Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP ...

learn more… | top users | synonyms

0
votes
2answers
27 views

Possible to send generated serialkeys using HTTP and get one right?

I have hooked the WS2 library with C++ in a game and found it sends a request to the server using http to check if my serial key is valid. http://warbandmain.taleworlds.com/handlerservers.ashx?type=...
3
votes
3answers
213 views

What purpose does Access-Control-Allow-Origin have?

I have a misunderstanding regarding CORS' Access-Control-Allow-Origin header. It's name says "allow" from which I understand that if I make a request from an "Origin" that is not allowed the request ...
1
vote
0answers
25 views

Tool for HPP testing? [closed]

Is there an automated vulnerability scanner that supports HPP (HTTP Parameter Pollution)? Since all I need is to take a query string and perform basic modifications / add new parameters, I was ...
2
votes
2answers
109 views

What is web application security best practice for HTTP Get request? [duplicate]

If I have web application GET URL which gives me details of particular user. What is more secure / which is good practice? eg. www.xyz.com/user?id=10 or www.xyz.com/user?fname="abc"&lname="...
1
vote
1answer
30 views

Passing a hash of a secret to a server instead of the plain text

Instead of passing an authentication token or api key in an http header to a server in the plain text, what if I calculated its hash and passed the hash? This way even if a adversary intercepts the ...
7
votes
1answer
1k views

Why does Firefox claim that my connection to Google is insecure?

I keep receiving this message whenever I open any site from Google: My Firefox is up-to-date, and so my Windows 8.1. Since I don't know much about HSTS, I don't know what's going on, and obviously, ...
3
votes
1answer
63 views

How does the same-origin-policy protect against PUT/DELETE CSRF?

I've read the OWASP guide for cross-site request forgery and it states that "other HTTP methods", such as PUT and DELETE could be theoretically used for CSRF. However with the same-origin-policy ...
1
vote
1answer
44 views

Computers connecting to suspicious websites via squid proxy

I am running a squid proxy server on my network which my computers connect through to access the internet. I have noticed several odd entries in the squid access.log file around the same time everyday,...
1
vote
3answers
79 views

Safely downloading user submitted content

TL;DR We save the request payload and Content-Type header in a database. It should be JSON or CSV but may be malformed. Support users download the request payload as a file in their browsers using ...
21
votes
2answers
2k views

Why would properly logging full http requests be bad practice?

I'm currently looking at Secure Coding Practices documentation provided by Veracode with their code analysis toolsuite. In a "secure logging practices" section, they mention that logging full HTTP ...
92
votes
4answers
15k views

A secret in a URL

Lately I've seen plenty of APIs designed like this: curl "https://api.somewebsite.com/v1/something&key=YOUR-API-KEY" Isn't it elementary that passing an API key in a query string as a part of ...
-3
votes
2answers
103 views

HTTP: weaknesses analysis & attitude [closed]

Many questions on this topic around here, but didn't find this particular angle Background: Sending any information of value with HTTP and through HTTPS is a bad idea (in the rare case a respected ...
1
vote
0answers
34 views

MAC spoofing under a OPN Access point HTTP does not work

I want to do a demo on the wifi security. So, I have one Wifi router and two client. I configured my router without security (OPN) and with a MAC filter. One of the two client is connected to the ...
0
votes
0answers
20 views

Relative paths in Tomcat

I want to develop a web application that has a public and a restricted area. app/public app/private Public access to the web application is permitted through the app.com domain. There shall be a ...
0
votes
1answer
103 views

How can an attacker eavesdrop on users in public WIFI?

I want know why it's said that public WIFI is not safe for banking transactions or entering password for online accounts etc. I want to imitate an attacker and try to harvest as much information as I ...
31
votes
3answers
3k views

Is HTTPS URL in plain text at first connection? [duplicate]

Let’s say I have never connected to the site example.com. If this site is https and I write https://example.com/supersecretpage will the URL be sent in clear text since it's the first time I connect ...
1
vote
0answers
75 views

Are there strong technical reasons for browsers mandating TLS for http2?

