Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP ...

learn more… | top users | synonyms

0
votes
0answers
17 views

Slow Loris Get Request

From my understanding, a slow loris attack is an attack of incomplete GET requests to most famously an Apache server because the server does not timeout the connection made. GET / HTTP/1.1\r\nHost: ...
9
votes
3answers
423 views

External websites in logs [duplicate]

I have a website, let's call it www.good.com. I've been getting a lot of requests to www.good.com under completely different URLs than www.good.com. I suspect this traffic is also causing some site ...
10
votes
0answers
1k views

If you block all incoming connections, how can you still use the internet? [migrated]

If your ISP or firewall is blocking all incoming connections, how can web servers still send you data to your browser? You send the request (outgoing) and server sends data (incoming). If you block ...
-1
votes
0answers
21 views

Https and FTPS security [duplicate]

Since booth FTPS and HTTPS are protocols over SSL/TLS, is it correct to assume that both are 100% equivalent in terms of security? Or am I missing something?
1
vote
0answers
26 views

Cross Origin Resource Sharing question

I have some mockup html/javascript on my desktop, I made an ajax GET call to: http://www.bungie.net/platform/Destiny/TigerPSN/Account/4611686018429149347/Character/2305843009215132906/Activities/ ...
0
votes
1answer
72 views

Is cloud server without HTTPS secure

I am running a Seafile Open Source Cloud server (v 4.0.6) on my Raspberry Pi 2. Currently it is set up to simply run without HTTPS or even a domain name on [myIP]:8000. I am also running an Apache web ...
12
votes
3answers
971 views

Why for some SSL websites browsers show extra info, while for others dont

While visiting some https websites (like online banks, etc) url string appear to have little extra green box on the left hand side, with some organisation details. While other https websites just ...
2
votes
1answer
41 views

Server side validations for file upload to prevent DoS on HTTP server

I am aware that client side validations can be easily bypassed by means like disabling javascript. I would like to know the things to be checked while doing a server side validation for file upload. I ...
5
votes
3answers
94 views

Can you sniff traffic to ip address from outside of your network?

I am not sure what it is called or even if it is possible but here is the scenario I am curious about: I login to a site that does not use SSL/TLS to do some work (unfortunately I must use this site ...
2
votes
1answer
65 views

application/json Content-Type character set

According to the OWASP Application Security Verification Standard: V11.3 Verify that every HTTP response contains a content type header specifying a safe character set (e.g., UTF-8). According ...
1
vote
1answer
54 views

Tamper with post data before it is sent

I am currently doing some pentesting for my work (not my job role but i always wanted to learn). I am trying to modify post and get data as it is sent (intercept, tamper), the web app I am trying to ...
8
votes
2answers
690 views

Question About HTTPS Security [duplicate]

I recently read about how HTTPS work and I have some questions to clarify. Pardon me if this sounds silly but I just need to get this clear. Correct me if I am wrong. I got to know that as part of ...
14
votes
7answers
3k views

How to perform safe authentication via HTTP?

I have to log in on an HTTP website. There is a login form which contains inputs for username and password and as hidden inputs the sessionId. I am creating an application in which I have to access ...
-2
votes
1answer
77 views

is encrypted body http secure

I'm working on an embedded project that needs to communicate with a server. Both the server and the device have an AES key pre-installed. I have a network device that provides http services but not ...
2
votes
1answer
72 views

Whitelist for HTTP request

Malicious request can come in the form of user agent string, referrer or cookie. To prevent being pawned by zero day attacks such as Shellshock, I have created a whitelist of characters for user agent ...
3
votes
1answer
97 views

Can serving HTTPS to Internet Explorer on Windows XP be made secure?

Answers to Why is HTTPS not the default protocol? state that a lot of sites still use clear HTTP instead of HTTPS because all of these are true: A substantial number of visitors to the site use ...
0
votes
1answer
39 views

rate limiting and access filter for web application

I had a requirement of rate limiting and dynamically access controlling access to web application dynamically I want to be able to rate limit access turned on / off dynamically black/white list ...
0
votes
2answers
77 views

Is it safe to set up IP address to domain name redirection?

