Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP ...

learn more… | top users | synonyms

0
votes
1answer
27 views

How does the symmetric key get exchanged in SSL/TLS handshake?

I've been reading a lot about SSL/TLS handshake between a client and a server and many articles on it are very contradictory. Some say that the symmetric key that will be used to communicate between ...
0
votes
0answers
20 views

Cleartext credentials proxy logs [on hold]

I am wondering if anyone thought about this. Obviously, checking HTTP GET and POST method calls is the starting point. Is there anything else other than username:password format that should be ...
0
votes
0answers
4 views

Who and where X-Forwarded-For header in user's request is added? [migrated]

X-Forwarded-For is a HTTP header which is used to identify the IP Address of originating user. I was wondering "where" this header is added in the request and "who" actually adds it? Is it your ...
0
votes
2answers
18 views

Integrity of downloaded Oracle JDK (/software in general) [duplicate]

Found something related Why aren't application downloads routinely done over HTTPS? This is a question about general security from a noob. I couldn't find anything relevant about this topic via ...
1
vote
3answers
58 views

Is it secure to have only https binding in IIS?

I have an API that I want to be accessible only by HTTPS. I know I can use URL-rewrite to force a redirect, but don't want to install additional modules. I was wondering whether only providing an ...
0
votes
0answers
78 views

View the access code, access token, and id token from Google during an OpenID Connect flow

Situation We're wanting to use an HTTP logger/proxy/analyzer to inspect the access code, access token, and id token that are part of the code flow. The flow is happening among Google (the ...
0
votes
1answer
55 views

Does HTTPS protect from session riding?

In a typical session riding scenario, the attacker tricks the victim into sending an HTTP request to a web site they are already logged in to. For example, tricking victim to click on a link to ...
10
votes
2answers
828 views

httpoxy - does TLS/SSL mitigate the vulnerability of HTTP Proxy header?

There's a new fancy-named, branded vulnerability called HTTPOXY. My question here: Are sites served via TLS also affected? Or is this an issue only for HTTP sites (unencrypted communication channel)? ...
1
vote
1answer
43 views

Best practices for securing open APIs from quota theft

I know that appKey is not a means of authenticating applications. But I am wondering what are the best practices for avoiding quota theft for open APIs, that are not associated with any user account. ...
0
votes
1answer
71 views

How does ISP intercept web traffic?

My question originates from following articles: http://www.theregister.co.uk/2016/07/14/cloudflare_investigating_mystery_interception_of_site_traffic_across_india/ and https://medium.com/@...
0
votes
1answer
40 views

Suricata Signature Explanation

I am trying to figure out some Suricata(or Snort) signatures, more specifically, what they mean, what they prevent and have some problems about meanings of keywords. I will not write irrelevant parts. ...
1
vote
1answer
46 views

Does encrypting HTTP header value provide additional security?

Payload before encryption : HTTP/1.1 200 OK Authorization: password Content-Encoding: UTF-8 Content-Length: 138 { "command" : "delete all records" } Payload after encrypting Authorization header : ...
22
votes
2answers
2k views

How does a website know the DNS server a client uses?

There are websites which claim to do "DNS leak tests". I don't care so much about DNS leaks but am curious, how does the website know which DNS server I am using? I guessed it would be a header sent ...
2
votes
1answer
29 views

Is it safer to use the preloading feature of HTTP Strict Transport Security (HSTS)?

Is it safer to use the preloading feature of HTTP Strict Transport Security (HSTS) and if so, why? With preloading: Strict-Transport-Security: max-age=10886400; includeSubDomains; preload Without ...
1
vote
1answer
156 views

Do my router and OS “know” which URLs I visit, if SSL is used?

Is it possible for a router or an operating system to get access to URLs I visit in my browser, if SSL-encryption is used between a browser and a webserver?
2
votes
2answers
68 views

How safe is accessing HTTP traffic(non-SSL) when using VPN and connected to public WiFi?

