Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP ...

learn more… | top users | synonyms

0
votes
1answer
137 views

HTTPS encryption and internet proxy [closed]

I'm not sure if this is the right place to ask this question. Please tell me, and I'll delete it. I want to modify a Word document hosted on my OneDrive account. I see that it is using a SSL ...
6
votes
3answers
1k views

Why can't we do MiTM attacks when using secure connection

I have this silly question that is bothering me. When not using secure connection (HTTP for example) cookies can be intercepted and used to connect to the site as if we have the id and password. We ...
3
votes
2answers
392 views

Why do we need WTLS?

Please excuse my probably gross misunderstanding of how all this works. I just started reading SSL & TLS Essentials by Stephen Thomas, and in chapter 1 he talks about how TLS is a separate ...
2
votes
2answers
211 views

Is HTTPS as secure or more secure than SSH if both have an IP address whitelist?

I'm wondering whether an HTTPS API endpoint would be as secure as or more secure than SSH. API Endpoint The API endpoint would require HTTPS The API authentication would use a POST'd API key. The ...
0
votes
2answers
52 views

Self signed certificate secure when just client sends sensitive information?

Is it secure to create a self signed certificate when just clients will send sensitive information to the server? After checking out the topic "What are the risks of self signing a certificate for ...
0
votes
0answers
211 views

Testing Basic Authentication with ncrack

I'm conducting some basic pen testing against a page protected with Basic Authentication. I've sucessfully tested with Medusa and Hydra but am struggling to get the syntax correct for ncrack. the ...
2
votes
2answers
129 views

On an “uncritical” site, is there any reason to NOT trust a self-signed certificate?

There are many sites that have self-signed ("untrusted" in Firefox) certificates. I then have the option to trust them or not. If I not trust them I can either leave the site or only visit the site ...
4
votes
3answers
118 views

Preventive security action in Android App

Currently, I'm developing a bank related android app. I would share my knowledge and also maybe you guys are more expert than me so you can add your ideas to the list. Bank is a very special client. ...
2
votes
2answers
336 views

What was the security vulnerability behind Box and Dropbox and what's different now?

Earlier today I received a number of comments saying that my shared links were disabled. I looked around and saw a number of articles explaining what happened, and Dropbox posted an official statement ...
4
votes
4answers
173 views

What risks are introduced by the browser passing the “referer” to the next site visited from a link to another domain?

As of today, I believe every major browser will by default reveal to a third-party site which site I came from, and more specifically, the exact URL I came from. What are the privacy implications of ...
0
votes
1answer
73 views

Sending GET requests to non-servers?

I ran a couple of wireshark runs for my computer and noticed inbound GET requests. Is it legitimate traffic for there to be GET request traffic inbound to my home computer if my home computer isn't a ...
10
votes
3answers
1k views

Is the HTTP TRACE method a security vulnerability?

I saw many posts here on this site dishing out advice on disabling HTTP TRACE method to prevent cross site tracing. I sought to do the same thing. But when I read the Apache documentation, it gives ...
3
votes
1answer
75 views

Can we detect malicious redirections by retrieving the webpage's headers? [closed]

Is it possible to know if there are URL redirections (to malicious websites) by retrieving the HTTP request and response headers of the legitimate website ?
4
votes
2answers
945 views

Securing remotely accessible IP cameras that do not support HTTPS

I have some IP cameras set up on my home network, which is WPA2 protected. These cameras are setup to be accessible from the Internet thru my router's DDNS address, and port number. So for example, ...
-2
votes
2answers
127 views

How to avoid session sharing inside the same network

I was thinking about a situation to avoid session sharing or hijacking, validating the IP the user logged in against the ip that is accessing any page after log in. It was working until I figured it's ...
0
votes
1answer
97 views

Do I need an SSL Certificate for a HTTP only site?

The cert for our public facing site is about to expire soon. Our site is entirely http. The site runs on SharePoint, and with SharePoint working with NTLM, the credentials that are passed over the ...
0
votes
0answers
79 views

Will http only cookie work while using chrome bandwidth saving feature in Android?

I am developing a site which uses http only cookies for authentication. By design[w3 standard] these cookies are XMLHttpObjects and will only be submitted to the domain they originated from to prevent ...
1
vote
1answer
80 views

How do you identify a website's form-type?

