
1
vote
2answers
218 views
Secure against HTTP FLOOD ATTACK
What is the best way to defend your web site against HTTP FLOOD POST/GET ATTACK ?
1
vote
3answers
400 views
Disadvantages of HTTP GET/POST Flooding Attack?
I asked about What is HTTP GET/POST Flooding Attack? recently and I got a few detailed answers about what they are and how they work.
Now I want to find out what are the disadvantages of them.
1
vote
3answers
1k views
What is HTTP GET/POST Flooding Attack?
I want to know what is HTTP GET/POST flood attack and what are their major differences and mitigation strategies ?
I searched a lot but I really can't find some good articles nor examples about this ...
12
votes
2answers
2k views
How to exploit HTTP Methods
Many security scanners like nikto, nessus, nmap, and w3af sometimes show that certain HTTP Methods like HEAD, GET, POST, PUT, DELETE, TRACE, OPTIONS, CONNECT, etc are vulnerable to attack.
What do ...
1
vote
1answer
126 views
What are security risks of serving user uploaded files without Content-Disposition?
Imagine a server that serves untrusted user-provided files and allows other users to download them. Under some circumstances server can be tricked to return responses to download file requests without ...
6
votes
2answers
819 views
Is it possible to do HTTP header injection if CR/LF are stripped?
In HTTP response there is the following header with attacker controlled content:
Content-Disposition:attachment; filename="attacker_controlled.html"
The only characters that can't appear in ...
0
votes
2answers
436 views
How to encode letters in multipart/form-data to include CR/LF characters?
Part of HTTP request that should be sent to server with Content-Type: multipart/form-data; looks like:
------WebKitFormBoundaryQ7KGYev31biaJTW8
Content-Disposition: form-data; name="subject"
...
1
vote
1answer
2k views
How to use http-get-form in THC-Hydra?
I've been messing with Hydra (Brute Force) to solve the "Damn Vulnerable Web App"
brute force section but the problem is when I use http-get-form it said:
Warning: child 1 seems to have died, ...
6
votes
1answer
590 views
ASP.NET HTTP Response Splitting Attack
By default ASP.NET checks for HTTP Response Splitting attack when you do Response.Redirect:
...
