Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP ...

learn more… | top users | synonyms

0
votes
1answer
33 views

How to ensure that a login is really going over http?

So I've been offered the chance to go to a day long security awareness event hosted by some organization. On their site, I noticed the login box in the corner, but the site was delivered on HTTP. ...
-1
votes
2answers
110 views

Google is going to mark all HTTP traffics as insecure in 2015? [on hold]

Firstly I would like to mention that I got this news from a blog I have read in last few days. This is only, perhaps, a rumor. If this is true, does this mean that anyone using Google Chrome or apps ...
-1
votes
0answers
24 views

Encryption algorithm of EScan anti-virus for data transmission between clients and server? [on hold]

I have a multi-user EScan anti-virus that uses a console to manage clients. This anti-virus has a server and receive updates from that server online, and then update its clients. The communication ...
1
vote
1answer
50 views

Is there a way to mimic http request of a compiled program?

Lets suppose my program makes a http request and uses it response to update some values. Is it possible to somehow mimic the response in order to modify it so the program believes the server responded ...
4
votes
1answer
78 views

Should I be worried about this url request I received on my site?

I was checking the weekend logs of my IIS server and noticed a strange request which was blocked: ...
-4
votes
2answers
136 views

Using my own encryption instead of https in app

I am writing a program that uses a webserver as a backend for communication between different users. Is it okay to use my own encryption (such as ...
3
votes
1answer
147 views

Is HTTPS over UDP secure?

Recently, I notice that while using Google search, I am connecting to Google's server using UDP instead of TCP on both port 80 and port 443. It seems that Google is experimenting with some new ...
0
votes
0answers
24 views

Fetching remote content in PDF files [closed]

Does there exist a commonly supported way for PDF files to fetch remote content like images? I understand AdobeReader supports javascript but I was wondering if reading PDF files in other pdf readers ...
-1
votes
0answers
51 views

How to use http:// in https:// using iframe? [migrated]

my website is ssl-enabled secure containg https:// Now i want to add a website link in my webpage using iframe which is in http:// How can i use it, Here problem is with http:// not working in ...
-3
votes
1answer
43 views

What is the Impact of TRACE Method? [duplicate]

What attacker will benefit of TRACE Exploitation and What is the Recommendation to fix this issue?
-1
votes
0answers
39 views

What is the Security Impact of HTTP1.0?

Nessus and other tools are detecting HTTP1.0 vulnerability. The status of the severity is "Informational" only. But what is the impact of this issue and how attacker can perform using this ...
0
votes
2answers
56 views

Safe to use setuid with absolutely no input?

I have a shell script which syncs some files from a remote source and I have a pretty typical HTTP server set-up. There is a user who owns the files served by the HTTP server and a user which runs the ...
3
votes
1answer
45 views

How to find out whether an ISP adds a perma-cookie to my requests?

I am interested in finding out whether my (or any) current ISP (Internet Service Provider) uses a technology known as "perma-cookie" oder "sticky cookie" when I am browsing the internet. This ...
-1
votes
0answers
13 views

Hydra empty response, only difference is header locaion [migrated]

I'm trying to crack my web page to see if it is possible or not. When you try to login on loginpage.php, form is posted to checklogin.php. checklogin.php checks form data and sets Session if login is ...
38
votes
4answers
10k views

Is SSL dying? Should I buy SSL certificates for my sites any more?

I'm planning to purchase a SSL certificate for one of my sites when I'm concerned about points made in these articles: WiredTree: The Most Significant Issue With SSL – And How To Solve It ...
2
votes
3answers
137 views

Can a form submission be encrypted even though address bar shows HTTP?

I was going to apply for a Student ID card through ISIC, but noticed that the form where they ask for payment (such as credit card number) details is not available through HTTPS. The URL to their ...
0
votes
1answer
1k views

Mixed content - stylesheet being blocked because of a querystring parameter?

