Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP ...

learn more… | top users | synonyms

3
votes
2answers
500 views

What is the difference between EV-SSL certificates and Normal SSL certificates? [duplicate]

Recently while looking at several banking URLs I can see the domain name with security certificate at address bar and normal locker security certificate at address bar. Have a look at the screenshots: ...
1
vote
1answer
46 views

Is this behavior the result of malware?

I have setup a new set of servers to test a software in Amazon EC2, and had set up my application. I've given it public access and a DNS entry, so its easily reachable by those that need to test it ...
8
votes
1answer
295 views

How to convert http site to full https? [closed]

I have a site running only with http. I have decided I want to go full https, but I have no idea how to do this. Do I have to buy that certificate somewhere? Where, how much does it cost? Does it ...
5
votes
2answers
72 views

HSTS behaviour within incognito mode?

By definition, incognito mode shouldn't leave a trail of visited websites. However, HSTS (HTTP Strict Transport Security) requires the browser to keep a database of hosts that have requested HSTS, ...
0
votes
1answer
45 views

Could HTTPS-Attacks like CRIME be mitigated by changing the session cookie regularly?

I was just reading about CRIME which is an attack to steal sensitive information by creating requests. Could this attack be mitigated, if the Server wouldn't send the client the actual session key to ...
0
votes
0answers
34 views

Can I prevent a replay attack of my signed JWTs?

I have implemented a stateless auth over HTTP in Laravel, using JWTs. I send my username/password from the frontend. Server authenticates user, sends back a signed JWT with an expiry time. I'm ...
1
vote
0answers
40 views

Can user identifying information in Dropbox be derived from subscription data?

I've noticed that my Dropbox installation really loves sending unencrypted information over the net including a "user_id" and it's user-agent. What i want to know is if it's possible at all to ...
1
vote
1answer
51 views

Why is the HTTP Server header not used by most servers, but the User agent used by most browsers? [closed]

I've read that the Server header would disclose information, and that its use would be bad. The arguments made in that question also apply for the User agent header. So why is it still used, and not a ...
2
votes
0answers
39 views
+50

Multi sub-domain login for content, spring security for main

Illustration : mainsite.com and contentsite.com both are being developed for same company by two teams. we will have login etc at mainsite.com contentsite.com will have some content that is not ...
9
votes
2answers
273 views

Can anyone recognise this sudden influx of malformed HTTP requests?

Starting around 3 weeks ago, my site started getting a lot of strange and recurring http requests from my users. I'm familiar with malicious scans which happen on a daily basis, but these requests ...
3
votes
1answer
49 views

How long do HTML password fields (sent to the server as postdata) remain in memory?

In any major server-side web framework, there is usually a mechanism to read HTML form input, e.g. in ASP, for an HTML element, <input type="text" name="the_field" />, it is ...
2
votes
1answer
45 views

Browser - what gets saved to the disk

We run scraping jobs on behalf of users. We use webkit-gtk as browser to do the scraping. Each job is executed as a separate process So as not to mix user data we have isolated following data per ...
5
votes
2answers
136 views

Security sanity check

A company whose services I'm trying to integrate uses this protocol: An AES key is embedded in an Android library. To authenticate itself, the library sends a SHA1 hash of the key over plain HTTP. ...
1
vote
0answers
74 views

HTTP headers of Gmail [migrated]

I just examined the headers of HTTP requests and responses regarding to Gmail. First, I submitted username and password and examined the headers. Then deleted an email from inbox and examined again. ...
1
vote
2answers
91 views

Block http HEAD, TRACE, DELETE OR TRACK requests is a valid security feature? [duplicate]

Block http HEAD requests helps us to solidify the safety rules for a Apache webserver or this restriction would be an exaggerated? What kind of vulnerability can be exploited by HEAD method? Tests: ...
17
votes
2answers
1k views

Should I disable http HEAD requests?