Suppose I am using public WiFi and connected to my office network through VPN. I am accessing some applications which are not SSL enabled. How easy it is for an attacker to see the traffic if he is ...
3
votes
2answers
81 views

Choice of authentication when both HTTP and HTTPS are supported

I am looking at a system where you are able to choose if you are going to connect to the web application via HTTP and/or HTTPS. You have to authenticate on either one. I know that the best option is ...
1
vote
3answers
98 views

Is HTTP POST any more secure than HTTP GET for AJAX?

All considerations of HTTPS/SSL, etc aside, if my user fills out a form and I send it by AJAX, it seems to me that POST & GET are equally interceptible, although GET is a teensy bit more ...
1
vote
1answer
75 views

Can you get a virus from sending a GET or POST request? [duplicate]

If I need to fix up my question in any way please let me know, this is my first question on the site So there's a game development website I use where you can develop with other people, and within ...
0
votes
1answer
59 views

Deobfuscating JavaScript Malware

Recently I was going over my network activity and came upon a PCAP that is directly related to a Trojan Dropper. Taking a quick look into the TCP stream of the packets, I found some malicious ...
27
votes
5answers
3k views

What's the difference between using HSTS and doing a 301 redirection?

If I already have done a 301 redirection from all the HTTP inner pages to HTTPS, why should I use HSTS as well?
0
votes
0answers
21 views

Using Nginx to block non-GET requests

I'm running a CouchDB instance on my server. A certain database within it (not the entire CouchDB instance) is exposed at a subdomain on my website via this Nginx configuration: server { listen ...
1
vote
1answer
66 views

Security disadvantages of sending a password with GET? [duplicate]

Other than over your shoulder peeping, if a password is sent using GET in plaintext over an encrypted connection, are there any extra security disadvantages or is it the same as POST?
0
votes
1answer
64 views

Is HTTP POST insecure?

Is it possible to perform a MITM attack or even bruteforce a HTTP POST? If so how does one perform an attack and how can a developer protect his/her site from such an attack?
3
votes
2answers
81 views

CAPTCHA code refreshing vulnerability

Question is not programmatic but rather conceptual. When a user is trying to fill in a contact form and then CAPTCHA code, if he/she accidentally refreshes the page or doesn't fill a required input ...
2
votes
2answers
36 views

Testing non‐browser‐based https clients for Poodle

I have a command line tool that can download any URLs likewget (only for vcs systems) but not it’s source code, how can I test if it is vulnerable to POODLE? There are lot of online automated tools ...
12
votes
1answer
240 views

Stack Exchange's javascript is malicious

I have, recently, discovered a rather annoying problem: every first-click I have on any Stack Exchange site creates an advertisement popup. This happens on my desktop, laptop, phone and even a VM. I ...
0
votes
2answers
101 views

How can I capture another IP's HTTP traffic with Wireshark network analyzer?

How can I capture another IP's HTTP(S) requests in a local network with Wireshark network analyzer? Is it possible?
2
votes
1answer
56 views

Unsecure to allow all headers? [closed]

I'm currently developing an webapp. For testing and developing I allowed all Headers. Is this unsecure for productive use? Header unset Connection Header unset Time-Zone Header unset Keep-Alive ...
-4
votes
3answers
64 views

How to pass website firewall, in PHP? [closed]

Recently, I have posted a question, (http://stackoverflow.com/questions/37494896/how-to-save-file-from-url-to-web-server-by-php). And, there is an answer in question. In this answer, he said: "So the ...
0
votes
0answers
26 views

bundling session information in a binary

We are in the process of developing a desktop app. When a user is logged into the website we create a dynamic binary(.exe) and add session information to that binary which is valid for one time login. ...
5
votes
1answer
57 views

Can HPKP be used to track users?

There is already a large flora of "supercookies" and browser fingerprinting methods out there. I am wondering whether HPKP provides yet another method to track users? A server could send an extra ...
-3
votes
1answer
59 views

How two identical domains work on Internet when they got signed from two different CA

Let's say A and B. Considering A and B are from same location. A went to the verisign and get signed for example.com B went to the godaddy.com and get signed for same domain(example.com) Now question ...
1
vote
4answers
79 views

Server echoes HTTP headers back to client - any security issues with that?

