Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP ...
1
vote
2answers
255 views
Does vulnerability exist when using XHR with GET method and custom anti-CSRF HTTP header?
Imagine button after clicking which browser sends XHR http request with GET method. Characteristics:
after executing request sensitive action is performed
sensitive information is sent in GET ...
1
vote
3answers
593 views
Is scanning a site directory considered illegal penetration testing?
Does anyone know if using Dirbuster [link] to scan for unlisted directories and their contents is (possibly) legal in say the US?
4
votes
3answers
293 views
Is there a security risk in existence of those HTTP headers in responses?
The following HTTP headers can be seen in responses on some sites:
Age: 12
Content-MD5: Q2hlY2sgSW50ZWdyaXR5IQ==
Via: 1.1 tacoma:3128 (squid/2.7.STABLE9)
X-Cache: MISS from tacoma
X-Cache-Lookup: ...
2
votes
3answers
369 views
Session fixation attack
Given the following conditions,
Session ID does not change upon login
Session ID travels in form of HTTP cookie
There is no cross site scripting/redirection vulnerability on the login page
is it ...
4
votes
3answers
2k views
Can I trust the source IP of an HTTP request?
As far as I've understood, if you try to issue a HTTP request with a spoofed IP address, then the TCP handshake fails, so it's not possible to complete the HTTP request, because the SYN/ACK from the ...
5
votes
4answers
798 views
weird visitors to my website
For the last three months I have thousands of real visitors to a single page on my website. Those visits are recorded in Google Analytics and count as page views in adsense reports, but they are fake:
...
1
vote
1answer
170 views
How to determine whether the redirect link is secure or not?
I am checking about the security of redirect link, For the below link , how to determine whether it is secure?
For the first link, the users are not allowed to change the url in the browser, but they ...
10
votes
1answer
2k views
My understanding of how HTTPS works (gmail for example)
I want to ask if my below understanding is correct or not regarding the HTTPS used for the webpage we are visiting.
I will use Gmail as an example:
My laptop tries to connect to the Gmail server ...
0
votes
1answer
121 views
Securing communication
The problem:
I have an open-source client (a Firefox add-on written in JavaScript) and a server containing somewhat sensible user information: username and user history (all from YouTube). The client ...
2
votes
2answers
306 views
Is DIGEST-MD5 secure if done over HTTPS?
If the DIGEST-MD5 negotiation is done over an HTTPS connection instead of HTTP, does that prevent this list of disadvantages from Wikipedia?:
Digest access authentication is intended as a security ...
0
votes
1answer
252 views
Reply to SSL Handshake Request with a 302 Response
Is it possible to respond to an SSL Handshake request by sending back a http 302 redirect without making the browser mad?
I would like to immediately redirect to a different site upon receiving the ...
2
votes
2answers
337 views
What if a browser does not understand the secure flag of cookie
I have two questions related to the same:
1 - As 'Httponly' attribute is understood by a set of modern browsers (https://www.owasp.org/index.php/HttpOnly#Browsers_Supporting_HttpOnly), I was ...
2
votes
2answers
419 views
Reveal the True IP of a User
Is there any best practice method (and preferably documented) way of revealing the True IP of a user using a HTTP(S) connection?
I.e.: To be able to uncover the true IP from transparent as well as ...
10
votes
2answers
687 views
What is the point of the same-domain rule for xmlhttprequest when script tags/JSONP can cross domains?
I get that I don't want a page loaded from stackoverflow.com to be able to request gmail.com on my behalf and read my email--but this seems to be simply a cookie issue.
Since JSONP bypasses ...
11
votes
3answers
1k views
How can I prevent tracking by ETAGs?
An ETAG is a HTTP header that is sent-behind-the-scenes between a web browser and an web server. This value is intended to control how long a particular file is cached on the client side.
There is ...
3
votes
1answer
1k views
cookie path protection within same domain
The answer to this question about how cookies are potentially vulnerable between sub-domains sparked my curiosity.
As far as I know, if a cookie is set on a sub-path of the same domain ...
0
votes
0answers
244 views
Connection Keep Alive misunderstanding? [closed]
Ive heard that keep alive is keeping the Server's port open by Client IP+ Port.
first of all , is it true ?
