Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP ...

learn more… | top users | synonyms

2
votes
2answers
24 views

Testing non‐browser‐based https clients for Poodle

I have a command line tool that can download any URLs likewget (only for vcs systems) but not it’s source code, how can I test if it is vulnerable to POODLE? There are lot of online automated tools ...
12
votes
1answer
219 views

Stack Exchange's javascript is malicious

I have, recently, discovered a rather annoying problem: every first-click I have on any Stack Exchange site creates an advertisement popup. This happens on my desktop, laptop, phone and even a VM. I ...
1
vote
1answer
65 views

How can I capture another IP's HTTP traffic with Wireshark network analyzer?

How can I capture another IP's HTTP(S) requests in a local network with Wireshark network analyzer? Is it possible?
2
votes
1answer
42 views

Unsecure to allow all headers? [closed]

I'm currently developing an webapp. For testing and developing I allowed all Headers. Is this unsecure for productive use? Header unset Connection Header unset Time-Zone Header unset Keep-Alive ...
-4
votes
3answers
57 views

How to pass website firewall, in PHP? [closed]

Recently, I have posted a question, (http://stackoverflow.com/questions/37494896/how-to-save-file-from-url-to-web-server-by-php). And, there is an answer in question. In this answer, he said: "So the ...
0
votes
0answers
25 views

bundling session information in a binary

We are in the process of developing a desktop app. When a user is logged into the website we create a dynamic binary(.exe) and add session information to that binary which is valid for one time login. ...
5
votes
1answer
54 views

Can HPKP be used to track users?

There is already a large flora of "supercookies" and browser fingerprinting methods out there. I am wondering whether HPKP provides yet another method to track users? A server could send an extra ...
-3
votes
1answer
54 views

How two identical domains work on Internet when they got signed from two different CA

Let's say A and B. Considering A and B are from same location. A went to the verisign and get signed for example.com B went to the godaddy.com and get signed for same domain(example.com) Now question ...
1
vote
3answers
60 views

Server echoes HTTP headers back to client - any security issues with that?

Im troubleshooting a server that behaves a bit odd. If I make a request that looks like this: GET / HTTP/1.1 Connection: close Host: hostname Someheader: somevalue Location: Woot? Set-Cookie: test=...
3
votes
1answer
64 views

How does firewall differentiate between browsing and downloading?

The firewall installed at my college's router allows me to surf the internet but never allows me to download any package that has a size more than 100mb. I wonder how exactly does it differentiate ...
0
votes
1answer
85 views

Why does SSLStrip fail when user types HTTPS?

During an HTTPS connection between a browser and server -- Is the very first packet from the browser encrypted? My guess is that the answer is "NO" because encryption should only begin after the ...
8
votes
0answers
3k views

How to know if it's actually a 404 page? [migrated]

What I learned from Foregenix: The HTTP 404 Not Found Error means that the webpage you were trying to reach could not be found on the server. It is a Client-side Error which means that either the ...
1
vote
1answer
32 views

Does HSTS inlcudeSubDomains directive include subdomains on all levels?

I asked this question on Stack Overflow, but thought its more relevant here. Regarding the HSTS includeSubDomains directive. Does this include every subdomain underneath e.g. example.com. So abc.def....
0
votes
1answer
47 views

Deploy intranet application with SSL certificate

My company has an intranet application build on the WAMP stack - Windows / Apache / MySQL / PHP. This application is installed on a server at each customer's site, and is accessed via LAN IP address. ...
1
vote
4answers
93 views

Is it possible to send HTTP packet via spoofed IP?

I have the following PHP code that writes accepted to a file named text.txt only if the IP is equal to 127.0.0.1 (loopback). If the IP doesn't match it writes denied. <?php $file = fopen('text.txt'...
-1
votes
1answer
117 views

Can VPN provider see my data?

I have a 2 questions: If I use a VPN and I go to any websites via HTTP - does VPN provider will be able to see the traffic? Those. logins, passwords, all the texts that pass through the channel (in ...
0
votes
2answers
88 views

Need help to exploit php script vulnerability of a challenge

i am trying to exploit a vulnerability in a php script of the 'stop us' challenge of Wechall.net and I am not sure but I think I found the vulnerability, but now I don't know how to exploit it. I made ...
2
votes
2answers
90 views

What information can my ISP see using squid proxy?