I realise there are similar questions around this topic, however I think this is sufficiently different/focused not to be a duplicate. I hope it doesn't sound like a soapbox piece. HTTP/2 effectively ...
5
votes
2answers
138 views

Server-side man-in-the-middle/eavesdropping: attacks between two servers using unencrypted HTTP

I’m new to security, and I’m wondering how man-in-the-middle and eavesdropping attacks between web servers work, rather than between personal devices and servers. Most questions I see here about man-...
-4
votes
2answers
53 views

How and what is used when information is sent to a hacker's server? [closed]

I'm working in some malware research, my main question is how the victim's data is transfered over the internet, protocol and how? Using HTTP or any other way? As fat as I know the data can be sent ...
1
vote
1answer
142 views

Setting the HTTP header X-Frame-Options DENY for static assets

I am checking the security of my Django application through a security scanner and I wonder if it useful to set the X-Frame-Options DENY header on static assets like CSS, images or JS files? I guess ...
17
votes
1answer
2k views

Why am I receiving HTTP GETs for a domain I don't own?

I am running a Centos7 web server. I noticed a few strange HTTP GET requests like these: 94.185.83.100 - - [29/Feb/2016:23:29:00 +0530] "GET http://testp1.piwo.pila.pl/testproxy.php HTTP/1.1" 404 390 ...
2
votes
1answer
55 views

Getting error in Hydra

I'm trying to test someones website for them and I'm using hydra in cygwin on Windows. When I enter: hydra -L myusers.txt -P mypass.txt website.net http-get-form \ "/wp-login.php:user_login=^USER^&...
0
votes
2answers
128 views

Is the Origin header really useful for securing a WebSocket?

I've been reading some posts about WebSockets security, and a few of them mention to use the Origin header for helping secure the connection. For example this one https://www.christian-schneider.net/...
1
vote
1answer
59 views

Would the CORS specification consider a missing Content-Type header to imply a “simple header”?

RFC 7231, Section 3.1.1.5 states: A sender that generates a message containing a payload body SHOULD generate a Content-Type header field in that message unless the intended media type of the ...
1
vote
2answers
52 views

Started seeing jQuery function calls in URL requests, what is this?

I administer an E-commerce site, and recently I have been seeing odd URL requests containing jQuery function calls. Here are some examples of the requested URLs that are being logged as 302 permanent ...
26
votes
7answers
4k views

Is it possible to modify your user agent http header for malicious use?

The Google crawl bot uses the user agent "Googlebot", and I am wondering if this knowledge can be used maliciously. Let's say in a random website, the Googlebot user agent is allowed to access an ...
0
votes
1answer
22 views

Disabling post-pageload http requests to account for XSS

I have a website where JavaScript is used to process sensitive data (chat messages) on the client side. No communication is done with the server or any other service after the initial page load. It's ...
0
votes
2answers
167 views

Are credentials sent via plain text to HTTP proxy?

If a proxy server requires authentication, and that proxy communicates over HTTP, are the credentials sent over plain text to the proxy server? If this is the case, isn't it possible to sniff the ...
5
votes
1answer
153 views

BREACH attack vs filtered reflected user input

I am in charge of the applicative security of our application and would like to test our exposure to the BREACH attack. Our django-based web application reflects filtered user-input and serves a CSRF ...
66
votes
3answers
7k views

What was the aim of this invalid HTTP request that tells a story about goats in the request URI?

I currently run an Apache HTTP server, and have set up monitoring to receive emails whenever an error appears in the error logs. I get the usual trying to find if I'm using HTTP 1.0 and trying to see ...
1
vote
0answers
40 views

Transmitted sensitive user data

At the moment, I have set up mitmproxy and can record all HTTP/HTTPS communications between the client and server. For research purposes I am looking to find a way to detect potential leakage of ...
5
votes
4answers
292 views

Is information disclosure in a form of a server header is a real vulnerability?

I have seen in many places that people say that headers of the following types is a vulnerability: Server:Microsoft-IIS/7.5 X-AspNet-Version:4.0.30319 X-Powered-By:ASP.NET I can see that this gives ...
5
votes
2answers
623 views

What is the difference between MITMproxy and SSLsplit?