I have seen increased 'HEAD' requests in my webserver access.log. What are these requests for? Should I disable this method in my webserver configs?
0
votes
1answer
46 views

Publicly Available API + Sensitive ID/Key Transmission Over HTTP

I've run into a predicament... I'm developing a mobile application that utilizes a server for various things. One portion is that it stores an id/key pair related to accessing and processing ...
0
votes
2answers
168 views

Clarifying MITM attacks and Digital Certificate requirement

We are running a Portal application for our client with Payment Gateway integrated. Payment gateway uses SSL as it is suppose to be . The concern for me is that our Portal application does not use ...
3
votes
3answers
281 views

Why isn't it possible for a third party to decrypt HTTPS traffic? [duplicate]

I really don't know much about HTTPS. But I always hear people saying that it is 100% safe and bullet proof. My question is: Is that true or even possible. I mean there are lots of tools that allow ...
0
votes
2answers
70 views

How does HTTP Basic Auth persist across pageviews?

I am familiar with the basic workings of HTTP Auth, but how does it keep track of authentication between page views? I see there is no cookie created when the initial authentication takes place.
2
votes
1answer
80 views

Where do browsers store HTTP Authentication details

Where do browsers store HTTP Authentication credentials ? If I gain access to a browser, is there some place I can look where all HTTP Authentication details would be available? In most browsers, even ...
1
vote
2answers
60 views

Are MITM attacks possible on HTTP loopbacks?

I have a web server running at example.com. The web server performs a server-side request to example.com which results in a loopback, so the request never passes over the network. Is this request ...
1
vote
2answers
43 views

HTTP Header disabling non-SSL (or TLS) content on this page

Is there an HTTP Response header that disallows any non-SSL content from being displayed on the current page? The idea is some times external content that needs to be on the website (cough, ad ...
1
vote
3answers
86 views

HTTP authentication: identify the client

We have a web-site, where each user has to log-in to access a private area. Inside the private area, there are some information about the user, a profile, including some sensitive information (home ...
0
votes
2answers
108 views

Is the lack of https reason enough to abort form submission?

Preamble: Am in awe about the quality of both questions and answers on https / SSL on this site. My humble question below pales in comparison. Both on professional and amateur websites I've ...
0
votes
5answers
218 views

Are all URL shorteners unsecure/vulnerable?

The OWASP state that open redirect is a vulnerability: An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This ...
0
votes
1answer
67 views

Secure end-to-end when part of conversation must be over HTTP

We have a situation where a user's identity can be verified as follows: the network provider knows the identity of the user and injects secure headers into the HTTP request, which our servers can use ...
2
votes
2answers
272 views

Content-Security-Policy hash of script

<?php header("Content-Security-Policy: default-src 'sha256-".base64_encode(hash('sha256', 'console.log("Hello world");', true))."'"); ?> <script>console.log("Hello world");</script> ...
0
votes
1answer
128 views

HTTPS encryption and internet proxy [closed]

I'm not sure if this is the right place to ask this question. Please tell me, and I'll delete it. I want to modify a Word document hosted on my OneDrive account. I see that it is using a SSL ...
6
votes
3answers
1k views

Why can't we do MiTM attacks when using secure connection

I have this silly question that is bothering me. When not using secure connection (HTTP for example) cookies can be intercepted and used to connect to the site as if we have the id and password. We ...
3
votes
2answers
377 views

Why do we need WTLS?

Please excuse my probably gross misunderstanding of how all this works. I just started reading SSL & TLS Essentials by Stephen Thomas, and in chapter 1 he talks about how TLS is a separate ...
2
votes
2answers
196 views

Is HTTPS as secure or more secure than SSH if both have an IP address whitelist?

I'm wondering whether an HTTPS API endpoint would be as secure as or more secure than SSH. API Endpoint The API endpoint would require HTTPS The API authentication would use a POST'd API key. The ...
0
votes
2answers
51 views

Self signed certificate secure when just client sends sensitive information?

Is it secure to create a self signed certificate when just clients will send sensitive information to the server? After checking out the topic "What are the risks of self signing a certificate for ...
0
votes
0answers
120 views

Testing Basic Authentication with ncrack

I'm conducting some basic pen testing against a page protected with Basic Authentication. I've sucessfully tested with Medusa and Hydra but am struggling to get the syntax correct for ncrack. the ...
2
votes
2answers
111 views

On an “uncritical” site, is there any reason to NOT trust a self-signed certificate?

