Questions tagged [http]

Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.

Filter by
Sorted by
Tagged with
1 vote
1 answer
87 views

Validate HTTPS traffic at later time [duplicate]

I want to capture HTTPS traffic, save it, and validate it at a later time. I want to ensure that at a later time I'm able to validate the HTTPS traffic using the certificate which was presented at the ...
438 votes
9 answers
316k views

Is BASIC-Auth secure if done over HTTPS?

I'm making a REST-API and it's straight forward to do BASIC auth login. Then let HTTPS secure the connection so the password is protected when the api is used. Can this be considered secure?
11 votes
3 answers
3k views

Upgrade-Insecure-Requests as an alternative for HSTS

I have seen that websites automatically transform HTTP requests into HTTPS without the HTTP Strict Transport Security (HSTS) Header. So does the following line in the request fully alleviate the ...
0 votes
1 answer
669 views

Why is Nessus report HTTP running a web server on port 80 when I'm sure that it isn't?

From a Nessus scan I have the following output regarding HTTP and the use of port 80: Info N/A 43111 HTTP Methods Allowed (per directory) Info N/A 24260 HyperText ...
0 votes
1 answer
287 views

What security concerns can arise from using HTTP Basic-Authentication? [duplicate]

During an engagement, i have been asked by a client to explain (with the use of one or more examples) why they must update their website authentication mechanism, as they are currently using HTTP ...
2 votes
2 answers
296 views

Mitigating the performance impact of strong hashes with Basic HTTP authentication

I am trying to decide which work factor to use for our hashed passwords, and I am facing the following dilemma. Let me elaborate for a moment. Basic HTTP authentication works as follows: The user ...
0 votes
1 answer
224 views

DNS Spoof Adware

Someone recently boasted about adware which can inject ads from most networks, and using DNS spoofing would make the providers think that the ads were on a website owned by me (i.e. www.myscamsite.com)...
14 votes
4 answers
40k views

POST over HTTPS "secure enough" for sensitive data?

I'm wondering if to prevent the possibility of a compromised SSL certificate leading to the potential for sensitive information disclosure if it might be prudent to further encrypt data being passed ...
0 votes
1 answer
129 views

Encryption options when one-way secure channel is available

I would like to ask what encryption options are available for the following real scenario: There is an unsecure, full-duplex communication channel between a server and client There is also a secure ...
2 votes
1 answer
242 views

Timeless timing attacks and response jitter

I've been researching timeless timing attacks, ie: timing attacks using concurrency rather than round trip time. Here is an article by portswigger with links to the original article by Van Goethem. ...
22 votes
4 answers
25k views

Is a secure cookie without the HttpOnly flag a problem?

I understand that cookies with the secure flag should be transmitted over a HTTPS connection. It also means that these cookies should be protected from adversaries (private cookie). Thus, it is ...
3 votes
2 answers
302 views

If the connection is encrypted, is it still unsafe to login at a public network?

It's common knowledge that one shouldn't login to personal or bank accounts on public wifi such as in a starbucks or a hotel. However, assuming that the connection is HTTPS and the passwords itself ...
2 votes
1 answer
379 views

HTTP and HSTS Web Server

If I have HSTS enforced on a web server with HTTPS 443, but HTTP port 80 is still open, does this make HTTP still accessible, or only for the first time before it's added to the browser HSTS list? I ...
0 votes
0 answers
327 views

How to perform php post request attack with javascript sanitization?

The following code demonstrates the source code of this challenge and basically, I need to send a post request with arbitrary code to execute on the server. However, after multiple attempts Im unable ...
6 votes
2 answers
8k views

Best practice for caching sensitive data

My server returns private data in the body of an HTTPS response. It's not passwords or credit cards, but it is user-generated text and images, which should not be accessed by others. The data for a ...
0 votes
2 answers
151 views

Changing HTTP to HTTPS in a URL has any effect in the security of a connection?

A lot of websites tell that HTTP is insecure, but if I manually change the address bar URL from http:// to https:// in a website I visit does it provide security regarding the connection? Because all ...
22 votes
6 answers
6k views

Backend database username and password revealed in JSP Page

Recently I came across a website and when clicking on one of hyperlinks it displayed a HTTP 500 error page as shown in the image, which indicated that it is using Java Server Pages and on line 23 the ...
89 votes
7 answers
66k views

Does a CSRF cookie need to be HttpOnly?

