Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP ...

learn more… | top users | synonyms

22
votes
3answers
4k views

Is it possible to transfer a virus through browser video?

I know that there is already a question related to viruses in videos, but the implication in the other question is that videos in question have been downloaded and played by media software on the ...
0
votes
0answers
39 views

How to safely pass password reset token from http get request to html page?

I am working on implementing my own custom password reset that sends an email where the user is taking to a page to reset their password. So far I have generated a unique token that gets put in an ...
4
votes
1answer
80 views

How secure is my system for a password reset?

I am using my custom Parse Server with Heroku which I am pretty sure (99%) that it is decently secure using things like oAuth2 and 1 way hashed passwords. The problem is I am trying to implement my ...
3
votes
1answer
32 views

What security implications does DNS prefetching have?

To improve performance, most browsers prefetch DNS records for linked resources in the background so that the browsers already knows where to send the request the instance you click the link. This is ...
0
votes
1answer
49 views

Why do some websites tell you they use cookies? [closed]

I often visit websites that have a small box telling me that they use cookies. Most sites just store cookies and don't say anything. Is there a reason that some do and others don't? For example:
62
votes
5answers
7k views

HTTPS web service switched to HTTP. What can go wrong?

I recently visited a website which used to have an HTTPS connection. Now it has just a plain HTTP connection, and the authentication method has changed from user+password to "authenticate with Google ...
0
votes
2answers
61 views

Website doesn't provide cookie (csrf token) when connecting over proxy. Why/how?

The Python code below should grab a "csrf token" cookie from Instagram.com, but I get an error message when running the program through any sort of https or socks5 proxy, informing me that the "csrf" ...
0
votes
2answers
23 views

Possible to send generated serialkeys using HTTP and get one right?

I have hooked the WS2 library with C++ in a game and found it sends a request to the server using http to check if my serial key is valid. ...
3
votes
3answers
75 views

What purpose does Access-Control-Allow-Origin have?

I have a misunderstanding regarding CORS' Access-Control-Allow-Origin header. It's name says "allow" from which I understand that if I make a request from an "Origin" that is not allowed the request ...
1
vote
0answers
14 views

Tool for HPP testing? [closed]

Is there an automated vulnerability scanner that supports HPP (HTTP Parameter Pollution)? Since all I need is to take a query string and perform basic modifications / add new parameters, I was ...
1
vote
2answers
105 views

What is web application security best practice for HTTP Get request? [duplicate]

If I have web application GET URL which gives me details of particular user. What is more secure / which is good practice? eg. www.xyz.com/user?id=10 or ...
1
vote
1answer
29 views

Passing a hash of a secret to a server instead of the plain text

Instead of passing an authentication token or api key in an http header to a server in the plain text, what if I calculated its hash and passed the hash? This way even if a adversary intercepts the ...
7
votes
1answer
240 views

Why does Firefox claim that my connection to Google is insecure?

I keep receiving this message whenever I open any site from Google: My Firefox is up-to-date, and so my Windows 8.1. Since I don't know much about HSTS, I don't know what's going on, and obviously, ...
3
votes
1answer
40 views

How does the same-origin-policy protect against PUT/DELETE CSRF?

I've read the OWASP guide for cross-site request forgery and it states that "other HTTP methods", such as PUT and DELETE could be theoretically used for CSRF. However with the same-origin-policy ...
1
vote
1answer
38 views

Computers connecting to suspicious websites via squid proxy

I am running a squid proxy server on my network which my computers connect through to access the internet. I have noticed several odd entries in the squid access.log file around the same time ...
0
votes
3answers
68 views

Safely downloading user submitted content

TL;DR We save the request payload and Content-Type header in a database. It should be JSON or CSV but may be malformed. Support users download the request payload as a file in their browsers using ...
21
votes
2answers
2k views

Why would properly logging full http requests be bad practice?