My ISP provides a transparent proxy to use and I can see that they are using the squid proxy for caching this. What I am wondering is what data can they see and what can they see further if they can ...
8
votes
1answer
83 views

Strange responses from an unfamiliar HTTP server

I noticed an unfamiliar device when scanning my local wireless network. It had two open (listening?) TCP ports; TCP/80 (http?) & TCP/443 (https?). In an effort to identify the unfamiliar device;...
0
votes
0answers
64 views

Data integrity and authentication of an Arduino using JSON Web Tokens and HMACs

I have a school project involving an Arduino-based sensor that needs to send sensor readings to a server via HTTP. The sensor readings do not need to be encrypted (it's okay that people know what they ...
22
votes
3answers
4k views

Is it possible to transfer a virus through browser video?

I know that there is already a question related to viruses in videos, but the implication in the other question is that videos in question have been downloaded and played by media software on the ...
0
votes
0answers
67 views

How to safely pass password reset token from http get request to html page?

I am working on implementing my own custom password reset that sends an email where the user is taking to a page to reset their password. So far I have generated a unique token that gets put in an ...
4
votes
1answer
86 views

How secure is my system for a password reset?

I am using my custom Parse Server with Heroku which I am pretty sure (99%) that it is decently secure using things like oAuth2 and 1 way hashed passwords. The problem is I am trying to implement my ...
3
votes
1answer
43 views

What security implications does DNS prefetching have?

To improve performance, most browsers prefetch DNS records for linked resources in the background so that the browsers already knows where to send the request the instance you click the link. This is ...
1
vote
1answer
55 views

Why do some websites tell you they use cookies? [closed]

I often visit websites that have a small box telling me that they use cookies. Most sites just store cookies and don't say anything. Is there a reason that some do and others don't? For example:
63
votes
5answers
9k views

HTTPS web service switched to HTTP. What can go wrong?

I recently visited a website which used to have an HTTPS connection. Now it has just a plain HTTP connection, and the authentication method has changed from user+password to "authenticate with Google ...
0
votes
2answers
107 views

Website doesn't provide cookie (csrf token) when connecting over proxy. Why/how?

The Python code below should grab a "csrf token" cookie from Instagram.com, but I get an error message when running the program through any sort of https or socks5 proxy, informing me that the "csrf" ...
0
votes
2answers
24 views

Possible to send generated serialkeys using HTTP and get one right?

I have hooked the WS2 library with C++ in a game and found it sends a request to the server using http to check if my serial key is valid. http://warbandmain.taleworlds.com/handlerservers.ashx?type=...
3
votes
3answers
147 views

What purpose does Access-Control-Allow-Origin have?

I have a misunderstanding regarding CORS' Access-Control-Allow-Origin header. It's name says "allow" from which I understand that if I make a request from an "Origin" that is not allowed the request ...
1
vote
0answers
20 views

Tool for HPP testing? [closed]

Is there an automated vulnerability scanner that supports HPP (HTTP Parameter Pollution)? Since all I need is to take a query string and perform basic modifications / add new parameters, I was ...
1
vote
2answers
106 views

What is web application security best practice for HTTP Get request? [duplicate]

If I have web application GET URL which gives me details of particular user. What is more secure / which is good practice? eg. www.xyz.com/user?id=10 or www.xyz.com/user?fname="abc"&lname="...
1
vote
1answer
30 views

Passing a hash of a secret to a server instead of the plain text

Instead of passing an authentication token or api key in an http header to a server in the plain text, what if I calculated its hash and passed the hash? This way even if a adversary intercepts the ...
7
votes
1answer
820 views

Why does Firefox claim that my connection to Google is insecure?

I keep receiving this message whenever I open any site from Google: My Firefox is up-to-date, and so my Windows 8.1. Since I don't know much about HSTS, I don't know what's going on, and obviously, ...
3
votes
1answer
55 views

How does the same-origin-policy protect against PUT/DELETE CSRF?