We were recently handed a security report containing the following: Cookie(s) without HttpOnly flag set vulnerability, which we apparently had in one of our internal applications. The applied fix ...
5 votes
2 answers
2k views

How can I make an SSL certificate for an IoT device trusted on all browsers?

I have a web server running on an IoT device, more specifically, on an ESP32. This web server serves a website that is used for managing the device and can contain some sensitive information, hence I ...
22 votes
4 answers
5k views

Are web servers that support HTTP any more vulnerable to client-run exploits than those that use HTTPS?

Does HTTPS have any unique mechanisms that protect web servers from exploits run by a malicious client (eg. SQL injection, specific browser exploits etc.)? My current understanding is that HTTPS is ...
0 votes
1 answer
277 views

Does using the "-k" flag with curl disable only the certificate verification?

I'm writing an API which is running on my own web server written in Go. I have a local environment set up to run it all under HTTS using a self signed cert and it all works great. It all works and I ...
1 vote
1 answer
143 views

owasp crs 3.0 rule functuonalityconsult

I have built a waf and using CRS 3.0, this waf can inspect the request body to limit the file size that upload to the server, I am wondering ,if I just disable this feature manually, it will cause any ...
19 votes
3 answers
129k views

Is it possible to force a browser to use http in an ssl enabled (https) website?

I was doing a security research on storing the session id in local storage instead of storing it in cookies. I understand that it is not possible to tag the values in local storage as HttpOnly and so ...
0 votes
1 answer
171 views

How do you sniff information exchanged with a site which does not use TLS/SSL?

Whenever you visit a website without HTTPS (because for whatever reason there are still quite a few of them even in 2022) typically the browser will announce that you should not enter any sensitive ...
0 votes
2 answers
817 views

Does the HTTP status code 302 guarantee no other content was served as part of the same HTTP response?

Does receiving the HTTP 302 status code from a domain A guarantee in any shape or form that there was no JavaScript ran or any additional content (external or not) loaded from that domain A? The ...
16 votes
5 answers
4k views

Obfuscating HTTP Error Codes

I'm working on a REST API endpoint where we only accept requests from certain domain names. Whitelisting. A dev I'm working with recommended that we return HTTP 400 instead of HTTP 403 if the incoming ...
0 votes
1 answer
794 views

Can POST request be changed in a HTTPS website?

I am trying to develop a website where I grab data using javascript and send it to PHP using ajax post. However, while researching, I found that the POST request can be modified using third-parties ...
1 vote
0 answers
322 views

CSRF and XSS Protection with a Static Site and REST API

I'm building an application which will support both browser and application access to REST resources. Applications will POST a username/password JSON body to a login endpoint which will return a ...
4 votes
1 answer
2k views

Can I trust the http Host header in this context

I have a microcontroller, connected to my WLAN, that hosts a tiny web server. I can reach the http server via 2 ways : either via a domain (admin.example.com) which acts as a reverse proxy to the ip ...
0 votes
2 answers
634 views

HTTP with encrypted message vs HTTPS

A bit of background: I am a web developer and sometimes i integrate some form of external API in my web applications. It's the second time already that i find something strange: some APIs instead of ...
1 vote
1 answer
3k views

What are the ports used by Online Email Accounts such as Yahoo Mail, Gmail, etc.?

Let us say that I send an email using Yahoo Mail or GMail. Can this email be intercepted using a packet sniffer? On which port does the email travel? HTTP, SMTP, POP3?
0 votes
1 answer
203 views

What exploit is trying to be leveraged here? (Apache access.log)

I've just deployed a barebones Apache server on Digital Ocean, only hosting static files. No PHP et al. I'm not too bothered to see random exploit attempts, but 99% of the requests are of this similar ...
-2 votes
1 answer
15k views

What are the most common HTTP ports? [closed]

What are the most common ports for HTTP services? 80,443,8080 are common for all of us, but what else are used?
9 votes
5 answers
4k views

Is information disclosure in a form of a server header a real vulnerability?

