Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP ...

learn more… | top users | synonyms

-1
votes
1answer
58 views

When I visit a site using HTTPS is it exposed to sniffers? [duplicate]

Say for example I visit https://foo.com. Could someone that is sniffing the network determine that I am going there? At what level does the https encrypt the request? I know that data is secured ...
3
votes
1answer
2k views

How to supply HTTP Basic Authentication details in OWASP ZAP proxy?

I am using Basic HTTP Authentication to log into my Web Application. The credentials are Base64 encoded and sent to the Server. OWASP ZAP Proxy is intercepting the request and I can see the ...
1
vote
0answers
26 views

Is there a “smart cache” device which provides cache if authorized?

Is there an implementation of a HTTP (or decoded HTTPS) optimization device which would allow for "smart caching" - i.e. the ability to release some cached content (initially transferred by someone ...
21
votes
3answers
2k views

Is there any reason to block HTTPS?

Within our local education's I.T system, all websites served via HTTPS are blocked, except a select few websites which are 'authorized'. This results in some websites being unable to function ...
6
votes
3answers
752 views

HSTS on sites available over HTTP and HTTPS

I'm wondering if it makes sense to enable HSTS on a site that is served over HTTPS as well as over HTTP. What I mean is to add HSTS-Header if the site is accessed over HTTPS. But there is no ...
19
votes
4answers
2k views

Is a VPN really required with free Wi-Fi on a train?

Our local train service has added free Wi-Fi. I have been checking GMail and logging into a few apps. Then logging into websites using HTTPS. Is this secure, especially if done via app? The network ...
1
vote
4answers
773 views

What is a typical response from webserver for POST request?

My web server is returning a 200 OK after submitting a POST request, but it does not seem to be a good idea according to a security team. It should return a 302 "Object Moved", so that it avoids ...
2
votes
1answer
114 views

Flaw in HTTP Digest Authentication

I am working through my textbook and I came across this question: Below is the message format for a browser response to access a password-protected web page using HTTP digest authentication. GET URI ...
2
votes
1answer
197 views

OAuth 2.0 client side redirect instead of HTTP redirect

I'm implementing an OAuth 2.0 authorisation server using the Authorization Code flow (i.e. users will authorise client apps to connect to our server). The auth server is the same as the resource ...
-1
votes
1answer
99 views

Understanding HTTP response from Linux Server

I am working through a question that involves someone using a vulnerability in a Linux server in order to gain access to it. The first part of the question states In monitoring the network activity ...
6
votes
1answer
2k views

JWT token login and logout

Hi I am creating mobile native application that uses REST API endpoints to communicate with server side. I have had previous experience developing native clients, but I have simple token (random ...
3
votes
2answers
68 views

Does the Content Security Policy header provide a false sense of security if a page is served over unencrypted HTTP?

I have been thinking about how a developer restricted (for whatever reason) to serving an unencrypted site might protect themselves from threats such as overzealous ISPs injecting ads or notifications ...
0
votes
0answers
27 views

Verify which file a request to the server originated from

In order to make my question clear I will give a practical scenario. Lets say I have a server where I allow people to upload a script and allot them part of my drive, the script can make requests to ...
2
votes
2answers
102 views

Can two users share the same Request.UserHostAddress?

I am working on an ASP.NET MVC-5 web application, which is available to public users (no login is required). And I need to prevent the same user from submitting more than 5 "contact us" requests ...
-1
votes
3answers
1k views

Why no support for TCP Sockets in JavaScript [closed]

I know there are now WebSockets, but what is the issue with providing a socket API to allow interacting with existing protocols? I mean, after all, I can use a hidden flash object to do the same ...
2
votes
1answer
161 views

Capturing (1x Only) HTTP POST Request [tcpdump]

Every now and then; I like to fire up tcpdump and just watch the network traffic as the packets flow on by. For example: user@host:~$ sudo tcpdump -Aevvv Will parse & print all local ...
6
votes
1answer
62 views

Relationship between http time response and geo-location

I have a lot of pcap files about traffic generated by malware, this include vast kind of packets like TCP UDP and more important HTTP. Whereas is possible I have the geo-locations related to the IP ...
1
vote
2answers
3k views

Implications of the security model of HTTP cookies on HTTPS connections

I have a feature that would require the user being able to provide the URL for a custom script, store the URL in a cookie, and incorporate the script into subsequent responses. This, of course, ...
2
votes
1answer
136 views

Can cascaded routers protect inner network's machine from attacker from outer network?