I've just run into a scenario where a stylesheet was being blocked on a secure payment page. The stylesheet was loaded like so: <link href="/CSS/all.min.css?v=2" rel="stylesheet" type="text/css" ...
-2
votes
0answers
35 views

Wireshark and Playstation 3 [migrated]

Im looking to capture all network traffic when playing my ps3 and find the external IP addresses of other players in my servers or game. Im wondering if this is possible ? if so how?
1
vote
1answer
325 views

Minimal HTTPS SSL client in C [closed]

I want to implement an HTTPS client using pure C. I have implemented an HTTP client, and it works just fine. My question is: I know the HTTPS protocol does some kind of negotiation to announce what ...
0
votes
2answers
128 views

How much does a GET request over HTTPS reveal to an eavesdropper

Correct me if I am wrong, according to HTTP v1.1 a simple CONNECT request initiates a SSL tunnel between the server and a client. its only after the tunnel is created that the complete GET or POST ...
-4
votes
1answer
103 views

How does https check md5, sha-1 and sha-2 fingerprints?

When a https site shows multiple finger prints, i.e.: md5 and sha1, or sha256 and sha1, how does the browser check? is it both just the "strongest" or whatever is convenient? This question arose ...
1
vote
3answers
138 views

{Secure} Telnet connect to a console server from webbrowser

I've got a terminal server set up in a data center that also serves as a console server. This console server only accepts regular telnet requests. To this server are a bunch of routers and switches ...
2
votes
3answers
723 views

Is it possible to force a browser to use http in an ssl enabled (https) website?

I was doing a security research on storing the session id in local storage instead of storing it in cookies. I understand that it is not possible to tag the values in local storage as HttpOnly and so ...
2
votes
2answers
59 views

Best practice to secure an API of unknown structure that can come from end user device or server [closed]

I'm trying to create an API with minimum forced structure. The messages can come from end user device or from a backend server. I'm ok with opening separate API for end user traffic and from servers. ...
3
votes
1answer
223 views

If I connect to VPN through proxy, who can see what?

I try to understand what happens when I use an HTTP(S) proxy in my OpenVPN client configuration. What's the advantage of an HTTPS proxy over plain HTTP? In any case the encryption takes place on the ...
1
vote
1answer
72 views

Maximum number of Requests in HTTP keep alive connection

We are running a network analyzer . And we log info which are in the HTTP request headers and HTTP response code. Because in keep alive connection request may come without responses. I push requests ...
-2
votes
1answer
75 views

HTTP status code for successful login [closed]

I have a web application for testing. It has a login page. For unsuccessful login attempts, the developers have made a custom error page so that the response from the web application shows 200 OK, ...
6
votes
4answers
975 views

How to identify the HTTP methods supported by a web server?

How can I identify the different HTTP methods supported by a web server, like OPTIONS, TRACE, etc.? I have tried the nc command on Linux. But it doesn't work. It doesn't show me the HTTP methods ...
1
vote
2answers
96 views

Force connected devices to use http rather than https

I am very new to MITM attacks and have been faffing around on my home network today.. When sniffing my iPhone trying to connect to some mail accounts I have noticed that it shows a message stating ...
1
vote
2answers
111 views

How to implement password reset functionality without becoming susceptible to cross-domain referer leakage?

I have typically implemented password reset functionality by sending a link that included something like this: http://example.com/pwreset?id=userId&resetToken=superSecretResetToken On my pwreset ...
1
vote
1answer
181 views

advantages of http basic authentication over token-based (e.g. oauth2)?

I am interested in the question if there are any possible advantages to securing a given REST API for web clients and mobile apps with http basic authentication (over https of course) over a ...
4
votes
1answer
190 views

Logging out of Basic HTTP Authentication

As seen on https://stackoverflow.com/questions/233507/how-to-log-out-user-from-web-site-using-basic-authentication, there are some interesting ways of logging out a user from Basic HTTP ...
2
votes
1answer
73 views

Does client certificate do any encryption in https connection? [duplicate]

In Https connection asymmetric encryption (with Server certificate) is used during handshake and to create symmetric keys. Am I right that in this case client certificate does no encryption? The ...
24
votes
3answers
1k views

Is there a way to detect web server in case it's not present in HEADER?