How do you know which attack method to use when using software like thc hydra, brutus, etc? e.g. http-get, https-get, http-form-get, http-form-post, etc? For example, for sites like Yahoo, Gmail, and ...
1
vote
2answers
115 views

How to prevent attacks before HSTS is established for the first time? [closed]

What is the best way to accomplish this and prevent attacks like SSL Strip?
0
votes
1answer
121 views

HTTP Status Codes - security considerations [duplicate]

I am designing an authorization framework and now I am thinking about the error codes which I should return when someone is trying to access a resource and he doesn't have the required permissions. ...
0
votes
2answers
380 views

Why don't more websites implement Perfect Forward Secrecy?

From what I understand, all it takes to enable PFS on a webserver is adding ephemeral cipher suites (ones that use DHE and ECDHE for the key exchange) to the list of cipher suites used in SSL/TLS ...
2
votes
2answers
123 views

How to prevent popping up a login dialogue using a malicious hotlinked image and HTTP Basic Auth header?

While using Firefox to browse my forums, I noticed that a malicious user posted an image (via hotlinking, not by uploading to my server) with the extension .png which complies with the forum rules ...
-1
votes
1answer
54 views

Detect xss from httprequest and response

I scanned my site using a tool that detects xss vulnerabilities. As a result, the tool generates a report that contains httprequest and response of vulnerable pages. Now my question is how this ...
1
vote
2answers
135 views

How Web-proxy and Virtual-Hosting are complications for HTTPS?

While studying HTTPS and related transport layer security protocols(SSL/TLS), I came to know that HTTPS suffers from two complications - Web-Proxy and Virtual-Hosting. I can understand how ...
2
votes
3answers
343 views

Does http support encryption without https (like STARTTLS)?

Does http support encryption without https, akin to STARTTLS in smtp? This may sound like a stupid question, but just think about it. Banks require strong encryption, and cannot do business without ...
0
votes
3answers
156 views

HTTP/HTTPS on the same site

Suppose a site allows connection to be established with HTTP or HTTPS .If you establish a connection to http://www.example.com or https://www.example.com then all further link's on the page displayed ...
3
votes
5answers
281 views

Free SSL Certificate when encryption is needed and not trust?

My understanding is that SSL certificates are expensive because you are paying a 3rd party to vouch for your identity, and apparently the most secure form of trust is the trust you have to pay for. ...
3
votes
3answers
195 views

If an attacker has the ability to modify data transferred over an Internet connection, can he or she affect TLS?

Now that Google, Twitter, and some other sites require a TLS connection to access their sites, when you go to http://www.twitter.com it redirects to https://www.twitter.com/. If an attacker had access ...
2
votes
4answers
247 views

Why aren't we all compromised on the internet?

Well, I've been thinking about this for a while now. Within the last decade, we've used various ways to make our websites look dynamic and live. For example, in JavaScript, it's quite easy to send ...
1
vote
3answers
149 views

Https forms on tens of domains

What is the optimal way (cost-wise, too) to secure page forms (https) on a large number of domains&subdomains? Are certificates required for all domains? Is putting all the page forms on a single ...
2
votes
3answers
165 views

Is it secure for a site to serve the login page with HTTP, but have the actual site in HTTPS? [duplicate]

On some websites, the login page (where you enter your login details) is served by a regular HTTP connection with no encryption. However, once I login, the page immediately switches to a secure HTTPS ...
1
vote
1answer
105 views

Suspicious http requests in my logs: *.html/RS=^

I see some strange (suspicious?) http requests in my webserver. Example: 192.161.x.x - - [14/Mar/2014:21:55:36 -0300] "GET /ce/c02i.html/RS=^ADAD3F3nOTvuESWLtAiP39aTQZiSRQ- HTTP/1.0" 404 881 ...
0
votes
1answer
176 views

CAPTCHA Bypassing with Captcha Clipping Attack is Like MiTM between servers, Is that even Possible?

Sorry if this is a very amateur question. I was checking out some article regarding CAPTCHA bypassing. And I though this article seemed interesting ...
33
votes
5answers
4k views

Why do some websites enforce lack of SSL?