Given: Outer Network router A wan ip 209.123.12.11 address 10.10.0.1 machine A address 10.10.0.10 gateway 10.10.0.1 Inner Network router B wan ip 10.10.0.100 address 192.168.10.1 ...
2
votes
1answer
125 views

How does LastPass know that Microsoft.com uses the password for Live.com?

When I visit Microsoft.com, the LastPass dropdown lists my username/password for login.live.com. It does something similar for Playstation.com and several other sites. How does it know? Are these ...
3
votes
1answer
217 views

HTTP Response Splitting in practice

Have you ever seen HTTP Response Splitting in laboratory environment? There are many examples for HTTP Response Splitting vulnerability. I used old PHP and managed to get 2 responses from server ...
2
votes
1answer
327 views

302 redirect and the body on the page (you are redirected to …)

I have page which take URL on query and string and it. Then, you get redirected using 302 to another page, and the response of the page contains HTML code and the redirect header. Like this: ...
2
votes
1answer
167 views

How should I tunnel arbitrary protocol traffic over HTTPS?

I'm posting this question from a moving train! (Ok, maybe that's not so impressive.) This train has an annoying WiFi - it's low-throughput, high-latency, tends to lose packets, and blocks most kinds ...
3
votes
2answers
2k views

HTTPS POST request header versus request body

Is there any security difference between placing sensitive data, such as an API key in a POST request header versus the POST request body assuming the API server is HTTPS-only? While you frequently ...
1
vote
1answer
36 views

Is it secure to have an iPad app run a webDAV server on localhost without authentication?

I have two iPad apps running on the same device. One is hosting a webDAV server on http://localhost:8080 without any authentication (the server is active whilst the app is foregrounded, and for a few ...
1
vote
1answer
98 views

What is the proper setup procedure for SSL Tunnel certificates?

I am a systems integrator using a system designed for bringing HVAC data up to a common interface; this system/software platform is called Niagara AX. The combination of the customer's network setup ...
1
vote
6answers
359 views

Can people know the server I'm connecting to despite being on SSH/HTTPS? [duplicate]

I understand that by connecting securely over SSH or HTTPS, the data that I transfer is cryptographically secure. However, can someone spying on my connection still determine the server I'm sending it ...
-3
votes
2answers
84 views

Which HTTP requests support custom data in URL? [closed]

I am aware that HTTP GET requests are sent to web-server using query-string name/value pair in URL. This means that one is able to pass custom data to web-server. For example ...
2
votes
2answers
101 views

Can 3rd party JavaScript libraries access the http headers of the hosting html page

So, I have website, it uses a cookie stored in the http header of the downloaded html document to maintain the session while the end user is logged on and accessing there 'secure' data. This webpage ...
-2
votes
3answers
77 views

Can a website that uses https be absolutely reliable? [duplicate]

Https websites cover some security requirements and certify the author, but how can we be sure that an author of such an https website is not malicious?
3
votes
1answer
99 views

Logout tied to cookie expiry

I am looking for an event to automatically logout a user from the application. Typically I would do it when an inactive session expires. I was wondering if it is secure to do so using cookies. So here ...
0
votes
5answers
3k views

How to send HTTPrequest anonymously [closed]

I want to send a HTTPrequest to a specific web address, but with different IP address. For example, if a webserver detect IP address, then add it to a database. If another request come from a IP, ...
2
votes
1answer
95 views

Generating shared secret key using existing receivers public key and senders private key

I have the public key of the receiver, and the private key of the sender. I want to generate a new key by using the receivers public key and senders private key (also known as the signing key) to ...
6
votes
1answer
1k views

HTTP Caching Headers: private vs no-cache

We're currently reviewing our set of "no-cache" security headers. Header set Cache-Control "no-cache, no-store, must-revalidate Header set Pragma "no-cache" Header set Expires 0 Besides the ...
2
votes
3answers
357 views

How does Facebook really identify requests?