I have seen in many places that people say that headers of the following types is a vulnerability: Server:Microsoft-IIS/7.5 X-AspNet-Version:4.0.30319 X-Powered-By:ASP.NET I can see that this gives ...
1 vote
1 answer
465 views

What is the difference between Cross Origin Opener Policy and SOP?

"The HTTP Cross-Origin-Opener-Policy (COOP) response header allows you to ensure a top-level document does not share a browsing context group with cross-origin documents." In a situation ...
1 vote
2 answers
3k views

Storing Session Id in application logs

Short version: Is it not recommended to store sessionId in log files/database in plaintext (considering it may put active sessions at risk)? If yes, why do I see many queries on how to log sessionId? ...
2 votes
0 answers
601 views

What are NGINX reverseproxy users doing to prevent HTTP Request smuggling?

Since NGINX does not support sending HTTP/2 requests upstream, what are the present NGINX reverseproxy users doing to mitigate HTTP Request Smuggling vulnerability? I understand that the best way to ...
0 votes
1 answer
179 views

Do websites send full URL over HTTP instead of HTTPS if there's an HTTPS connection?

I was learning to use wireshark when I noticed that opening a reddit url (reddit.com/r/privacy) sent a GET request for r/privacy over HTTP. Is this visible to the ISP or network sniffers? I was under ...
3 votes
2 answers
535 views

Is it ok to skip validation of TLS validation if the request's host is targeting localhost?

I'm writing a canary for monitoring which will be deployed to the same host as the monitored application. The underlying application validates certificates for incoming requests and validates that the ...
1 vote
1 answer
2k views

Modifying UserAgent by a proxy?

For learning and testing purposes I'd like to change the UserAgent in the HTTP header. In the desktop Firefox it is simple: there is an add-on for this task. But on android... it is impossible. I ...
0 votes
0 answers
95 views

Security implications of using HTTP for service to service communication within the same host [duplicate]

What are the security implications of using HTTP only for IPC for services within the same host? In my case, I am using docker-compose to host two ASP.NET Core services within the same host in Azure. ...
0 votes
1 answer
12k views

Hydra cannot connect to http-post-form

I don't get the correct results and I'm not sure what I'm doing wrong: $ ./hydra -l admin -x 3:9:a http://localhost http-post-form "/admin/login:j_username=^USER^&j_password=^PASS^:failed&...
3 votes
1 answer
480 views

Cookies VS localStorage (JavaScript Security)

I know that HTTP requests made by the site get the browser's localStorage for a site, and document.cookie is encrypted for HTTPs websites, but I'm still wondering the risk of storing sensitive ...
0 votes
1 answer
5k views

CheckMarx SSRF Vulnerability

I have a REST which takes a parameter dataSource as input and myService has follow logic. @RequestMapping(value ="/save", method = RequestMethod.POST) public List<String> find(@...
28 votes
4 answers
13k views

Do websites know which previous website I visited?

Suppose I am using a web browser to look at example.com. Now, from the same web browser tab, I enter example.org in the address bar and go to that completely different website operated by another ...
0 votes
0 answers
319 views

Authenticating (getting token) by making Http request

As the topic is a bit vague I have decided to ask you guys here what do you think and what is the best practice in given scenario.   Disclaimer: I am programmer, and although I know a bit about ...
2 votes
1 answer
2k views

Is it secure to share a public (RSA) key over http?

The following scenario: We have a HTTP (not HTTPS, so unencrypted) server which contains an open (RSA) public key. The general sharing of the public key should not be a problem since it is the public ...
24 votes
2 answers
43k views

Specific risks of embedding an HTTPS iframe in an HTTP page

I need help listing the specific risks of embedding an HTTPS iframe that enables credit card checkout inside of an HTTP page. Are there security issues with embedding an HTTPS iframe on an HTTP page? ...
0 votes
2 answers
135 views

What can be deduced with a GET /.ht 403 forbidden and a GET /hx 404 not found?

In testing a website on a bug bounty platform. What can reasonably be deduced from the following situation? GET /.ht -> returns a 403 Forbidden GET /.hx -> returns a 404 Not Found The only ...
0 votes
2 answers
744 views

Is end to end encryption over HTTP safe?

If you wrap all your data in an end-to-end encrypted payload is it safe to transmit over HTTP or at worse case self signed HTTPS instead of traditional CA signed SSL?

1 2 3
4
5
30