Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP ...

learn more… | top users | synonyms

1
vote
1answer
56 views

Hydra from Kali Linux + Tamper http post form syntax of the failure login attempt

I had asked this question in the general forum I think it is more adequate to place it here. ...
-8
votes
0answers
116 views

If https is so good (as to completely replace http), why is DJB not using it? [closed]

D. J. Bernstein, http://cr.yp.to/djb.html, @hashbreaker, is famously known for his crypto and hashbreaking abilities. Outside of the theoretical research that he is engaged in as a professor, his ...
2
votes
2answers
78 views

How to ensure that a login is really going over http?

So I've been offered the chance to go to a day long security awareness event hosted by some organization. On their site, I noticed the login box in the corner, but the site was delivered on HTTP. ...
-2
votes
2answers
138 views

Google is going to mark all HTTP traffics as insecure in 2015? [closed]

Firstly I would like to mention that I got this news from a blog I have read in last few days. This is only, perhaps, a rumor. If this is true, does this mean that anyone using Google Chrome or apps ...
1
vote
1answer
51 views

Is there a way to mimic http request of a compiled program?

Lets suppose my program makes a http request and uses it response to update some values. Is it possible to somehow mimic the response in order to modify it so the program believes the server responded ...
4
votes
1answer
79 views

Should I be worried about this url request I received on my site?

I was checking the weekend logs of my IIS server and noticed a strange request which was blocked: ...
-4
votes
2answers
138 views

Using my own encryption instead of https in app

I am writing a program that uses a webserver as a backend for communication between different users. Is it okay to use my own encryption (such as ...
3
votes
1answer
157 views

Is HTTPS over UDP secure?

Recently, I notice that while using Google search, I am connecting to Google's server using UDP instead of TCP on both port 80 and port 443. It seems that Google is experimenting with some new ...
-1
votes
0answers
51 views

How to use http:// in https:// using iframe? [migrated]

my website is ssl-enabled secure containg https:// Now i want to add a website link in my webpage using iframe which is in http:// How can i use it, Here problem is with http:// not working in ...
-3
votes
1answer
44 views

What is the Impact of TRACE Method? [duplicate]

What attacker will benefit of TRACE Exploitation and What is the Recommendation to fix this issue?
-1
votes
0answers
39 views

What is the Security Impact of HTTP1.0?

Nessus and other tools are detecting HTTP1.0 vulnerability. The status of the severity is "Informational" only. But what is the impact of this issue and how attacker can perform using this ...
0
votes
2answers
57 views

Safe to use setuid with absolutely no input?

I have a shell script which syncs some files from a remote source and I have a pretty typical HTTP server set-up. There is a user who owns the files served by the HTTP server and a user which runs the ...
3
votes
1answer
50 views

How to find out whether an ISP adds a perma-cookie to my requests?

I am interested in finding out whether my (or any) current ISP (Internet Service Provider) uses a technology known as "perma-cookie" oder "sticky cookie" when I am browsing the internet. This ...
-1
votes
0answers
13 views

Hydra empty response, only difference is header locaion [migrated]

I'm trying to crack my web page to see if it is possible or not. When you try to login on loginpage.php, form is posted to checklogin.php. checklogin.php checks form data and sets Session if login is ...
39
votes
4answers
10k views

Is SSL dying? Should I buy SSL certificates for my sites any more?

I'm planning to purchase a SSL certificate for one of my sites when I'm concerned about points made in these articles: WiredTree: The Most Significant Issue With SSL – And How To Solve It ...
2
votes
3answers
137 views

Can a form submission be encrypted even though address bar shows HTTP?

I was going to apply for a Student ID card through ISIC, but noticed that the form where they ask for payment (such as credit card number) details is not available through HTTPS. The URL to their ...
0
votes
1answer
2k views

Mixed content - stylesheet being blocked because of a querystring parameter?

