Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP ...
2
votes
2answers
29 views
CSRF protection and Single Page Apps
I am in the process of writing a thick client web app using Angular.js (single page app) and was wondering what are the best practices for securing the app using a CSRF token.
Should I send a CSRF ...
18
votes
5answers
545 views
Malicious Links that Respond to Browsers but not curl or wget
There are some emails with links to people's cracked websites with a malware download
Like this kind of email:
fake DHL pack station email
... the links often take the form of:
http:// ...
-1
votes
1answer
80 views
Wireshark Decode HTTPS Root Certificate
I'm currently dealing with a "Sniffy" java application. Well I can see it connecting to some kind of server using HTTPS. I would like to see what its sending or getting over HTTPS. i have read some ...
5
votes
3answers
185 views
How to block an IP, if getting many http requests in a second
If some one tried force burst attack on my website, how can I block them?
I mean, I want to block an IP if I have many http/Apache requests in a second.
Thanks in advance.
1
vote
1answer
61 views
Simple and secure remote installation method that accepts input via a web page?
When installing software on a remote server: Is it possible to let the admin (i.e. the user that installs the software) define admin username and password via a HTML page, in a secure manner?
...
4
votes
2answers
224 views
I'm being followed on the web. Explanations for mysterious behavior
Am I being stalked?
I was recently doing some basic Python development scripting.
Python has a nice feature where it can run a simple HTTP server that serves the contents of the local directory, on ...
-1
votes
2answers
107 views
Allow embedded videos while keeping youtube blocked [closed]
Our organization has launched a training program for employees. the hosting server(internal), has YouTube videos embedded. we have YouTube blocked, and employees access the internet via proxy.
How can ...
6
votes
1answer
76 views
Are there any situations when one can only mount a passive MITM?
This came up while discussing Web & insecure HTTP - Using RSA for encrypting passwords on the client side
Is there any such situation possible when requesting an HTTP page where an attacker is ...
4
votes
1answer
138 views
If SSL encrypts urls, then how are https messages routed?
I've googled around and it seems like SSL encrypts URLs. (Correct?) As I understand it, if I go to a site like http://security.stackexchange.com then a DNS server looks at the URL, says hey, he wants ...
2
votes
3answers
146 views
How to identify the Java program that is maliciously accessing my web site from many client addresses?
For many years, my personal web site receives numerous pairs of hits that look like this, every day:
202.xx.xx.xx - - [22/Apr/2013:12:02:26 +0000] "GET / HTTP/1.1" 200 5923 "-" "Java/1.4.1_04"
...
15
votes
3answers
465 views
Vulnerable code suggested on OWASP?
Session Hijacking Prevention
It is good practice to bind sessions to IP addresses, that would prevent most session hijacking scenarios (but not all), however some users might use anonymity ...
5
votes
3answers
241 views
Is it possible to “protect” against MITM attacks over HTTP?
In a conversation on twitter I warned a site about a security vulnerability. Specifically, the possibility of a MITM (Man in the Middle) attack used to compromise their registration form.
The ...
29
votes
9answers
1k views
Use additional “password” in Referer to hide private site?
I have a private (= I'm the only user) site at example.com/private/. Nothing else is published at this host (it's my domain).
I don't want anyone to know that there is anything at example.com, ...
3
votes
7answers
509 views
Is it compulsory to have https on e-commerce site?
I saw that some e-commerce scripts can also run without ssl, but everyone recommends to activate it to protect sensitive data.
I just saw a site that has an e-shop link, if i click it my browser says ...
1
vote
1answer
93 views
Following redirects from HTTPS to HTTP - Secure?
So I have an HTTP client which supports HTTPS. However, it doesn't follow the HTTP spec recommendation for redirects on POST(which is to ask the user before redirecting)
This means, in theory, if you ...
-1
votes
2answers
87 views
Keyloggers and Email Accounts [duplicate]
This morning, I was experimenting with some keyloggers and noticed that they have a feature to send e-mails to the attacker.
How can these e-mails be intercepted? Let us say that I have a packet ...
0
votes
1answer
88 views
Ports used by Online Email Accounts such as Yahoo Mail, Gmail etc
Let us say that I send an email using Yahoo Mail or Gmail. Can this email be intercepted using a packet sniffer?