I'm currently looking at Secure Coding Practices documentation provided by Veracode with their code analysis toolsuite. In a "secure logging practices" section, they mention that logging full HTTP ...
90
votes
4answers
15k views

A secret in a URL

Lately I've seen plenty of APIs designed like this: curl "https://api.somewebsite.com/v1/something&key=YOUR-API-KEY" Isn't it elementary that passing an API key in a query string as a part of ...
-3
votes
2answers
101 views

HTTP: weaknesses analysis & attitude [closed]

Many questions on this topic around here, but didn't find this particular angle Background: Sending any information of value with HTTP and through HTTPS is a bad idea (in the rare case a respected ...
1
vote
0answers
25 views

MAC spoofing under a OPN Access point HTTP does not work

I want to do a demo on the wifi security. So, I have one Wifi router and two client. I configured my router without security (OPN) and with a MAC filter. One of the two client is connected to the ...
0
votes
0answers
19 views

Relative paths in Tomcat

I want to develop a web application that has a public and a restricted area. app/public app/private Public access to the web application is permitted through the app.com domain. There shall be a ...
0
votes
1answer
80 views

How can an attacker eavesdrop on users in public WIFI?

I want know why it's said that public WIFI is not safe for banking transactions or entering password for online accounts etc. I want to imitate an attacker and try to harvest as much information as I ...
30
votes
3answers
3k views

Is HTTPS URL in plain text at first connection? [duplicate]

Let’s say I have never connected to the site example.com. If this site is https and I write https://example.com/supersecretpage will the URL be sent in clear text since it's the first time I connect ...
1
vote
0answers
74 views

Are there strong technical reasons for browsers mandating TLS for http2?

I realise there are similar questions around this topic, however I think this is sufficiently different/focused not to be a duplicate. I hope it doesn't sound like a soapbox piece. HTTP/2 effectively ...
5
votes
2answers
91 views

Server-side man-in-the-middle/eavesdropping: attacks between two servers using unencrypted HTTP

I’m new to security, and I’m wondering how man-in-the-middle and eavesdropping attacks between web servers work, rather than between personal devices and servers. Most questions I see here about ...
-4
votes
2answers
48 views

How and what is used when information is sent to a hacker's server? [closed]

I'm working in some malware research, my main question is how the victim's data is transfered over the internet, protocol and how? Using HTTP or any other way? As fat as I know the data can be sent ...
1
vote
1answer
65 views

Setting the HTTP header X-Frame-Options DENY for static assets

I am checking the security of my Django application through a security scanner and I wonder if it useful to set the X-Frame-Options DENY header on static assets like CSS, images or JS files? I guess ...
16
votes
1answer
1k views

Why am I receiving HTTP GETs for a domain I don't own?

I am running a Centos7 web server. I noticed a few strange HTTP GET requests like these: 94.185.83.100 - - [29/Feb/2016:23:29:00 +0530] "GET http://testp1.piwo.pila.pl/testproxy.php HTTP/1.1" 404 390 ...
2
votes
1answer
43 views

Getting error in Hydra

I'm trying to test someones website for them and I'm using hydra in cygwin on Windows. When I enter: hydra -L myusers.txt -P mypass.txt website.net http-get-form \ ...
0
votes
2answers
76 views

Is the Origin header really useful for securing a WebSocket?

I've been reading some posts about WebSockets security, and a few of them mention to use the Origin header for helping secure the connection. For example this one ...
1
vote
1answer
50 views

Would the CORS specification consider a missing Content-Type header to imply a “simple header”?

RFC 7231, Section 3.1.1.5 states: A sender that generates a message containing a payload body SHOULD generate a Content-Type header field in that message unless the intended media type of the ...
1
vote
2answers
48 views

Started seeing jQuery function calls in URL requests, what is this?

I administer an E-commerce site, and recently I have been seeing odd URL requests containing jQuery function calls. Here are some examples of the requested URLs that are being logged as 302 permanent ...
26
votes
7answers
3k views

Is it possible to modify your user agent http header for malicious use?

The Google crawl bot uses the user agent "Googlebot", and I am wondering if this knowledge can be used maliciously. Let's say in a random website, the Googlebot user agent is allowed to access an ...
0
votes
1answer
16 views

Disabling post-pageload http requests to account for XSS

I have a website where JavaScript is used to process sensitive data (chat messages) on the client side. No communication is done with the server or any other service after the initial page load. It's ...
0
votes
2answers
143 views

Are credentials sent via plain text to HTTP proxy?

