Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP ...

learn more… | top users | synonyms

0
votes
0answers
55 views

What to use to encode JSON Web Token?

I'm using JWT to create access tokens for a Sinatra API. My question is, what should I use to sign the token? Right now I'm trying to use the user's password hash, but bcrypt-ruby changes the ...
2
votes
2answers
91 views

Security of HTTP proxies

If POST requests are being made to a website via a browser using an HTTP proxy from sslproxies.org, is it possible to trace the origin of those AJAX requests without having access to the proxy being ...
1
vote
1answer
133 views

FTP over SSL vs HTTPS implemention

Consider two implementations of SSL on a HTTP server and on an FTP server. With the same cipher suites used and the exact same protocols used. Is one more secure than the other. I have heard that it ...
2
votes
1answer
148 views

HTTP Host Header redirect traffic

Recently, I've seen periodic floods of traffic to my web servers with various Host headers that do not belong to us. The traffic appears to come primarily from China and a decent number seem to think ...
2
votes
2answers
182 views

How can I be sure that I'm downloading over SSL?

Maybe I'm asking absolutely dumb question, but I couldn't find the answer yet. I know when I'm sending or getting a data in a browser over https, both server and client (browser) checks each other ...
0
votes
1answer
97 views

How could one defeat Webtrackers

I was just wondering why some pages refuse to load completely while surfing with no-script Plug-in when I don’t allow specific Java scripts. I was wondering if there is some way to hold the tracker ...
0
votes
2answers
229 views

intercepting AJAX request and response using BURP

I would like to intercept an AJAX request using BURP. I have used BURP for web applications testing before. This, however, appears to be a weird case. I am not certain what am I missing here. The ...
2
votes
1answer
107 views

CSRF-protection using authentication token in HTTP header

I'm working on a web application which stores an authentication token in a cookie. The only CSRF-protection is referrer checking. I am considering improving this by moving the authentication token ...
4
votes
2answers
209 views

Long character sequence in first string of HTTP GET request breaks the web service's HTTP response. Buffer overflow?

During my current security audit test I've stumbled on something I can't possibly comprehend. The behavior exhibits signs of a buffer overflow in the target or in some intermidiate service (HTTP ...
0
votes
2answers
58 views

HTTPS in request and HTTP in response [closed]

If I have an API that calls a backend webservice, is it possible to use HTTPS in the request and just HTTP in the response? I have such a question because I want to protect my OAuth token in my ...
6
votes
2answers
879 views

Know of any HTTP tarpits/blackholes to use for redirecting malicious traffic?

So I cleaned up some malicious PHP scripts from a client's site and I've been monitoring for follow up connections to the scripts. Of course, I've found a LOT of IPs requesting the files. Too many ...
1
vote
2answers
43 views

HTTP BA from a different Server [duplicate]

There is a weird situation that I am stuck with regarding HTTP Basic Authentication. Below is a hypothetical situation: Lets say there is a certain domain, say https://myfacebook.com and there is a ...
1
vote
0answers
70 views

HTTP GET Request to a webpage that does not exist [closed]

I am seeing a machine is making a HTTP GET request to webpage (ex: www.sample.com/1.png), proxy devices respond with status code 407 (proxy auth required). But when I checked for the site via ...
0
votes
1answer
46 views

Working of Burp [closed]

I want to know How does burp decides whether the attack has been successful or not. When I send a request through burp the server give http response code as 500, what does this mean Session lost ...
0
votes
2answers
268 views

Scan all possible files on server (Brute force Filenames)

I'm not sure if I'm right here, but I just wanted to know if there is a tool that scans all possible filename combinations on a server and tells you what filenames the server responded to. So it would ...
2
votes
1answer
92 views

Http redirect using Location, but using falsely supplied data from host header

If I have a domain www.mysite.com, and I am making a request to www.mysite.com on port 80 using telnet, but I send a host header with another domain name(www.wrong-domain.com), but the server doesn't ...
4
votes
1answer
90 views

Do concurrent connections to an HTTPS website perform separate SSL handshakes?