On which port does the email travel? HTTP, SMTP, POP3?
Thank you.
2
votes
1answer
122 views
Web service HMAC authentication/anti-replay
I am creating a web service, which handles various requests from web clients. The client and server share a big secret key S, and when one part wants to send data, it calculates the token as follows:
...
2
votes
1answer
446 views
How does DHE-RSA-AES256-SHA compare to RC4 as the Cipher for SSL?
I read a lot of issue [1] currently stating that RC4 is broken and is at risk.
I just checked my web server (nginx) and it is using the default settings, which is
DHE-RSA-AES256-SHA
How does this ...
1
vote
1answer
138 views
Web Applications (http): Don't get how token based authentication is secure
See something like this:
http://stackoverflow.com/questions/10826293/restful-authentication-via-spring/10864088#comment21706215_10864088
Or more specific:
Token-based authentication - Securing the ...
5
votes
1answer
101 views
What's the risk in putting semantically meaningful data in an HTTP session identifier?
I'm currently looking at performance optimization and am considering a way of speeding up cookie based session handling. There are advantages to having a session identifier in place when there is no ...
2
votes
3answers
177 views
HMAC What is secure manner to distribute shared secret between client and server?
I am looking at ways to secure http communication using HMAC. My understanding is that in this scenario the client and the server both know a secret. This means the secret must be first generated on ...
1
vote
2answers
108 views
Is it bad practice to send decryptable data?
If I'm authenticating an action, is it a bad practice to authorize the connection using a decryptable hash that does have a specific algorithm, but only the remote machine knows?
Is sending ...
15
votes
4answers
545 views
Credit card forms on HTTP pages a MITM risk?
The other day, there was a web developer mailing list thread about a fundraiser page.
One person noted that the page with the credit card form was HTTP, not HTTPS.
In response, one person said that ...
2
votes
2answers
73 views
Actual issue? Phone switches from 3G to router makes session switch from https to http
I heard that a security issue exists in some cases when a mobile phone has:
Connected to a website via https via 3G
Connects to a router
I'm told that that in this particular scenario the router ...
2
votes
2answers
154 views
HTTPOnly Cookies: Security Depends on Client Cooperation?
I've been implementing HTTPOnly cookie-based session handling and have some questions about what HTTPOnly means.
I realise it's a flag that gets passed around in the HTTP header when setting cookies. ...
8
votes
4answers
389 views
Can URLs be sniffed when using SSL? [duplicate]
I know that http requests can be sniffed, so sniffer can see the requested URL from the victim. So 2 days ago I my bank made me a web-account to see, send money etc...
The thing I saw is my session ...
4
votes
4answers
161 views
Security risk of adding a HTTP Header with server identifier
We are about to deploy a web application to a web farm of quite a few web servers. During our testing we have found issues happening in one of the servers but not in others. Most of them because of ...
8
votes
5answers
526 views
Apache/Linux server, DoS attack from own IP
I have an unusual problem I've been trying to diagnose for a while:
It's about a Debian server running a custom compile of apache 2.2 with PHP, Red5, MySQL 5.5 (standard binary), sendmail (distro ...
1
vote
2answers
220 views
Secure against HTTP FLOOD ATTACK
What is the best way to defend your web site against HTTP FLOOD POST/GET ATTACK ?
-3
votes
2answers
96 views
Cannot use HTTPS or download stuff from sourceforge with a mac, what kind of soft does that? [closed]
I'm at a public library (france). I have a http library login to access that wifi.
I just want to download some SFML zip to make some app, but many things are blocked, mainly https. I can't even ...
0
votes
4answers
221 views
Is using the md5 hashing algorithm as method for authorization in an HTTP POST request unsafe?
I am creating a page on a website that will show a user some authorized information from another website, and that website uses a combination of the user's user-number and a secret passphrase hashed ...
0
votes
1answer
42 views
What would be a safe number of HTTP redirects to follow when scraping a URL until giving up? [closed]
I'm doing a "share box" where users can enter a link before posting and the app automatically scraps the URL to get a thumbnail and some other info. My question is: What would be a safe number of HTTP ...
