Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP ...
4
votes
1answer
58 views
Build a secure channel without SSL/TLS
I'm looking at possible options to build a secure channel between multiple embedded devices with limited cryptography capabilities and an HTTP server (It could be some sort of web service).
1. ...
0
votes
1answer
56 views
HTTP Basic Auth is enough?
I have WebSVN, Gitlab and phpMyAdmin hosted on my dev server. Now, all of it, I password protect the pages (not their individual login) using HTTP Basic Auth, is this the best practice that I can do?
1
vote
3answers
98 views
Is it possible to pass TCP handshake with spoofed IP address?
Little time ago, me and my friends argued if TCP handshake can be passed with a spoofed IP address.
Assume I have a https web server that allows only admin's IP numbers.
Can anyone connect that web ...
-2
votes
0answers
42 views
HTTP Parameters Pollution attack [closed]
I have a search form in my site that is submitted with POST method. I recently realize that it is vulnerable against HPP (Http Parameters Pollution). Somebody told me that fact. But I am not sure if ...
-1
votes
1answer
100 views
Who can view my https browsing habbits? [closed]
I was wondering about HTTPS security and how easily is compromised. I have already read the similar threads in here, but I have some more questions:
Let's say I am searching something at Google. ...
0
votes
2answers
103 views
How secure is using a blank index.html / index.php? [duplicate]
When you put a blank index.html into a given directory on a web server, web browsers will not display a file listing for that directory. But is it secure enough for other purposes other than ...
5
votes
5answers
173 views
Is including a secret GUID in an URL Security Through Obscurity?
I know that this question is a little bit on the side of Opinion/Discussion, but I think there's a provable answer to it.
I think the common view of "Security Through Obscurity" is that the security ...
2
votes
2answers
104 views
CSRF protection and Single Page Apps
I am in the process of writing a thick client web app using Angular.js (single page app) and was wondering what are the best practices for securing the app using a CSRF token.
Should I send a CSRF ...
19
votes
6answers
1k views
Malicious Links that Respond to Browsers but not curl or wget
There are some emails with links to people's cracked websites with a malware download
Like this kind of email:
fake DHL pack station email
... the links often take the form of:
http:// ...
-1
votes
1answer
101 views
Wireshark Decode HTTPS Root Certificate
I'm currently dealing with a "Sniffy" java application. Well I can see it connecting to some kind of server using HTTPS. I would like to see what its sending or getting over HTTPS. i have read some ...
5
votes
3answers
217 views
How to block an IP, if getting many http requests in a second
If some one tried force burst attack on my website, how can I block them?
I mean, I want to block an IP if I have many http/Apache requests in a second.
Thanks in advance.
1
vote
1answer
69 views
Simple and secure remote installation method that accepts input via a web page?
When installing software on a remote server: Is it possible to let the admin (i.e. the user that installs the software) define admin username and password via a HTML page, in a secure manner?
...
4
votes
2answers
246 views
I'm being followed on the web. Explanations for mysterious behavior
Am I being stalked?
I was recently doing some basic Python development scripting.
Python has a nice feature where it can run a simple HTTP server that serves the contents of the local directory, on ...
-1
votes
2answers
158 views
Allow embedded videos while keeping youtube blocked [closed]
Our organization has launched a training program for employees. the hosting server(internal), has YouTube videos embedded. we have YouTube blocked, and employees access the internet via proxy.
How can ...
6
votes
1answer
81 views
Are there any situations when one can only mount a passive MITM?
This came up while discussing Web & insecure HTTP - Using RSA for encrypting passwords on the client side
Is there any such situation possible when requesting an HTTP page where an attacker is ...
4
votes
1answer
159 views
If SSL encrypts urls, then how are https messages routed?
I've googled around and it seems like SSL encrypts URLs. (Correct?) As I understand it, if I go to a site like http://security.stackexchange.com then a DNS server looks at the URL, says hey, he wants ...
2
votes
3answers
163 views
How to identify the Java program that is maliciously accessing my web site from many client addresses?
For many years, my personal web site receives numerous pairs of hits that look like this, every day:
202.xx.xx.xx - - [22/Apr/2013:12:02:26 +0000] "GET / HTTP/1.1" 200 5923 "-" "Java/1.4.1_04"
...