I've just run into a scenario where a stylesheet was being blocked on a secure payment page. The stylesheet was loaded like so: <link href="/CSS/all.min.css?v=2" rel="stylesheet" type="text/css" ...
1
vote
1answer
328 views

Minimal HTTPS SSL client in C [closed]

I want to implement an HTTPS client using pure C. I have implemented an HTTP client, and it works just fine. My question is: I know the HTTPS protocol does some kind of negotiation to announce what ...
0
votes
2answers
129 views

How much does a GET request over HTTPS reveal to an eavesdropper

Correct me if I am wrong, according to HTTP v1.1 a simple CONNECT request initiates a SSL tunnel between the server and a client. its only after the tunnel is created that the complete GET or POST ...
-4
votes
1answer
108 views

How does https check md5, sha-1 and sha-2 fingerprints?

When a https site shows multiple finger prints, i.e.: md5 and sha1, or sha256 and sha1, how does the browser check? is it both just the "strongest" or whatever is convenient? This question arose ...
1
vote
3answers
139 views

{Secure} Telnet connect to a console server from webbrowser

I've got a terminal server set up in a data center that also serves as a console server. This console server only accepts regular telnet requests. To this server are a bunch of routers and switches ...
2
votes
3answers
732 views

Is it possible to force a browser to use http in an ssl enabled (https) website?

I was doing a security research on storing the session id in local storage instead of storing it in cookies. I understand that it is not possible to tag the values in local storage as HttpOnly and so ...
2
votes
2answers
59 views

Best practice to secure an API of unknown structure that can come from end user device or server [closed]

I'm trying to create an API with minimum forced structure. The messages can come from end user device or from a backend server. I'm ok with opening separate API for end user traffic and from servers. ...
3
votes
1answer
244 views

If I connect to VPN through proxy, who can see what?

I try to understand what happens when I use an HTTP(S) proxy in my OpenVPN client configuration. What's the advantage of an HTTPS proxy over plain HTTP? In any case the encryption takes place on the ...
1
vote
1answer
76 views

Maximum number of Requests in HTTP keep alive connection

We are running a network analyzer . And we log info which are in the HTTP request headers and HTTP response code. Because in keep alive connection request may come without responses. I push requests ...
-2
votes
1answer
76 views

HTTP status code for successful login [closed]

I have a web application for testing. It has a login page. For unsuccessful login attempts, the developers have made a custom error page so that the response from the web application shows 200 OK, ...
6
votes
4answers
980 views

How to identify the HTTP methods supported by a web server?

How can I identify the different HTTP methods supported by a web server, like OPTIONS, TRACE, etc.? I have tried the nc command on Linux. But it doesn't work. It doesn't show me the HTTP methods ...
1
vote
2answers
101 views

Force connected devices to use http rather than https

I am very new to MITM attacks and have been faffing around on my home network today.. When sniffing my iPhone trying to connect to some mail accounts I have noticed that it shows a message stating ...
1
vote
2answers
113 views

How to implement password reset functionality without becoming susceptible to cross-domain referer leakage?

I have typically implemented password reset functionality by sending a link that included something like this: http://example.com/pwreset?id=userId&resetToken=superSecretResetToken On my pwreset ...
1
vote
1answer
190 views

advantages of http basic authentication over token-based (e.g. oauth2)?

I am interested in the question if there are any possible advantages to securing a given REST API for web clients and mobile apps with http basic authentication (over https of course) over a ...
4
votes
1answer
216 views

Logging out of Basic HTTP Authentication

As seen on https://stackoverflow.com/questions/233507/how-to-log-out-user-from-web-site-using-basic-authentication, there are some interesting ways of logging out a user from Basic HTTP ...
2
votes
1answer
73 views

Does client certificate do any encryption in https connection? [duplicate]

In Https connection asymmetric encryption (with Server certificate) is used during handshake and to create symmetric keys. Am I right that in this case client certificate does no encryption? The ...
25
votes
3answers
1k views

Is there a way to detect web server in case it's not present in HEADER?

I'm trying to detect what web server a particular website uses. For instance whether it's nginX, Apache, Tomcat and so on. I usually use Live HTTP Headers Firefox add-on. The problem is that sites ...
1
vote
1answer
56 views

Use TOTP to prevent simulating requests

I'm developing an API system which provides functionalities for a game. Currently, we are using HMAC to prevent simulating requests (let's say, prevent hackers from simulating the game) but because we ...
3
votes
1answer
2k views

Am I safe if browsing to /cgi-bin/ returns HTTP 403?