I've read the OWASP guide for cross-site request forgery and it states that "other HTTP methods", such as PUT and DELETE could be theoretically used for CSRF. However with the same-origin-policy ...
1
vote
1answer
41 views

Computers connecting to suspicious websites via squid proxy

I am running a squid proxy server on my network which my computers connect through to access the internet. I have noticed several odd entries in the squid access.log file around the same time everyday,...
1
vote
3answers
78 views

Safely downloading user submitted content

TL;DR We save the request payload and Content-Type header in a database. It should be JSON or CSV but may be malformed. Support users download the request payload as a file in their browsers using ...
21
votes
2answers
2k views

Why would properly logging full http requests be bad practice?

I'm currently looking at Secure Coding Practices documentation provided by Veracode with their code analysis toolsuite. In a "secure logging practices" section, they mention that logging full HTTP ...
91
votes
4answers
15k views

A secret in a URL

Lately I've seen plenty of APIs designed like this: curl "https://api.somewebsite.com/v1/something&key=YOUR-API-KEY" Isn't it elementary that passing an API key in a query string as a part of ...
-3
votes
2answers
103 views

HTTP: weaknesses analysis & attitude [closed]

Many questions on this topic around here, but didn't find this particular angle Background: Sending any information of value with HTTP and through HTTPS is a bad idea (in the rare case a respected ...
1
vote
0answers
29 views

MAC spoofing under a OPN Access point HTTP does not work

I want to do a demo on the wifi security. So, I have one Wifi router and two client. I configured my router without security (OPN) and with a MAC filter. One of the two client is connected to the ...
0
votes
0answers
20 views

Relative paths in Tomcat

I want to develop a web application that has a public and a restricted area. app/public app/private Public access to the web application is permitted through the app.com domain. There shall be a ...
0
votes
1answer
93 views

How can an attacker eavesdrop on users in public WIFI?

I want know why it's said that public WIFI is not safe for banking transactions or entering password for online accounts etc. I want to imitate an attacker and try to harvest as much information as I ...
30
votes
3answers
3k views

Is HTTPS URL in plain text at first connection? [duplicate]

Let’s say I have never connected to the site example.com. If this site is https and I write https://example.com/supersecretpage will the URL be sent in clear text since it's the first time I connect ...
1
vote
0answers
75 views

Are there strong technical reasons for browsers mandating TLS for http2?

I realise there are similar questions around this topic, however I think this is sufficiently different/focused not to be a duplicate. I hope it doesn't sound like a soapbox piece. HTTP/2 effectively ...
5
votes
2answers
122 views

Server-side man-in-the-middle/eavesdropping: attacks between two servers using unencrypted HTTP

I’m new to security, and I’m wondering how man-in-the-middle and eavesdropping attacks between web servers work, rather than between personal devices and servers. Most questions I see here about man-...
-4
votes
2answers
51 views

How and what is used when information is sent to a hacker's server? [closed]

I'm working in some malware research, my main question is how the victim's data is transfered over the internet, protocol and how? Using HTTP or any other way? As fat as I know the data can be sent ...
1
vote
1answer
120 views

Setting the HTTP header X-Frame-Options DENY for static assets

I am checking the security of my Django application through a security scanner and I wonder if it useful to set the X-Frame-Options DENY header on static assets like CSS, images or JS files? I guess ...
17
votes
1answer
2k views

Why am I receiving HTTP GETs for a domain I don't own?

I am running a Centos7 web server. I noticed a few strange HTTP GET requests like these: 94.185.83.100 - - [29/Feb/2016:23:29:00 +0530] "GET http://testp1.piwo.pila.pl/testproxy.php HTTP/1.1" 404 390 ...
2
votes
1answer
52 views

Getting error in Hydra

I'm trying to test someones website for them and I'm using hydra in cygwin on Windows. When I enter: hydra -L myusers.txt -P mypass.txt website.net http-get-form \ "/wp-login.php:user_login=^USER^&...
0
votes
2answers
110 views

Is the Origin header really useful for securing a WebSocket?

I've been reading some posts about WebSockets security, and a few of them mention to use the Origin header for helping secure the connection. For example this one https://www.christian-schneider.net/...