Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP ...

learn more… | top users | synonyms

1
vote
3answers
142 views

Are Modern Servers susceptible to HTTP Splitting Attacks

Note: I know how HTTP Splitting works. Note 2: I am not working in WebGoat. I am trying to make this on my own. I am trying to imitate the HTTP Splitting attack on my machine. For that I wrote this ...
2
votes
3answers
326 views

Does HTTPS encryption work when there is invalid or there is no certificate?

When I have a website run on https and there is no certificate, there is wrong certificate or out of date like here does encryption still work or not?
4
votes
1answer
619 views

Is every hash format that nginx accepts for HTTP Basic Auth weak against brute force?

According to http://nginx.org/en/docs/http/ngx_http_auth_basic_module.html nginx can read password hashes of these types: crypt(), apr1, SHA1 & SSHA. This is how I understand how these hashes ...
3
votes
1answer
171 views

What kind of requests are those?

I receive a lot of requests like this: ip-10-80-XXX-XXX.eu-west-1.compute.internal:80 110.249.208.XXX - - [11/Dec/2013:10:27:17 +0000] "GET ...
0
votes
3answers
2k views

How can I control the content of the HTTP HOST header in requests issued from my website?

Is anyone familiar with a way in which I can post a link on my website, that when accessed will cause users to issue an HTTP request to a 3rd party site with custom content in the HOST header ...
2
votes
1answer
353 views

What method for CSRF token generation should I use in my scenario?

I'm working on a RESTful API to work with my AngularJS application. Authenticating works by generating an ASP.NET FormsAuthenticationTicket. It is stored in a cookie using ...
1
vote
2answers
262 views

Why is my Mac trying to connect to an http://akamai.com server

I am running a properly configured pf_config ( at least, sort of properly configured ) and have wiped my hard drive clean 3 times with a fresh install of OSX Maverick. I find it odd that my laptop ...
0
votes
1answer
87 views

Service TO Service Authentication & authorization [duplicate]

I have two web services A and B the requests between those services is http. I want so establish a secure connection between service A and service B to ensure the authorized and authenticate request ...
1
vote
2answers
436 views

Token based authentication under http

I am doing a token based authentication but facing some security problems. In the system, a user will login as follows: Type username and password to login in a https login page If the login is ...
2
votes
1answer
493 views

Access-Control-Allow-Origin header spoofing?

Is it possible for a attacker to spoof the Access-Control-Allow-Origin header? Or, is it secure enough to protect resource access via the Access-Control-Allow-Origin header? I'm trying to make an ...
16
votes
6answers
2k views

Is it a good practice to show 403 unauthorized access error to user?

Whenever we see a 403 forbidden access error page we think we have got to a place where some secret or private data is present. Now at this point bad guys know that this might be of interest and start ...
1
vote
1answer
4k views

Speaking Plain HTTP over an SSL enabled Server port [closed]

atm I'm facing a problem with IE and Firefox because they don't redirect my Links correctly. I'm requesting my application via: https://myapp.example.de/context In my webapplication I have links ...
2
votes
3answers
150 views

Website Authenticity/Verification without SSL

Are there any other ways of verifying the web server you're visiting is actually the correct one? For example, if a domain name's DNS was hypothetically hijacked, and users were directed to a phishing ...
0
votes
4answers
928 views

How can I test that I have correctly disabled unnecessary HTTP methods?

I am making a web-based application and I disabled some of the HTTP methods which are not necessary for the website (specifically, OPTIONS, HEAD and TRACE). I put this in the httpd.conf of my xampp ...
3
votes
1answer
136 views

What does Django's ALLOWED_HOSTS variable actually do?

I'm supposed to set ALLOWED_HOSTS in my Django project's configuration to the hostnames that belong to me to ... prevent an attacker from poisoning caches and password reset emails with links to ...
10
votes
2answers
642 views

Why are we still using HTTP? [duplicate]

I've been reading a lot of online articles and blogs about advantages of using HTTPS (HTTP over SSL/TLS) and the performance issues involved in deploying a website over HTTPS. What I understood is ...
1
vote
1answer
179 views

How to check whether a link is safe or not? [closed]

I've been working on a task to find threats in a social network called Skyrock. For which, I've managed to retrieve a significant amount of URLs by crawling various user profiles and parsing the data ...
2
votes
1answer
162 views

Is it important to keep my pastebin developer key private?