If yes , Whats happens when
Me and my friend are on Intranet organization and we both ...
2
votes
5answers
657 views
What are practical risks of http (not https) in server-to-server communications
What are some of the practical risks that come with a server-to-server connection over http (not secured with https/SSL)? There are no users involved, just a B2B connection from one company to ...
3
votes
1answer
209 views
Could somebody explain connect loop DoS?
I'm trying to understand this vulnerability.
How can I reproduce this?
1
vote
2answers
226 views
http blocked over very low ports in Opera web browser
Opera blocks the user from making http requests over very low ports (below 1024). Why does Opera not allow the user to override this setting?
What is wrong with running a web server on, say, port ...
5
votes
1answer
476 views
Is it possible to have stateless server nonces in HTTP Digest
When implementing a HTTP Digest server, there's the issue of nonces.
Server nonces (as opposed to client nonces)
must be issued by the server
may be re-used by clients as long as the server allows ...
5
votes
2answers
3k views
How to thwart sslstrip attack?
I need help understanding the dynamics of an sslstrip attack. I'm using it to test the security of a site that I own. I can successfully sniff the victim (in this case, myself) credentials over the ...
2
votes
2answers
244 views
HTTP + HTTPS + One Time Pad/stream cipher
I'm designing a web application where users will exchange short messages with the server very frequently (for instance, a few characters every second). I want the whole communication to be ...
6
votes
1answer
584 views
ASP.NET HTTP Response Splitting Attack
By default ASP.NET checks for HTTP Response Splitting attack when you do Response.Redirect:
...
3
votes
3answers
564 views
How to roll my own security mechanism - avoid SSL
i'm looking at implementing my own security mechanism rather than using ssl due to ssl being 'hopelessly broken' http://www.theregister.co.uk/2011/04/11/state_of_ssl_analysis/ and also because it is ...
2
votes
3answers
657 views
HTTPS Apache2 Information Leakage
Hello IT Security!
I have Apache2 vhost with HTTPS listening on port 443, ie. https:// securesecret.com.
I have another vhosts with HTTP listening on port 80, ie. http:// one.com, http:// two.com.
...
2
votes
2answers
717 views
Secure SSL Session from losing itself into unsecure http
I've seen some implementations of HTTPS SSL and, as a visitor, forced to rely to a lot of those. What would a secure implementation look like and where can one expect problems? I expect the installer ...
4
votes
4answers
2k views
Benefits of identifying clients based upon the “X-Forwarded-For” or similar HTTP header in addition to Client IP
The X-Forwarded-For header is used by some HTTP proxies to identify the IP address of the client. The wiki page (linked above) mentions that ISPs may use this header as well.
In addition there are a ...
1
vote
3answers
3k views
Facebook login on HTTP? [duplicate]
Possible Duplicate:
Is the Facebook login form using SSL without https in the URL?
If you access http://www.facebook.com/, in the top right side there is the login section. You can enter ...
2
votes
7answers
365 views
How can http data be compromised on a secure network?
I understand that it is bad to send passwords in plain text over the wire because somebody can look at it and clearly steal your information, and that the solution is to use HTTPS because the ...
7
votes
5answers
776 views
Websites that interactively test browser security (XSS, CSRF, Javascript, etc)
I'm looking for a comprehensive list of browser test sites so that I can visually prove that the browser is patched and configured for safe web browsing. My intent is to know what risks may exist ...
6
votes
1answer
382 views
Inconsistencies found in OpenID Provider's HTTP Headers. Which one is the most secure that I should imitate in my STS, and Relying Party?
I'm comparing the HTTP headers of the various providers (LiveID, Google, Yahoo, etc) and notice a broad inconsistency in implementation on the sign in page, sign out page, and subsequent pages.
...
6
votes
7answers
530 views
Should I prevent sending of GET requests for urls that are normally operated with POST request?
There is an url that is normally operated using POST requests (i.e. POST request is sent when user submits form). But attacker can form GET request with parameters that are sent in POST request. This ...
2
votes
2answers
304 views
When is an intermediate page needed before directing a user off my primary website? What is the best implementation?