I know that most browsers nowadays support around 6 concurrent TCP sessions per hostname, to perform multiple requests at the same time. For sites which utilise SSL, is there a separate handshake ...
0
votes
1answer
224 views

Authentication and security of a REST API

Scenario: I design a REST API where authenticated users can hit the API over TLS. I have to use TLS as the data transmitted over the wire is sensitive. I don't need authorization right now, but I ...
4
votes
2answers
924 views

Data on Malicious WiFi Network

Let's assume that I unwittingly connect to a malicious WiFi network and visit websites. By malicious, I mean the network has been set up for the purpose of stealing data. From what I've read, using ...
1
vote
1answer
861 views

Hydra from Kali Linux + Tamper http post form syntax of the failure login attempt [duplicate]

I had asked this question in the general forum I think it is more adequate to place it here. ...
2
votes
2answers
114 views

How to ensure that a login is really going over http?

So I've been offered the chance to go to a day long security awareness event hosted by some organization. On their site, I noticed the login box in the corner, but the site was delivered on HTTP. ...
-2
votes
2answers
195 views

Google is going to mark all HTTP traffics as insecure in 2015? [closed]

Firstly I would like to mention that I got this news from a blog I have read in last few days. This is only, perhaps, a rumor. If this is true, does this mean that anyone using Google Chrome or apps ...
1
vote
1answer
58 views

Is there a way to mimic http request of a compiled program?

Lets suppose my program makes a http request and uses it response to update some values. Is it possible to somehow mimic the response in order to modify it so the program believes the server responded ...
4
votes
1answer
92 views

Should I be worried about this url request I received on my site?

I was checking the weekend logs of my IIS server and noticed a strange request which was blocked: ...
-4
votes
2answers
209 views

Using my own encryption instead of https in app

I am writing a program that uses a webserver as a backend for communication between different users. Is it okay to use my own encryption (such as ...
4
votes
1answer
387 views

Is HTTPS over UDP secure?

Recently, I notice that while using Google search, I am connecting to Google's server using UDP instead of TCP on both port 80 and port 443. It seems that Google is experimenting with some new ...
-3
votes
1answer
80 views

What is the Impact of TRACE Method? [duplicate]

What attacker will benefit of TRACE Exploitation and What is the Recommendation to fix this issue?
0
votes
2answers
90 views

Safe to use setuid with absolutely no input?

I have a shell script which syncs some files from a remote source and I have a pretty typical HTTP server set-up. There is a user who owns the files served by the HTTP server and a user which runs the ...
4
votes
1answer
95 views

How to find out whether an ISP adds a perma-cookie to my requests?

I am interested in finding out whether my (or any) current ISP (Internet Service Provider) uses a technology known as "perma-cookie" oder "sticky cookie" when I am browsing the internet. This ...
40
votes
4answers
11k views

Is SSL dying? Should I buy SSL certificates for my sites any more?

I'm planning to purchase a SSL certificate for one of my sites when I'm concerned about points made in these articles: WiredTree: The Most Significant Issue With SSL – And How To Solve It ...
2
votes
3answers
167 views

Can a form submission be encrypted even though address bar shows HTTP?

I was going to apply for a Student ID card through ISIC, but noticed that the form where they ask for payment (such as credit card number) details is not available through HTTPS. The URL to their ...
0
votes
1answer
6k views

Mixed content - stylesheet being blocked because of a querystring parameter?

I've just run into a scenario where a stylesheet was being blocked on a secure payment page. The stylesheet was loaded like so: <link href="/CSS/all.min.css?v=2" rel="stylesheet" type="text/css" ...
1
vote
1answer
470 views

Minimal HTTPS SSL client in C [closed]

I want to implement an HTTPS client using pure C. I have implemented an HTTP client, and it works just fine. My question is: I know the HTTPS protocol does some kind of negotiation to announce what ...
0
votes
2answers
200 views

How much does a GET request over HTTPS reveal to an eavesdropper

Correct me if I am wrong, according to HTTP v1.1 a simple CONNECT request initiates a SSL tunnel between the server and a client. its only after the tunnel is created that the complete GET or POST ...
-4
votes
1answer
206 views

How does https check md5, sha-1 and sha-2 fingerprints?