I am aware that MITMproxy only captures HTTP/HTTPS protocols where SSLsplit is a transparent proxy and therefore can capture also other non-HTTP protocol communications. However MITMproxy can operate ...
-1
votes
1answer
91 views

Does the page that links to my login page need to https?

So I realise the login ajax call must be https, and the page that ajax call is made from should also be https to prevent a man in the middle potentially changing the page and changing the form that ...
5
votes
2answers
131 views

Why doesn't the HTTP/2 spec require TLS?

Although no browser implements the full HTTP/2 spec right now limiting themselves to just the TLS part there are stories on the internet that this incomplete implementation of the spec is a way of ...
3
votes
2answers
85 views

Can I trust the Host header received in the request?

The question is very simple: can I trust the value of the Host header? We are developing an application that serves some resources via HTTP and we wan't to have some private services and some ...
0
votes
1answer
129 views

How to prevent hotlinking on binary content served through PHP?

I am trying to secure a byte serving script, written in PHP, mostly taken from http://www.tuxxin.com/php-mp4-streaming/ to protect against linking the video directly and easy downloading. I therefore ...
24
votes
1answer
1k views

HTTP HEAD and its security versus operational uses

Most security advice I see recommends turning off HTTP Methods like TRACE, OPTIONS, HEAD etc. So now I have turned off most of these options on my web server and leaving only GET and POST options that ...
1
vote
1answer
347 views

How to brute force HTTP Basic Authentication requested with XHR?

How can one brute force a website using HTTP Basic authentication using metasploit which uses XHR in background? I am getting error "No URI found that asks for HTTP authentication". Relevant headers ...
5
votes
1answer
72 views

How do I verify that in-app social login dialogs are secure?

If I have a mobile app that supports some kind of social login feature, say, to login to the app from my Facebook account, and if the app opens the Facebook login page inside the app in a mobile, is ...
0
votes
1answer
76 views

Privilege Escalation Mitigation [closed]

What is the best protection against Privilege Escalation vulnerability in web application. Basically I am able to change the HTTP response in JSON format from USER ID to ADMIN ID to get access to the ...
4
votes
4answers
1k views

Password hashing on frontend or backend? [duplicate]

I have a Java Server with Spring Boot and a JS Frontend in AngularJS. My teacher told me to use HTTPS for passwords, because I cannot hash them securely enough, that nobody can hack them. With HTTPS,...
1
vote
1answer
67 views

Forcing response headers

I'm testing a particular vulnerability box since yesterday and I came with one rather strange problem that I didn't expect. Lets say a vulnerable web-application offer image file upload. The image ...
1
vote
1answer
119 views

Unauthorized access to a page - when or if you should return 401 HTTP status code

When a user requests a page that they don't have access to; should you return a 401 HTTP status code and a page to notify the user. In the past I have worked under the idea thats bad practice, as ...
3
votes
3answers
123 views

Large / Over-sizesd HTTP Header Lengths and Security Implications

Wondering if there are any security implications / risks involved with a server returning relatively large (100+) HTTP header lengths?
3
votes
1answer
126 views

How to get a green certificate bar if I'm not a company?

I'm not a company and do not represent one, but I would like to have a green bar on my website for several reasons. One of them, for example, is that I want to ensure that the information displayed in ...
0
votes
0answers
21 views

HTTPS red icon help [duplicate]

I have the the HTTPS red icon on some sites. I see many other comments about this but as a computer amateur I do not understand how to fix this. Can anybody put the answer simply for me?
0
votes
0answers
27 views

What is more secure for Authentication: PostMessage or Redirect

Apple iCloud has the option to either PostMessage or Redirect upon authentication. Which is more secure, and why?
1
vote
2answers
206 views

HTTP login to iframe HTTPS/ MiTM attack

I would like to know if the credentials can be intercepted/MitM attack if the site is using HTTP to HTTPS login iframe. Here are some login details from my Chrome dev tools (Form Data) So I can see ...
3
votes
2answers
53 views

Application level proxy on HTML. Capabilities

I am studying for a network security exam. I found in an old exam the following question and I have no idea of the answer: A company is protecting its intranet by a multi-homed bastion host B, ...