Im troubleshooting a server that behaves a bit odd. If I make a request that looks like this: GET / HTTP/1.1 Connection: close Host: hostname Someheader: somevalue Location: Woot? Set-Cookie: test=...
3
votes
1answer
70 views

How does firewall differentiate between browsing and downloading?

The firewall installed at my college's router allows me to surf the internet but never allows me to download any package that has a size more than 100mb. I wonder how exactly does it differentiate ...
0
votes
1answer
112 views

Why does SSLStrip fail when user types HTTPS?

During an HTTPS connection between a browser and server -- Is the very first packet from the browser encrypted? My guess is that the answer is "NO" because encryption should only begin after the ...
1
vote
1answer
32 views

Does HSTS inlcudeSubDomains directive include subdomains on all levels?

I asked this question on Stack Overflow, but thought its more relevant here. Regarding the HSTS includeSubDomains directive. Does this include every subdomain underneath e.g. example.com. So abc.def....
0
votes
1answer
79 views

Deploy intranet application with SSL certificate

My company has an intranet application build on the WAMP stack - Windows / Apache / MySQL / PHP. This application is installed on a server at each customer's site, and is accessed via LAN IP address. ...
1
vote
4answers
134 views

Is it possible to send HTTP packet via spoofed IP?

I have the following PHP code that writes accepted to a file named text.txt only if the IP is equal to 127.0.0.1 (loopback). If the IP doesn't match it writes denied. <?php $file = fopen('text.txt'...
-1
votes
1answer
146 views

Can VPN provider see my data?

I have a 2 questions: If I use a VPN and I go to any websites via HTTP - does VPN provider will be able to see the traffic? Those. logins, passwords, all the texts that pass through the channel (in ...
0
votes
2answers
101 views

Need help to exploit php script vulnerability of a challenge

i am trying to exploit a vulnerability in a php script of the 'stop us' challenge of Wechall.net and I am not sure but I think I found the vulnerability, but now I don't know how to exploit it. I made ...
2
votes
2answers
105 views

What information can my ISP see using squid proxy?

My ISP provides a transparent proxy to use and I can see that they are using the squid proxy for caching this. What I am wondering is what data can they see and what can they see further if they can ...
8
votes
1answer
85 views

Strange responses from an unfamiliar HTTP server

I noticed an unfamiliar device when scanning my local wireless network. It had two open (listening?) TCP ports; TCP/80 (http?) & TCP/443 (https?). In an effort to identify the unfamiliar device;...
0
votes
0answers
103 views

Data integrity and authentication of an Arduino using JSON Web Tokens and HMACs

I have a school project involving an Arduino-based sensor that needs to send sensor readings to a server via HTTP. The sensor readings do not need to be encrypted (it's okay that people know what they ...
22
votes
3answers
4k views

Is it possible to transfer a virus through browser video?

I know that there is already a question related to viruses in videos, but the implication in the other question is that videos in question have been downloaded and played by media software on the ...
0
votes
0answers
95 views

How to safely pass password reset token from http get request to html page?

I am working on implementing my own custom password reset that sends an email where the user is taking to a page to reset their password. So far I have generated a unique token that gets put in an ...
4
votes
1answer
91 views

How secure is my system for a password reset?

I am using my custom Parse Server with Heroku which I am pretty sure (99%) that it is decently secure using things like oAuth2 and 1 way hashed passwords. The problem is I am trying to implement my ...
3
votes
1answer
59 views

What security implications does DNS prefetching have?

To improve performance, most browsers prefetch DNS records for linked resources in the background so that the browsers already knows where to send the request the instance you click the link. This is ...
1
vote
1answer
61 views

Why do some websites tell you they use cookies? [closed]

I often visit websites that have a small box telling me that they use cookies. Most sites just store cookies and don't say anything. Is there a reason that some do and others don't? For example:
63
votes
5answers
10k views

HTTPS web service switched to HTTP. What can go wrong?

I recently visited a website which used to have an HTTPS connection. Now it has just a plain HTTP connection, and the authentication method has changed from user+password to "authenticate with Google ...