When a https site shows multiple finger prints, i.e.: md5 and sha1, or sha256 and sha1, how does the browser check? is it both just the "strongest" or whatever is convenient? This question arose ...
1
vote
3answers
192 views

{Secure} Telnet connect to a console server from webbrowser

I've got a terminal server set up in a data center that also serves as a console server. This console server only accepts regular telnet requests. To this server are a bunch of routers and switches ...
4
votes
4answers
2k views

Is it possible to force a browser to use http in an ssl enabled (https) website?

I was doing a security research on storing the session id in local storage instead of storing it in cookies. I understand that it is not possible to tag the values in local storage as HttpOnly and so ...
2
votes
2answers
67 views

Best practice to secure an API of unknown structure that can come from end user device or server [closed]

I'm trying to create an API with minimum forced structure. The messages can come from end user device or from a backend server. I'm ok with opening separate API for end user traffic and from servers. ...
3
votes
1answer
607 views

If I connect to VPN through proxy, who can see what?

I try to understand what happens when I use an HTTP(S) proxy in my OpenVPN client configuration. What's the advantage of an HTTPS proxy over plain HTTP? In any case the encryption takes place on the ...
1
vote
1answer
104 views

Maximum number of Requests in HTTP keep alive connection

We are running a network analyzer . And we log info which are in the HTTP request headers and HTTP response code. Because in keep alive connection request may come without responses. I push requests ...
-2
votes
1answer
151 views

HTTP status code for successful login [closed]

I have a web application for testing. It has a login page. For unsuccessful login attempts, the developers have made a custom error page so that the response from the web application shows 200 OK, ...
6
votes
4answers
1k views

How to identify the HTTP methods supported by a web server?

How can I identify the different HTTP methods supported by a web server, like OPTIONS, TRACE, etc.? I have tried the nc command on Linux. But it doesn't work. It doesn't show me the HTTP methods ...
1
vote
2answers
155 views

Force connected devices to use http rather than https

I am very new to MITM attacks and have been faffing around on my home network today.. When sniffing my iPhone trying to connect to some mail accounts I have noticed that it shows a message stating ...
1
vote
2answers
247 views

How to implement password reset functionality without becoming susceptible to cross-domain referer leakage?

I have typically implemented password reset functionality by sending a link that included something like this: http://example.com/pwreset?id=userId&resetToken=superSecretResetToken On my pwreset ...
1
vote
1answer
503 views

advantages of http basic authentication over token-based (e.g. oauth2)?

I am interested in the question if there are any possible advantages to securing a given REST API for web clients and mobile apps with http basic authentication (over https of course) over a ...
4
votes
1answer
1k views

Logging out of Basic HTTP Authentication

As seen on https://stackoverflow.com/questions/233507/how-to-log-out-user-from-web-site-using-basic-authentication, there are some interesting ways of logging out a user from Basic HTTP ...
2
votes
1answer
110 views

Does client certificate do any encryption in https connection? [duplicate]

In Https connection asymmetric encryption (with Server certificate) is used during handshake and to create symmetric keys. Am I right that in this case client certificate does no encryption? The ...
26
votes
3answers
2k views

Is there a way to detect web server in case it's not present in HEADER?

I'm trying to detect what web server a particular website uses. For instance whether it's nginX, Apache, Tomcat and so on. I usually use Live HTTP Headers Firefox add-on. The problem is that sites ...
1
vote
1answer
65 views

Use TOTP to prevent simulating requests

I'm developing an API system which provides functionalities for a game. Currently, we are using HMAC to prevent simulating requests (let's say, prevent hackers from simulating the game) but because we ...
3
votes
1answer
2k views

Am I safe if browsing to /cgi-bin/ returns HTTP 403?

I am wondering whether my server could be vulnerable to ShellShock (or better: was vulnerable). The shell test reveals that I'm vulnerable: $ export evil='() { :;}; echo vulnerable'; bash -c echo; ...