0
votes
1answer
143 views

HTTPS Proxy Everwhere?

I am configuring a HTTPS proxy, which I want to use for my laptop wherever I go. The idea is that since its encrypted, I should be safe from eavesdroppers, even on open wireless networks. Think of it ...
0
votes
1answer
262 views

Intercepting HTTP requests from a Java Application [duplicate]

I was wondering if anyone knew of a way of capturing and modifying the requests sent out by a Java application over HTTP. I can see them in Wireshark, but I also want to be able to modify them in ...
3
votes
1answer
160 views

What kind of requests are those?

I receive a lot of requests like this: ip-10-80-XXX-XXX.eu-west-1.compute.internal:80 110.249.208.XXX - - [11/Dec/2013:10:27:17 +0000] "GET ...
4
votes
3answers
665 views

Why is this response splitting attack not working?

I'm working through OWASP's "WebGoat" (version 5.4) vulnerable web application, but I'm getting stuck on one of the earliest lessons which is to do with HTTP response splitting. I've looked in all ...
3
votes
2answers
897 views

How can I implement authentication in my proxy server?

I have a proxy server, it will have a captive portal page. Users will be required to sign in before gaining access to the internet. So far I am aware of IP and/or MAC address based authentication. ...
3
votes
3answers
1k views

Is a company website secure against sslstrip if it doesn't use ssl on homepage but ssl everywhere else?

Most ecommerce websites use SSL/TLS when you want to log. But most have homepage using http only. Is it enough to have SSL/TLS on login page and logged page to prevent sslstrip ?