There are many sites that have self-signed ("untrusted" in Firefox) certificates. I then have the option to trust them or not. If I not trust them I can either leave the site or only visit the site ...
4
votes
3answers
106 views

Preventive security action in Android App

Currently, I'm developing a bank related android app. I would share my knowledge and also maybe you guys are more expert than me so you can add your ideas to the list. Bank is a very special client. ...
2
votes
2answers
280 views

What was the security vulnerability behind Box and Dropbox and what's different now?

Earlier today I received a number of comments saying that my shared links were disabled. I looked around and saw a number of articles explaining what happened, and Dropbox posted an official statement ...
4
votes
4answers
154 views

What risks are introduced by the browser passing the “referer” to the next site visited from a link to another domain?

As of today, I believe every major browser will by default reveal to a third-party site which site I came from, and more specifically, the exact URL I came from. What are the privacy implications of ...
0
votes
1answer
73 views

Sending GET requests to non-servers?

I ran a couple of wireshark runs for my computer and noticed inbound GET requests. Is it legitimate traffic for there to be GET request traffic inbound to my home computer if my home computer isn't a ...
10
votes
3answers
894 views

Is the HTTP TRACE method a security vulnerability?

I saw many posts here on this site dishing out advice on disabling HTTP TRACE method to prevent cross site tracing. I sought to do the same thing. But when I read the Apache documentation, it gives ...
3
votes
1answer
72 views

Can we detect malicious redirections by retrieving the webpage's headers? [closed]

Is it possible to know if there are URL redirections (to malicious websites) by retrieving the HTTP request and response headers of the legitimate website ?
4
votes
2answers
652 views

Securing remotely accessible IP cameras that do not support HTTPS

I have some IP cameras set up on my home network, which is WPA2 protected. These cameras are setup to be accessible from the Internet thru my router's DDNS address, and port number. So for example, ...
-1
votes
2answers
100 views

How to avoid session sharing inside the same network

I was thinking about a situation to avoid session sharing or hijacking, validating the IP the user logged in against the ip that is accessing any page after log in. It was working until I figured it's ...
0
votes
1answer
92 views

Do I need an SSL Certificate for a HTTP only site?

The cert for our public facing site is about to expire soon. Our site is entirely http. The site runs on SharePoint, and with SharePoint working with NTLM, the credentials that are passed over the ...
0
votes
0answers
71 views

Will http only cookie work while using chrome bandwidth saving feature in Android?

I am developing a site which uses http only cookies for authentication. By design[w3 standard] these cookies are XMLHttpObjects and will only be submitted to the domain they originated from to prevent ...
1
vote
1answer
68 views

How do you identify a website's form-type?

How do you know which attack method to use when using software like thc hydra, brutus, etc? e.g. http-get, https-get, http-form-get, http-form-post, etc? For example, for sites like Yahoo, Gmail, and ...
1
vote
2answers
99 views

How to prevent attacks before HSTS is established for the first time? [closed]

What is the best way to accomplish this and prevent attacks like SSL Strip?
0
votes
1answer
104 views

HTTP Status Codes - security considerations [duplicate]

I am designing an authorization framework and now I am thinking about the error codes which I should return when someone is trying to access a resource and he doesn't have the required permissions. ...
0
votes
2answers
304 views

Why don't more websites implement Perfect Forward Secrecy?

From what I understand, all it takes to enable PFS on a webserver is adding ephemeral cipher suites (ones that use DHE and ECDHE for the key exchange) to the list of cipher suites used in SSL/TLS ...
2
votes
2answers
120 views

How to prevent popping up a login dialogue using a malicious hotlinked image and HTTP Basic Auth header?

While using Firefox to browse my forums, I noticed that a malicious user posted an image (via hotlinking, not by uploading to my server) with the extension .png which complies with the forum rules ...