I'm trying to detect what web server a particular website uses. For instance whether it's nginX, Apache, Tomcat and so on. I usually use Live HTTP Headers Firefox add-on. The problem is that sites ...
1
vote
1answer
56 views

Use TOTP to prevent simulating requests

I'm developing an API system which provides functionalities for a game. Currently, we are using HMAC to prevent simulating requests (let's say, prevent hackers from simulating the game) but because we ...
3
votes
1answer
2k views

Am I safe if browsing to /cgi-bin/ returns HTTP 403?

I am wondering whether my server could be vulnerable to ShellShock (or better: was vulnerable). The shell test reveals that I'm vulnerable: $ export evil='() { :;}; echo vulnerable'; bash -c echo; ...
3
votes
1answer
153 views

Securing server to server http communication

We are trying to come up with a scheme to secure http communication between our internal servers. Are there any good established schemes out there? The requirements we have are: The clients and ...
5
votes
2answers
140 views

Strange escape codes in a GET request - is this a known attack?

I recently came across some entries in nginx's access logs that resemble the following: ##.##.##.## - - [24/Sep/2014:01:21:51 -0400] "GET /767/browser-wars-side-show-ho ...
4
votes
0answers
217 views

Ensuring an HTTP request is coming from my program

Is there a way to ensure that an HTTP request to my REST server is coming from my application? I'm guessing no because whatever I do on the client side, as people have access to that code, they can ...
1
vote
1answer
122 views

Is my authentication persistence system design secure?

This system is for a personal file upload and sharing web application made with PHP. When a user logs into the application, it has the option to "stay logged in" after closing and reopening their ...
2
votes
1answer
66 views

What is x-frame content?

I tried scanning websites for vulnerabilities and found most of them are with low risk x-frame content and "nosniff" what is it exactly?
1
vote
2answers
96 views

Why the Websense blocks same site when used with http & not when used https? [closed]

I have been working in a IT firm. I have access to some social sites. When I try to open site Links in mail (that are having http://), the websense prompts me that the access is blocked. However, when ...
3
votes
2answers
169 views

How safe is to secure sensitive content by URL with MD5 hash and no other authorization?

Suppose we have website that use MD5 hash in URL like this: http://somewebsite.com/XXX/ where XXX is MD5 hash. Content of this website may have sensitive information like transaction details with ...
21
votes
3answers
3k views

What are the disadvantages of implementing HTTP authentication in a web application? [duplicate]

I know that there are different types of authentication mechanisms available. One among them is the HTTP authentication. What is the danger in using this method compared to other methods?
2
votes
1answer
54 views

Understanding cross origing requests from a web page

Reading up the XSS attacks on wiki I see that it says an injected script could send data/cookies to the attackers site. How is this achieved? Are there no checks/restrictions on cross origin requests ...
8
votes
1answer
1k views

Why would HTTP client only send authentication headers once an unauthenticated request was rejected?

The default usage of HttpClient and HttpWebRequest .NET classes is setting Credentials property and then asking the class instance to perform an HTTP request. If the target requres Basic authorization ...
1
vote
1answer
105 views

Is Java javax.servlet.http.HttpServletResponse sendRedirect() auto replace the carriage return(%0d%0a) to prevent Http Header Splitting attack?

I just tried to demonstrate a simple Web app program to simulate the Http Header Splitting attack but I failed. I realise that this sendRedirect() function has filtered my carriage return and replace ...
1
vote
2answers
72 views

If TLS compression is not supported is a site still vulnerable to attacks such as BREACH?

I have read that BREACH was a side channel compression attack against TLS however focuses on HTTP response compression. If a site has disabled support for TLS compression does that still mean it can ...
1
vote
1answer
68 views

BREACH attack and content length

I've been researching BREACH, and while I can understand how it might work if you have access to the the browser (to send crafted requests) and the wire (to capture compressed response length), I ...
2
votes
2answers
835 views

I ran a netstat on my server and port 80 is listening, does that mean it is open and vulnerable to attacks? [closed]

Sorry I am just getting into Web Development and trying to learn more about servers and PHP, so I downloaded the LAMP stack on an Ubuntu14 OS and started an apache2 server. tcp6 0 0 :::80 ...