I am wondering whether my server could be vulnerable to ShellShock (or better: was vulnerable). The shell test reveals that I'm vulnerable: $ export evil='() { :;}; echo vulnerable'; bash -c echo; ...
3
votes
1answer
153 views

Securing server to server http communication

We are trying to come up with a scheme to secure http communication between our internal servers. Are there any good established schemes out there? The requirements we have are: The clients and ...
5
votes
2answers
143 views

Strange escape codes in a GET request - is this a known attack?

I recently came across some entries in nginx's access logs that resemble the following: ##.##.##.## - - [24/Sep/2014:01:21:51 -0400] "GET /767/browser-wars-side-show-ho ...
4
votes
0answers
217 views

Ensuring an HTTP request is coming from my program

Is there a way to ensure that an HTTP request to my REST server is coming from my application? I'm guessing no because whatever I do on the client side, as people have access to that code, they can ...
1
vote
1answer
124 views

Is my authentication persistence system design secure?

This system is for a personal file upload and sharing web application made with PHP. When a user logs into the application, it has the option to "stay logged in" after closing and reopening their ...
2
votes
1answer
66 views

What is x-frame content?

I tried scanning websites for vulnerabilities and found most of them are with low risk x-frame content and "nosniff" what is it exactly?
1
vote
2answers
98 views

Why the Websense blocks same site when used with http & not when used https? [closed]

I have been working in a IT firm. I have access to some social sites. When I try to open site Links in mail (that are having http://), the websense prompts me that the access is blocked. However, when ...
3
votes
2answers
172 views

How safe is to secure sensitive content by URL with MD5 hash and no other authorization?

Suppose we have website that use MD5 hash in URL like this: http://somewebsite.com/XXX/ where XXX is MD5 hash. Content of this website may have sensitive information like transaction details with ...
21
votes
3answers
3k views

What are the disadvantages of implementing HTTP authentication in a web application? [duplicate]

I know that there are different types of authentication mechanisms available. One among them is the HTTP authentication. What is the danger in using this method compared to other methods?
2
votes
1answer
54 views

Understanding cross origing requests from a web page

Reading up the XSS attacks on wiki I see that it says an injected script could send data/cookies to the attackers site. How is this achieved? Are there no checks/restrictions on cross origin requests ...
8
votes
1answer
1k views

Why would HTTP client only send authentication headers once an unauthenticated request was rejected?

The default usage of HttpClient and HttpWebRequest .NET classes is setting Credentials property and then asking the class instance to perform an HTTP request. If the target requres Basic authorization ...
1
vote
1answer
107 views

Is Java javax.servlet.http.HttpServletResponse sendRedirect() auto replace the carriage return(%0d%0a) to prevent Http Header Splitting attack?

I just tried to demonstrate a simple Web app program to simulate the Http Header Splitting attack but I failed. I realise that this sendRedirect() function has filtered my carriage return and replace ...
1
vote
2answers
74 views

If TLS compression is not supported is a site still vulnerable to attacks such as BREACH?

I have read that BREACH was a side channel compression attack against TLS however focuses on HTTP response compression. If a site has disabled support for TLS compression does that still mean it can ...
1
vote
1answer
69 views

BREACH attack and content length

I've been researching BREACH, and while I can understand how it might work if you have access to the the browser (to send crafted requests) and the wire (to capture compressed response length), I ...
2
votes
2answers
842 views

I ran a netstat on my server and port 80 is listening, does that mean it is open and vulnerable to attacks? [closed]

Sorry I am just getting into Web Development and trying to learn more about servers and PHP, so I downloaded the LAMP stack on an Ubuntu14 OS and started an apache2 server. tcp6 0 0 :::80 ...
23
votes
9answers
4k views

Can an HTTPS site be malicious or unsafe?

I know it's possible for a computer to be infected just by visiting a website. I also know that HTTPS websites are secure. To my understanding, "secure" here refers to "immune to MITM attacks", but ...