If a proxy server requires authentication, and that proxy communicates over HTTP, are the credentials sent over plain text to the proxy server? If this is the case, isn't it possible to sniff the ...
5
votes
1answer
114 views

BREACH attack vs filtered reflected user input

I am in charge of the applicative security of our application and would like to test our exposure to the BREACH attack. Our django-based web application reflects filtered user-input and serves a CSRF ...
66
votes
3answers
7k views

What was the aim of this invalid HTTP request that tells a story about goats in the request URI?

I currently run an Apache HTTP server, and have set up monitoring to receive emails whenever an error appears in the error logs. I get the usual trying to find if I'm using HTTP 1.0 and trying to see ...
1
vote
0answers
39 views

Transmitted sensitive user data

At the moment, I have set up mitmproxy and can record all HTTP/HTTPS communications between the client and server. For research purposes I am looking to find a way to detect potential leakage of ...
5
votes
4answers
167 views

Is information disclosure in a form of a server header is a real vulnerability?

I have seen in many places that people say that headers of the following types is a vulnerability: Server:Microsoft-IIS/7.5 X-AspNet-Version:4.0.30319 X-Powered-By:ASP.NET I can see that this gives ...
5
votes
2answers
337 views

What is the difference between MITMproxy and SSLsplit?

I am aware that MITMproxy only captures HTTP/HTTPS protocols where SSLsplit is a transparent proxy and therefore can capture also other non-HTTP protocol communications. However MITMproxy can operate ...
-1
votes
1answer
89 views

Does the page that links to my login page need to https?

So I realise the login ajax call must be https, and the page that ajax call is made from should also be https to prevent a man in the middle potentially changing the page and changing the form that ...
5
votes
2answers
127 views

Why doesn't the HTTP/2 spec require TLS?

Although no browser implements the full HTTP/2 spec right now limiting themselves to just the TLS part there are stories on the internet that this incomplete implementation of the spec is a way of ...
3
votes
2answers
66 views

Can I trust the Host header received in the request?

The question is very simple: can I trust the value of the Host header? We are developing an application that serves some resources via HTTP and we wan't to have some private services and some ...
0
votes
1answer
94 views

How to prevent hotlinking on binary content served through PHP?

I am trying to secure a byte serving script, written in PHP, mostly taken from http://www.tuxxin.com/php-mp4-streaming/ to protect against linking the video directly and easy downloading. I therefore ...
24
votes
1answer
1k views

HTTP HEAD and its security versus operational uses

Most security advice I see recommends turning off HTTP Methods like TRACE, OPTIONS, HEAD etc. So now I have turned off most of these options on my web server and leaving only GET and POST options that ...
1
vote
1answer
189 views

How to brute force HTTP Basic Authentication requested with XHR?

How can one brute force a website using HTTP Basic authentication using metasploit which uses XHR in background? I am getting error "No URI found that asks for HTTP authentication". Relevant headers ...
4
votes
1answer
49 views

How do I verify that in-app social login dialogs are secure?

If I have a mobile app that supports some kind of social login feature, say, to login to the app from my Facebook account, and if the app opens the Facebook login page inside the app in a mobile, is ...
0
votes
1answer
66 views

Privilege Escalation Mitigation [closed]

What is the best protection against Privilege Escalation vulnerability in web application. Basically I am able to change the HTTP response in JSON format from USER ID to ADMIN ID to get access to the ...
4
votes
4answers
670 views

Password hashing on frontend or backend? [duplicate]

I have a Java Server with Spring Boot and a JS Frontend in AngularJS. My teacher told me to use HTTPS for passwords, because I cannot hash them securely enough, that nobody can hack them. With ...
1
vote
1answer
59 views

Forcing response headers

I'm testing a particular vulnerability box since yesterday and I came with one rather strange problem that I didn't expect. Lets say a vulnerable web-application offer image file upload. The image ...