When trying to visit https://www.ebay.com, I noticed that I get redirected to HTTP immediately. Here's what cURL says about that: $ curl --max-redirs 0 -v -L https://www.ebay.com * Rebuilt URL to: ...
2
votes
1answer
61 views

Danger of having my website make arbitrary web requests

I'm setting up a small code-hosting web site, in the vein of github or bitbucket. I would like to allow users to specify an arbitrary URL from which my site's server will initially clone their ...
8
votes
1answer
155 views

How to force “expensive calculation” when clients connect to my server?

Page 183 of Secrets & Lies on countering denial-of-service attacks: Some researchers have proposed defenses that force the client to perform an expensive calculation to make a connection. ...
0
votes
1answer
357 views

Should Access-Control-Allow-Origin need to be domain specific

Infosec has recommended us to use this header : Access-Control-Allow-Origin:http://domainA.mycompany.com,http://*.mycompany.com But I also own domain : http://domainB.mycompany.com So, if i just ...
1
vote
1answer
142 views

Legitimate use case of man-in-the-middle attack for DPI?

I am working on a device that should sit between the end-user and the server, and that will do deep packet inspection. It is basically a parental control node. This device will be sold to the user, so ...
1
vote
1answer
63 views

Can I reliably identify Apple devices that have not patched against the gotofail vulnerability based on user agent string?

The title pretty much says it. Do the security patches to address the gotofail security issue in multiple Apple products employing SSL change the User Agent string for the respective systems? And, of ...
0
votes
2answers
395 views

Is SSL a mitigating factor for HTTPonly not set on cookies?

I have a few sites that are using HTTPS (no mixed mode HTTPS/HTTP). The cookies do not have a HTTPOnly flag set. They do pass along session IDs. Also some of the sites do not have a "Secure"flag set ...
0
votes
1answer
41 views

How could a comments plugin be securely loaded from domains people are already logged into?

The fundamental idea is to load a blog comments plugin (like Disqus) from a domain someone is already logged into to save users time and increase engagement. I like the facebook comments plugin ...
1
vote
3answers
1k views

NGINX Hacking Attempt

Every time I start my test-server and let it run for some days I get this in my log-files (in different variations): 111.241.26.165 - - [18/Feb/2014:22:16:45 +0100] "\x04\x01\x00\x19\xCBER!\x00" 400 ...
0
votes
1answer
192 views

Can closing port 80 lead to more security?

If a website is running on HTTPS only, is it reasonable to close port 80 of the web server and only leave port 443 open? Does this action provide more security for the website?
2
votes
1answer
2k views

Authenticating Users from Android with PHP Webservice

I'm creating a simple Android application which requires reading and writing values to the cloud. I intent to use PHP for the webservice. But I'm a little confused over the authentication scheme. I ...
1
vote
0answers
134 views

Is my approach to anonymous certificate based HTTP(s) authentication and secure private messaging sound?

I'm trying to work out a somewhat anonymous secure messaging system, and was hoping someone could validate my overall approach. Keep in mind, this all takes place over HTTPS. Authentication While ...
1
vote
1answer
97 views

HTTP security headers on non HTML (images, JavaScript, etc)

Let's say, the HTTP security headers below are applied to all HTML pages of a site: HTTP Strict Transport Security (HSTS) X-Frame-Options (XFO) X-XSS-Protection X-Content-Type-Options Is it OK to ...
1
vote
2answers
1k views

POST over HTTPS “secure enough” for sensitive data?

I'm wondering if to prevent the possibility of a compromised SSL certificate leading to the potential for sensitive information disclosure if it might be prudent to further encrypt data being passed ...
-1
votes
4answers
423 views

Secure communication between server and client [duplicate]

I'm writing some security software, and don't want anyone to be able to intercept data as its passed from client->server, and server->client. The best way to do this is over HTTPS via SSL. However, ...
1
vote
1answer
92 views

Is it dangerous to sync my data with my personal server through unencrypted http?

Since Apple force iPhone users to use iCloud to sync contacts & calendar, I moved to a local ownCloud instance that works well. However, it would be more convenient if I could sync everywhere and ...
1
vote
2answers
549 views

Actually, isn't it bad to redirect http to https? [duplicate]

I have a two-part question about question #570288 over on ServerFault. Question: Is it bad to redirect http to https? Accepted answer (185 up-votes): [...] Hell no. It's very good. Part 1 ...