We recieved the following e-mail with from one of the UI developers When we browser site with IP: http://x.x.x.x/, it doesn’t redirect to http://www.our_website_name.com. This could cause ...
0
votes
2answers
91 views

Are CSRF tokens useful outside of web APIs?

I'm trying to understand CSRF tokens and one thing isn't making sense to me. For a web API, you can provide a CSRF token just once, on authentication, and expect the client to remember that token ...
2
votes
1answer
62 views

Best way to do security testing for a server behind nginx proxy [closed]

I'm trying to do some security testing for my server(not a web server) which is sitting behind a nginx proxy. To start with it, I've done some fuzz testing using Sulley. As expected, most of the ...
22
votes
9answers
3k views

Why can protocols on higher layers be left unchanged?

In his answer to "How does SSL/TLS work?", Luc gives an explanation of how SSL works: SSL (and its successor, TLS) is a protocol that operates directly on top of TCP (although there are also ...
4
votes
3answers
120 views

How is HTTPS/SSL able to hide destination website that one is connecting to?

I understand how it is able to create a secure connection via the handshake, but how is it able to initiate a secure connection without first sending an unencrypted request, thus revealing the ...
16
votes
4answers
3k views

Can someone using Wireshark obtain the full URL if my program uses HTTPS?

While perusing the contents of pcap files I've noticed some URLs appear to be visible despite being HTTPS. These mainly occur inside payloads that contain cert URLs too, but I also see HTTPS URLs ...
0
votes
0answers
30 views

What to use to encode JSON Web Token?

I'm using JWT to create access tokens for a Sinatra API. My question is, what should I use to sign the token? Right now I'm trying to use the user's password hash, but bcrypt-ruby changes the ...
1
vote
2answers
76 views

Security of HTTP proxies

If POST requests are being made to a website via a browser using an HTTP proxy from sslproxies.org, is it possible to trace the origin of those AJAX requests without having access to the proxy being ...
1
vote
1answer
82 views

FTP over SSL vs HTTPS implemention

Consider two implementations of SSL on a HTTP server and on an FTP server. With the same cipher suites used and the exact same protocols used. Is one more secure than the other. I have heard that it ...
2
votes
1answer
99 views

HTTP Host Header redirect traffic

Recently, I've seen periodic floods of traffic to my web servers with various Host headers that do not belong to us. The traffic appears to come primarily from China and a decent number seem to think ...
2
votes
2answers
155 views

How can I be sure that I'm downloading over SSL?

Maybe I'm asking absolutely dumb question, but I couldn't find the answer yet. I know when I'm sending or getting a data in a browser over https, both server and client (browser) checks each other ...
0
votes
1answer
92 views

How could one defeat Webtrackers

I was just wondering why some pages refuse to load completely while surfing with no-script Plug-in when I don’t allow specific Java scripts. I was wondering if there is some way to hold the tracker ...
0
votes
2answers
107 views

intercepting AJAX request and response using BURP

I would like to intercept an AJAX request using BURP. I have used BURP for web applications testing before. This, however, appears to be a weird case. I am not certain what am I missing here. The ...
2
votes
1answer
71 views

CSRF-protection using authentication token in HTTP header

I'm working on a web application which stores an authentication token in a cookie. The only CSRF-protection is referrer checking. I am considering improving this by moving the authentication token ...
4
votes
2answers
164 views

Long character sequence in first string of HTTP GET request breaks the web service's HTTP response. Buffer overflow?

During my current security audit test I've stumbled on something I can't possibly comprehend. The behavior exhibits signs of a buffer overflow in the target or in some intermidiate service (HTTP ...
0
votes
2answers
52 views

HTTPS in request and HTTP in response [closed]

If I have an API that calls a backend webservice, is it possible to use HTTPS in the request and just HTTP in the response? I have such a question because I want to protect my OAuth token in my ...
6
votes
2answers
849 views

Know of any HTTP tarpits/blackholes to use for redirecting malicious traffic?