1
vote
1answer
209 views
Route traffic from iphone to dektop and back
Iv'e got some iOS app to pentest, and the target server is accessible only through the iPhone APN.
My problem is, that i want to configure the traffic in such way so i can intercept and tamper HTTP ...
2
votes
3answers
239 views
Is it possible to list folder from my web server if i have an empty index.html in the root folder?
I have a small mongoose web server installed on my machine. I have a empty index.html in the root directory.
I want to be able to share link with people i know, by creating a folder that look like ...
7
votes
2answers
808 views
Why does HTTP Basic authentication encode the username and password with base64?
RFC 2617 requires that in HTTP Basic authentication, the username and password must be encoded with base64.
To receive authorization, the client sends the userid and password,
separated by a ...
1
vote
3answers
405 views
Disadvantages of HTTP GET/POST Flooding Attack?
I asked about What is HTTP GET/POST Flooding Attack? recently and I got a few detailed answers about what they are and how they work.
Now I want to find out what are the disadvantages of them.
1
vote
2answers
342 views
HTTP Response Splitting
Is this apart of a HTTP Response Splitting attack ? Here below is some code that gets put into a web browser after clearing the url while on the website
javascript: var xhr = new XMLHttpRequest(); ...
2
votes
2answers
243 views
How does Chat monitor work,if we use encrypted service like gtalk
i have heard that there are software like this http://formessengers.com/mdetect.htm that monitor Chats and can see the chat logs,but how do these kind of software work if we are using services like ...
1
vote
3answers
1k views
What is HTTP GET/POST Flooding Attack?
I want to know what is HTTP GET/POST flood attack and what are their major differences and mitigation strategies ?
I searched a lot but I really can't find some good articles nor examples about this ...
7
votes
2answers
87 views
Can other customers on shared hosting see requests from/to my site?
I installed a wiki on my shared webhosting (using Apache) account. This wiki is set to private (no read/edit/create rights for unauthorized users) and I'm the only one with an account.
The wiki ...
3
votes
2answers
196 views
What exploit types do I need to protect against in PHP?
I recently learned that apparently, it is common for people to attempt SQL injections using the HTTP referrer in PHP. What other inputs do I need to protect against? I am currently "cleaning up" ...
7
votes
2answers
546 views
Strange request URI with lot of + (spaces) and “chosen nickname”
Over the last six months or so (after publishing a certain article) my site has being pestered with a number of requests URIs that follow this pattern:
...
6
votes
3answers
285 views
What sort of delay will deter a robot from crawling my site?
I use what I believe is the standard method of identifying bad bots that do not respect my robots.txt (i.e. disallowing crawling the bad-bots subdirectory, then logging those who still go there).
So ...
3
votes
3answers
170 views
How similar are bots regarding their HTTP GET request?
Lets assume a botnet is attacking a website by HTTP GET flooding. To find the bots, the only way seems to be finding the similarities of the HTTP GET requests considering the URL and header fields, ...
0
votes
1answer
111 views
Anonymous access over SSL
I am using a paid VPN service and I just realized IP privacy does not exist at all when the connection is made over SSL.
If I Google "what is my ip" using the HTTP version of Google, it will give me ...
2
votes
1answer
182 views
Burp proxy between non proxy aware device
I want to intercept traffic between a Ethernet connected device, which is not proxy aware and modify/inject javascript. Conventionally when testing webapps I would use burp.
Can burp sit on my ...
1
vote
3answers
235 views
Using Netcat to detect the webserver type
In order to know which server a site is running I can use netcat.
Through the following command I can gather information about the type of server installed.
netcat -vv www.example.com 80
But if ...
0
votes
2answers
163 views
How valid is this statement “SSL sit between application layer and network layer”
taken from http://searchsecurity.techtarget.com/answer/How-does-SSL-sit-between-the-network-layer-and-application-layer
The SSL protocol is quite unusual, as it doesn't just operate at one layer. ...
0
votes
3answers
102 views
Does including decorative HTTP headers into server reply pose extra security risk?
Suppose I reconfigure my HTTP server to add the following HTTP header into every reply:
X-Hello: Hello!
or some other presumably funny text.
Can this have any negative effect on the server ...