16
votes
3answers
500 views
Vulnerable code suggested on OWASP?
Session Hijacking Prevention
It is good practice to bind sessions to IP addresses, that would prevent most session hijacking scenarios (but not all), however some users might use anonymity ...
5
votes
3answers
286 views
Is it possible to “protect” against MITM attacks over HTTP?
In a conversation on twitter I warned a site about a security vulnerability. Specifically, the possibility of a MITM (Man in the Middle) attack used to compromise their registration form.
The ...
29
votes
9answers
1k views
Use additional “password” in Referer to hide private site?
I have a private (= I'm the only user) site at example.com/private/. Nothing else is published at this host (it's my domain).
I don't want anyone to know that there is anything at example.com, ...
3
votes
7answers
528 views
Is it compulsory to have https on e-commerce site?
I saw that some e-commerce scripts can also run without ssl, but everyone recommends to activate it to protect sensitive data.
I just saw a site that has an e-shop link, if i click it my browser says ...
1
vote
1answer
96 views
Following redirects from HTTPS to HTTP - Secure?
So I have an HTTP client which supports HTTPS. However, it doesn't follow the HTTP spec recommendation for redirects on POST(which is to ask the user before redirecting)
This means, in theory, if you ...
-1
votes
2answers
111 views
Keyloggers and Email Accounts [duplicate]
This morning, I was experimenting with some keyloggers and noticed that they have a feature to send e-mails to the attacker.
How can these e-mails be intercepted? Let us say that I have a packet ...
0
votes
1answer
109 views
Ports used by Online Email Accounts such as Yahoo Mail, Gmail etc
Let us say that I send an email using Yahoo Mail or Gmail. Can this email be intercepted using a packet sniffer?
On which port does the email travel? HTTP, SMTP, POP3?
Thank you.
2
votes
1answer
156 views
Web service HMAC authentication/anti-replay
I am creating a web service, which handles various requests from web clients. The client and server share a big secret key S, and when one part wants to send data, it calculates the token as follows:
...
3
votes
1answer
705 views
How does DHE-RSA-AES256-SHA compare to RC4 as the Cipher for SSL?
I read a lot of issue [1] currently stating that RC4 is broken and is at risk.
I just checked my web server (nginx) and it is using the default settings, which is
DHE-RSA-AES256-SHA
How does this ...
1
vote
1answer
210 views
Web Applications (http): Don't get how token based authentication is secure
See something like this:
http://stackoverflow.com/questions/10826293/restful-authentication-via-spring/10864088#comment21706215_10864088
Or more specific:
Token-based authentication - Securing the ...
5
votes
1answer
103 views
What's the risk in putting semantically meaningful data in an HTTP session identifier?
I'm currently looking at performance optimization and am considering a way of speeding up cookie based session handling. There are advantages to having a session identifier in place when there is no ...
2
votes
3answers
221 views
HMAC What is secure manner to distribute shared secret between client and server?
I am looking at ways to secure http communication using HMAC. My understanding is that in this scenario the client and the server both know a secret. This means the secret must be first generated on ...
1
vote
2answers
109 views
Is it bad practice to send decryptable data?
If I'm authenticating an action, is it a bad practice to authorize the connection using a decryptable hash that does have a specific algorithm, but only the remote machine knows?
Is sending ...
15
votes
4answers
556 views
Credit card forms on HTTP pages a MITM risk?
The other day, there was a web developer mailing list thread about a fundraiser page.
One person noted that the page with the credit card form was HTTP, not HTTPS.
In response, one person said that ...
2
votes
2answers
74 views
Actual issue? Phone switches from 3G to router makes session switch from https to http
I heard that a security issue exists in some cases when a mobile phone has:
Connected to a website via https via 3G
Connects to a router
I'm told that that in this particular scenario the router ...
2
votes
2answers
166 views
HTTPOnly Cookies: Security Depends on Client Cooperation?
I've been implementing HTTPOnly cookie-based session handling and have some questions about what HTTPOnly means.
I realise it's a flag that gets passed around in the HTTP header when setting cookies. ...