Today I have discovered something very strange. It seems like Facebook is playing some kind of unfair game for identifying one's online identity. So, here is what I have done: I have a regular ...
3
votes
0answers
56 views

WiFi Fingerprinting RFC2617 Linux Device Cannot Unauthenticate Unless AP Password Changes

There is a Cisco WiFi Access Point in the office that is intended for guests. It is an open network in that you can associate without providing a password with the SSID. It supports RFC2617 and so the ...
12
votes
2answers
2k views

Is sending a string (representing a HTTP message) over SSL the same as sending a HTTPS message?

I want to communicate from an embedded device that only has SSL for encryption with an intranet-server that can receive HTTPS. Will SSL encrypted HTTP string be interpreted as HTTPS? or is there more ...
5
votes
3answers
1k views

How can I defend against malicious GET requests?

My server is getting hit with a variety if requests like the following: Started GET "/key/values" ActionController::RoutingError (No route matches [GET] "/key/values") Started GET "/loaded" ...
11
votes
1answer
796 views

Why can't you steal the synchroniser token to do CSRF? [duplicate]

I'm reading up on CSRF and I came across synchroniser tokens. I don't understand why you can't do a CSRF to get the token to do a real CSRF. Example: bank.com has a form like this at ...
2
votes
1answer
209 views

Encrypting layers of OSI

I was reading that WPA2-PSK encrypts layer 2 of the OSI network model. What is the danger of having this layer in plaintext (I know it can be decrypted very easily from within the network)? Is there a ...
17
votes
6answers
800 views

Securing web applications with only a reverse proxy

In order to secure its public HTTP API (so called REST), my client is asking me to implement a simple HTTP reverse proxy that will verify (OAuth 2.0) access tokens and forward HTTP requests to ...
1
vote
1answer
105 views

How to Develop Waf as Service [closed]

Recently, I've started a my educational project WAF as service. To develop this project as per my view, following things are required: Web Application Firewall is in-line with the web servers; it ...
1
vote
0answers
541 views

'http_login' metasploit module isn't able to Brute Force the target. Any suggestions? [closed]

I'm trying to Brute force the http Basic authentication on the domain pentesteracademylab.appspot.com The complete path is pentesteracademylab.appspot.com/lab/webapp/basicauth I'm using the ...
8
votes
3answers
4k views

Windows: unknown program/service etc. sends HTTP request to download a file; how can I find the origin of that request?

The firewall of my company has detected and blocked a repetitive (every 15 min) HTTP request from a PC, which tries to start a download of a file called ..._chrome_installer.exe(or so) from the host: ...
-3
votes
1answer
103 views

Session hijacking [closed]

I know one way of doing session hijacking 1.copying the session value from the chrome browser and pasting the cookie value to firefox browser Is there any other way of doing session hijacking ? If ...
7
votes
1answer
2k views

What are those http://123.249.24.233/POST_ip_port.php POST requests I get on my server? [closed]

I receive a lot of requests on my Node.js server, which I don't understand. On the picture, there are phpMyAdmin-oriented requests, that I understand as automated testing against phpMyAdmin. But I ...
1
vote
1answer
78 views

How to make sure my HTTP server on Win 7 is secure? [closed]

I'm hosting a HTTP server from home. I'm concerned about security issues since the machine has some personal files in it. I have forwarded data from external IP port 80 to my IP at port 80. The ...
7
votes
2answers
140 views

What are the security benefits to block all http referer header requests for web browser?

I would like to know also if you lose site functionality. Is this a security benefit that is beneficial than compromising functionality (if compromising at all)? What I mean by this is one a ...
3
votes
1answer
264 views

Secure Flag and HSTS in HTTPS Only site

If I had a site only available in HTTPS should I still enable HSTS and Secure Flag?
-1
votes
1answer
220 views

SSL and Fake Domain

I am reading information related to SSL handshake on the Internet. It seems like in the last step the domain name is compared to the domain in the certificate. How exactly is this protecting against ...