So I cleaned up some malicious PHP scripts from a client's site and I've been monitoring for follow up connections to the scripts. Of course, I've found a LOT of IPs requesting the files. Too many ...
1
vote
2answers
41 views

HTTP BA from a different Server [duplicate]

There is a weird situation that I am stuck with regarding HTTP Basic Authentication. Below is a hypothetical situation: Lets say there is a certain domain, say https://myfacebook.com and there is a ...
1
vote
0answers
58 views

HTTP GET Request to a webpage that does not exist [closed]

I am seeing a machine is making a HTTP GET request to webpage (ex: www.sample.com/1.png), proxy devices respond with status code 407 (proxy auth required). But when I checked for the site via ...
0
votes
1answer
41 views

Working of Burp [closed]

I want to know How does burp decides whether the attack has been successful or not. When I send a request through burp the server give http response code as 500, what does this mean Session lost ...
0
votes
2answers
107 views

Scan all possible files on server (Brute force Filenames)

I'm not sure if I'm right here, but I just wanted to know if there is a tool that scans all possible filename combinations on a server and tells you what filenames the server responded to. So it would ...
2
votes
1answer
72 views

Http redirect using Location, but using falsely supplied data from host header

If I have a domain www.mysite.com, and I am making a request to www.mysite.com on port 80 using telnet, but I send a host header with another domain name(www.wrong-domain.com), but the server doesn't ...
4
votes
1answer
73 views

Do concurrent connections to an HTTPS website perform separate SSL handshakes?

I know that most browsers nowadays support around 6 concurrent TCP sessions per hostname, to perform multiple requests at the same time. For sites which utilise SSL, is there a separate handshake ...
0
votes
1answer
156 views

Authentication and security of a REST API

Scenario: I design a REST API where authenticated users can hit the API over TLS. I have to use TLS as the data transmitted over the wire is sensitive. I don't need authorization right now, but I ...
4
votes
2answers
908 views

Data on Malicious WiFi Network

Let's assume that I unwittingly connect to a malicious WiFi network and visit websites. By malicious, I mean the network has been set up for the purpose of stealing data. From what I've read, using ...
1
vote
1answer
577 views

Hydra from Kali Linux + Tamper http post form syntax of the failure login attempt [duplicate]

I had asked this question in the general forum I think it is more adequate to place it here. ...
2
votes
2answers
100 views

How to ensure that a login is really going over http?

So I've been offered the chance to go to a day long security awareness event hosted by some organization. On their site, I noticed the login box in the corner, but the site was delivered on HTTP. ...
-1
votes
2answers
177 views

Google is going to mark all HTTP traffics as insecure in 2015? [closed]

Firstly I would like to mention that I got this news from a blog I have read in last few days. This is only, perhaps, a rumor. If this is true, does this mean that anyone using Google Chrome or apps ...
1
vote
1answer
54 views

Is there a way to mimic http request of a compiled program?

Lets suppose my program makes a http request and uses it response to update some values. Is it possible to somehow mimic the response in order to modify it so the program believes the server responded ...
4
votes
1answer
89 views

Should I be worried about this url request I received on my site?

I was checking the weekend logs of my IIS server and noticed a strange request which was blocked: ...
-4
votes
2answers
175 views

Using my own encryption instead of https in app

I am writing a program that uses a webserver as a backend for communication between different users. Is it okay to use my own encryption (such as ...
4
votes
1answer
258 views

Is HTTPS over UDP secure?

Recently, I notice that while using Google search, I am connecting to Google's server using UDP instead of TCP on both port 80 and port 443. It seems that Google is experimenting with some new ...
-3
votes
1answer
68 views

What is the Impact of TRACE Method? [duplicate]

What attacker will benefit of TRACE Exploitation and What is the Recommendation to fix this issue?