8
votes
4answers
434 views
Can URLs be sniffed when using SSL? [duplicate]
I know that http requests can be sniffed, so sniffer can see the requested URL from the victim. So 2 days ago I my bank made me a web-account to see, send money etc...
The thing I saw is my session ...
4
votes
4answers
167 views
Security risk of adding a HTTP Header with server identifier
We are about to deploy a web application to a web farm of quite a few web servers. During our testing we have found issues happening in one of the servers but not in others. Most of them because of ...
9
votes
5answers
571 views
Apache/Linux server, DoS attack from own IP
I have an unusual problem I've been trying to diagnose for a while:
It's about a Debian server running a custom compile of apache 2.2 with PHP, Red5, MySQL 5.5 (standard binary), sendmail (distro ...
1
vote
2answers
231 views
Secure against HTTP FLOOD ATTACK
What is the best way to defend your web site against HTTP FLOOD POST/GET ATTACK ?
-3
votes
2answers
105 views
Cannot use HTTPS or download stuff from sourceforge with a mac, what kind of soft does that? [closed]
I'm at a public library (france). I have a http library login to access that wifi.
I just want to download some SFML zip to make some app, but many things are blocked, mainly https. I can't even ...
0
votes
4answers
231 views
Is using the md5 hashing algorithm as method for authorization in an HTTP POST request unsafe?
I am creating a page on a website that will show a user some authorized information from another website, and that website uses a combination of the user's user-number and a secret passphrase hashed ...
0
votes
1answer
44 views
What would be a safe number of HTTP redirects to follow when scraping a URL until giving up? [closed]
I'm doing a "share box" where users can enter a link before posting and the app automatically scraps the URL to get a thumbnail and some other info. My question is: What would be a safe number of HTTP ...
1
vote
1answer
239 views
Route traffic from iphone to dektop and back
Iv'e got some iOS app to pentest, and the target server is accessible only through the iPhone APN.
My problem is, that i want to configure the traffic in such way so i can intercept and tamper HTTP ...
2
votes
3answers
312 views
Is it possible to list folder from my web server if i have an empty index.html in the root folder?
I have a small mongoose web server installed on my machine. I have a empty index.html in the root directory.
I want to be able to share link with people i know, by creating a folder that look like ...
7
votes
2answers
1k views
Why does HTTP Basic authentication encode the username and password with base64?
RFC 2617 requires that in HTTP Basic authentication, the username and password must be encoded with base64.
To receive authorization, the client sends the userid and password,
separated by a ...
1
vote
3answers
441 views
Disadvantages of HTTP GET/POST Flooding Attack?
I asked about What is HTTP GET/POST Flooding Attack? recently and I got a few detailed answers about what they are and how they work.
Now I want to find out what are the disadvantages of them.
1
vote
2answers
380 views
HTTP Response Splitting
Is this apart of a HTTP Response Splitting attack ? Here below is some code that gets put into a web browser after clearing the url while on the website
javascript: var xhr = new XMLHttpRequest(); ...
2
votes
2answers
275 views
How does Chat monitor work,if we use encrypted service like gtalk
i have heard that there are software like this http://formessengers.com/mdetect.htm that monitor Chats and can see the chat logs,but how do these kind of software work if we are using services like ...
1
vote
3answers
2k views
What is HTTP GET/POST Flooding Attack?
I want to know what is HTTP GET/POST flood attack and what are their major differences and mitigation strategies ?
I searched a lot but I really can't find some good articles nor examples about this ...
7
votes
2answers
89 views
Can other customers on shared hosting see requests from/to my site?
I installed a wiki on my shared webhosting (using Apache) account. This wiki is set to private (no read/edit/create rights for unauthorized users) and I'm the only one with an account.
The wiki ...
4
votes
2answers
209 views
What exploit types do I need to protect against in PHP?
I recently learned that apparently, it is common for people to attempt SQL injections using the HTTP referrer in PHP. What other inputs do I need to protect against? I am currently "cleaning up" ...
8
votes
2answers
596 views
Strange request URI with lot of + (spaces) and “chosen nickname”
Over the last six months or so (after publishing a certain article) my site has being pestered with a number of requests URIs that follow this pattern:
...