I would like for my application to enable users to save their programs to Pastebin through the Pastebin api. This requires a developer key, which is automatically created with each account. Keeping ...
0
votes
1answer
238 views

What is the attacker trying to do? (maybe just spam my form) [closed]

I have a PHP-included form that tells me the URL the customer was visiting when they fill it out. The content of the message was either jibberish or poorly handled by the form. (it looked mostly like ...
17
votes
5answers
2k views

Security of an initial redirection from http://example.com to https://example.com

Suppose that http://example.com/<foo> systematically redirects to https://example.com/<foo>. I enter http://example.com in my browser's URL bar, and I see a page load and the URL bar now ...
9
votes
3answers
337 views

Finding out what headers are visible

I would like to find an easy way to find out what headers are visible on my websites. For example PHP version, server etc. I've looked around and can't seem to find a good explanation on the subject ...
3
votes
3answers
555 views

What stops a hacker from installing it's own CA certificate?

Taking a look at this (now rather old) article about the generated rogue DigiNotar certificates, it states the following: ...Such is the case with that small company in the Netherlands, ...
2
votes
2answers
118 views

How to create an anti-flood mechanism without leaving VPN's out?

I'm trying to protect my applications from some bots that are either malfunctioning or trying to take my sites down (lots of requests from the same IPs in the logs). Every time someone requests an ...
14
votes
2answers
29k views

Why is the Access-Control-Allow-Origin header necessary?

I understand the purpose of the Access-Control-Allow-Credentials header, but can't see what problem the Access-Control-Allow-Origin header solves. More precisely, it's easy to see how, if ...
15
votes
2answers
697 views

Twitter's HTTP response vs Google's HTTP response

I was looking at the HTTP responses form https://twitter.com and https://encrypted.google.com. These two responses have interesting similarities and differences in their security definitions. Both ...
1
vote
2answers
206 views

How to defeat CRIME, BREACH, TIME etc… server side (without sacrificing compression)

I am writing full-stack server side software and I have been researching CRIME attacks and it's relation to SPDY header compression as I am implementing the server side codecs for it at the moment. ...
1
vote
2answers
95 views

non-MiTM Reverse SSL

Do non-MiTM Reverse SSL Proxies exist? Or do all proxies that do SSL-SSL mappings decode and then re-encode HTTPS traffic? If this is the case and I want to map https://mypublicdomain.com -> ...
3
votes
2answers
543 views

Is there a problem with issuing a HSTS header in PHP?

I want to trial a HSTS policy on my blog without enabling it site wide initially. As a HSTS policy is just a HTTP response header would there be any problem with sending the header in PHP like so: ...
1
vote
3answers
242 views

What information can be seen from HTTPS to HTTP?

Assuming a secured page https://google.com/redirect.php?keyword=apple which redirects the visitor to a non-secured website http://apple.com, would an eavesdropper (anyone watching over the network) be ...
1
vote
0answers
2k views

Linux Hydra issue - random correct password success

I have an issue with Hydra when i use it. First let me inform that, i read multible guides, tries the excact same command lines as in guides directly supported by the Damn Vulnerable Web Application ...
1
vote
2answers
108 views

Using HTTPS GET from app to server

When developing Webpages, they say you should use POST for "destructive" actions, and GET for actions that only retrieve information. Is the same true for apps? Is it a total no-no to use GET for ...
0
votes
1answer
290 views

What mechanism to use for simple and secure HTTP API access?

I am currently working on a service which offers a HTTP API for mobile clients. I want clients to authenticate in order to access my API. The server itself is doing the authentication there will be ...
1
vote
1answer
755 views

Extremely big HTTP chunk size

I am working in a project which we must count HTTP response size. I am getting chunk size like: crlf = g_strstr_len(chunkeddata , responceSize - responceHeaderSize, "\r\n") And than I had a ...
0
votes
1answer
90 views

Is there any reason to allow Python fetches of my Web server's pages?