The NSA has a page that intercepts redirections off the primary site. (click "TLS: "Suite B Cipher Suites for TLS," RFC 5430" for an example).
I've seen this used in Exchange Outlook Web Access ...
14
votes
1answer
935 views
Does the practice of blocking an off-site “Referer:” HTTP requests improve website security?
Is there any benefit for a security-paranoid website to disallow HTTP requests that have a Referer: from 3rd party sites?
The pitch is that if such a HTTP request were to come in, then certain XSS ...
7
votes
2answers
444 views
When are HTTP session cookies at risk over Wi-Fi?
If I'm using websites that do not use HTTPS, but I'm on a WEP-protected Wi-Fi network, are my cookies safe from being sniffed by third-parties?
Are cookies only at risk during login, or am I at risk ...
8
votes
9answers
340 views
What is the proper way to view the sourcecode of a website?
I recently heard that Firefox makes a second HTTP request when the sourcecode is requested. Is this true?
Does this mean the webserver may issue alternate source from the original?
Lastly, is ...
3
votes
1answer
294 views
Should I include a random padding in every HTTPS request and response?
According to the following paper, it is possible to decrypt HTTPS traffic by inspecting AJAX calls and using the size parameter as a cryptographic oracle.
Should I be sending a variable length ...
5
votes
4answers
3k views
How do the processes for digital certificates, signatures and ssl work?
I have been trying to understand how ssl works. Instead of Alice and Bob, lets consider client and server communication.
Server has a digital certificate acquired from a CA. It also has public and ...
9
votes
2answers
2k views
Are there any statistics about webservers and browsers TLS support?
From Hackers break SSL encryption used by millions of sites:
The vulnerability resides in versions 1.0 and earlier of TLS, or transport layer security, the successor to the secure sockets layer ...
2
votes
2answers
618 views
SSL verification of host name of https server
I recently found that a library I am using (specifically Apache HTTPClient) when is configured to verify the hostname of the remote server against the certificate's CN it just seems to be doing a ...
-3
votes
2answers
380 views
Web service that converts HTTP GET to POST?
Is there some online forwarding service that I can give HTTP GET parameters to, and it would create a form with the parameters and submit it as POST?
For example, I'd like to give someone the URL:
...
6
votes
1answer
343 views
Strict Transport Security — max_age value
I've been wondering what max-age should the HTTP Strict Transport Security header have.
Both paypal and lastpass sites leave it very low: 500 (seconds = bit over 8 minutes)
market.android.com has it ...
16
votes
2answers
1k views
Which HTTP status codes are interesting from a security point of view?
I'm looking to extract interesting information from webserver logs and I wonder which HTTP status codes should I filter out?
For example, 200 hits can be considered to be 'regular behavior' whereas ...
5
votes
2answers
972 views
Can I block the true IP address using X-Forwarded-For header in IIS?
All the traffic gets to the IIS server through a proxy, I cant block or white list IPs, because all the traffic comes from the proxy's IP, Can I use the X-Forwarded-For header with IIS?
-1
votes
1answer
588 views
login with a password in clear text
Suppose that i do a login to a website.
When i type my personal data, aka, password and email, the password is sent in clear text to the server, correct? Then, a network card in promiscuous mode can ...
2
votes
1answer
466 views
Is it possible to secure a web app without HTTPS? [duplicate]
Possible Duplicate:
Can you secure a web app from FireSheep without using SSL?
Think of a typical web application where the users log in, and then the session is kept with a session key. Is ...
23
votes
5answers
1k views
Why is HTTPS not the default protocol?
Why is HTTP still commonly used, instead what I would believe much more secure HTTPS?
-1
votes
2answers
802 views
Strange 400 requests in webserver nginx logs(possible exploit scan?)
It's one of the logged by nginx webserver requests:
‹\x11Г»=џ&gьµЈБЈx¬ёђАЙхPЙuN0жЫ¶@Oc[ќЮmћC”Ь™\x04»c/‹\x1F
or
...
3
votes
3answers
190 views
How do you make sure a pdf is deleted after being viewed in the browser?
For things like images or html documents, cache headers make sure that the data is deleted when the browser is closed. However as PDFs are opened in a plugin, the cache headers do not seem to have the ...