I keep seeing "python-requests/1.1.0 CPython/2.7.4 Linux/3.8.0-19-generic" requests e.g. from Amazon's servers of my website. It's kind of creepy. Who would set up an Amazon server to scan websites? ...
1
vote
1answer
435 views

Why is Access-Control-Allow-Origin required for uncredentialed cross-domain requests?

I understand CSRF and why cross-domain AJAX requests with cookies or other credentials can't be permitted without an Access-Control-Allow-Credentials header explicitly permitting them - otherwise I'd ...
0
votes
1answer
186 views

Are there any risk in serving static assets via compressed SSL protocol from 3rd party domain?

e.g. curl -v -H 'Accept-Encoding: gzip' 'https://cdnjs.cloudflare.com/ajax/libs/Colors.js/1.2.2/colors.min.js' As you can see, result is gzipped. My assumption is since they are serving from 3rd ...
4
votes
4answers
1k views

Is a cookie safer than a simple HTTP header?

I was recently told that a cookie is "safer" than a regular old HTTP header, which is safer than a URL parameter, particularly when passing around access tokens. What is the reasoning behind a cookie ...
25
votes
4answers
6k views

BREACH - a new attack against HTTP. What can be done?

Following on from CRIME, now we have BREACH to be presented at Black Hat in Las Vegas Thursday (today). From the linked article, it suggests that this attack against compression will not be as simple ...
7
votes
3answers
749 views

Is this GET request an exploit attempt?

I've noticed a few requests like this to a Rails application I am maintaining: GET ...
4
votes
3answers
709 views

Why is this response splitting attack not working?

I'm working through OWASP's "WebGoat" (version 5.4) vulnerable web application, but I'm getting stuck on one of the earliest lessons which is to do with HTTP response splitting. I've looked in all ...
2
votes
3answers
867 views

Odd “duplicate” HTTP requests

An unexpected duplicate HTTP GET operation triggered an "unusual event" report on my web site. The duplicate came from the web site of "Trendmicro.com" who seem to be in the internet security ...
1
vote
1answer
2k views

In which ways could a javascript making a cross domain HEAD request be a threat?

I was just reading this answer to the question Why is the same origin policy so important? Basically, when you try to make an XMLHttpRequest to a different domain, the browser will do one of two ...
1
vote
2answers
126 views

Question about authentication cookies? [duplicate]

Say, I have a website where users are required to login to access certain functionality. Once they are logged in, they are issued an authentication cookie. Some of the pages on the authenticated ...
5
votes
3answers
623 views

Are 500 responses or specific error codes more secure for REST services?

I am building a REST API to store security sensitive data for both my client and third-party partners. Each request is validated using an HMAC of certain data which is keyed on a temporary key ...
3
votes
2answers
1k views

Exploiting HTTP content in HTTPS page [closed]

I recall hearing there is a range of attacks one can mount against a page which mixes HTTP and HTTPS loaded content (say, https://Secure-Site.com loading an image from http://Not-A-Secure-Site.com) ...
18
votes
8answers
2k views

Should a site have SSL if it doesn't have a login form?

We have a site at work that is used for the following: Our homepage, which is just some info and contact info. Job applications are also handled on our site. There is no place where you can login ...
9
votes
5answers
3k views

SSL/TLS - Distinction between self-signed cert and self-signed CA, and other questions?

I have a small personal website which I wish to serve securely over HTTPS. At the moment I do not wish to use a third party CA to sign my certs. I was reading this document on generating a self-signed ...
-2
votes
1answer
641 views

Are GET parameters secure over https? [duplicate]

Since GET parameters are passed in the url, how can they be secure from someone with access to network logs. He would be able to see what urls are accessed, even if he cannot see the request and ...
0
votes
4answers
5k views

How is HTTP PUT and DELETE methods insecure, if they really are? [duplicate]

If I really need to use these methods, how do i make sure they are secure? Edit: Is there a link or source where I can see how to make sure that 'PUT' and 'DELETE' methods are not able to delete or ...
1
vote
3answers
176 views

How can someone access data that I am requesting when I use HTTP?

I have heard that HTTP use plain text communication. If it is so how can a hacker or someone tap it. From my little knowledge I know that if we sent a request to a web server it replies back to us ...