Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP ...

learn more… | top users | synonyms

2
votes
2answers
81 views

What information can my ISP see using squid proxy?

My ISP provides a transparent proxy to use and I can see that they are using the squid proxy for caching this. What I am wondering is what data can they see and what can they see further if they can ...
2
votes
2answers
102 views

Can two users share the same Request.UserHostAddress?

I am working on an ASP.NET MVC-5 web application, which is available to public users (no login is required). And I need to prevent the same user from submitting more than 5 "contact us" requests ...
2
votes
1answer
125 views

How does LastPass know that Microsoft.com uses the password for Live.com?

When I visit Microsoft.com, the LastPass dropdown lists my username/password for login.live.com. It does something similar for Playstation.com and several other sites. How does it know? Are these ...
2
votes
2answers
478 views

Best practice for caching sensitive data

My server returns private data in the body of an HTTPS response. It's not passwords or credit cards, but it is user-generated text and images, which should not be accessed by others. The data for a ...
2
votes
1answer
962 views

Mandatory to implement HTTPOnly if Java Secure Cookies are set to 'true'?

Here is a test case from a recent application security asessment which I have had experienced: cookie = new Cookie(strKey1, EncryptDecrypt.encrypt(strValue)); cookie.setMaxAge(-1); ...
2
votes
2answers
585 views

Is HTTPS as secure or more secure than SSH if both have an IP address whitelist?

I'm wondering whether an HTTPS API endpoint would be as secure as or more secure than SSH. API Endpoint The API endpoint would require HTTPS The API authentication would use a POST'd API key. The ...
2
votes
3answers
1k views

Why don't more websites implement Perfect Forward Secrecy?

From what I understand, all it takes to enable PFS on a webserver is adding ephemeral cipher suites (ones that use DHE and ECDHE for the key exchange) to the list of cipher suites used in SSL/TLS ...
2
votes
2answers
7k views

POST over HTTPS “secure enough” for sensitive data?

I'm wondering if to prevent the possibility of a compromised SSL certificate leading to the potential for sensitive information disclosure if it might be prudent to further encrypt data being passed ...
2
votes
1answer
433 views

HTTP Basic Auth is enough?

I have WebSVN, Gitlab and phpMyAdmin hosted on my dev server. Now, all of it, I password protect the pages (not their individual login) using HTTP Basic Auth, is this the best practice that I can do?
2
votes
2answers
2k views

Signed request vs HTTP digest auth for API authentication?

By signed request I mean something like this (simplified example): Client creates a sig in his request: $sig = hash('sha256', $api_key.$data); which generates 7409ur0k0asidjko2j for example. He then ...
2
votes
2answers
3k views

Secure SSL Session from losing itself into unsecure http

I've seen some implementations of HTTPS SSL and, as a visitor, forced to rely to a lot of those. What would a secure implementation look like and where can one expect problems? I expect the installer ...
2
votes
3answers
275 views

IP over HTTP GET only

Consider the following scenario: There is a client behind a really strict firewall. There is nearly nothing available to 'connect to the internet'. Just DNS resolution and HTTP/HTTPS (some whitelisted ...
2
votes
2answers
87 views

Disclosure and HTTP status codes

Disclaimer: yes, I have checked the Which HTTP status codes are interesting from a security point of view? which sounds relevant but not entirely. These days it's supposed to be a good practice to ...
2
votes
2answers
292 views

How can I be sure that I'm downloading over SSL?

Maybe I'm asking absolutely dumb question, but I couldn't find the answer yet. I know when I'm sending or getting a data in a browser over https, both server and client (browser) checks each other ...
2
votes
2answers
763 views

What was the security vulnerability behind Box and Dropbox and what's different now?

Earlier today I received a number of comments saying that my shared links were disabled. I looked around and saw a number of articles explaining what happened, and Dropbox posted an official statement ...
2
votes
1answer
2k views

Web service HMAC authentication/anti-replay

I am creating a web service, which handles various requests from web clients. The client and server share a big secret key S, and when one part wants to send data, it calculates the token as follows: ...
2
votes
2answers
3k views

Is it harmful to allow http requests with very long querystrings in IIS?

I am developing a website with a search feature that could generate HTTP requests that are very long (up to 15,000) characters. However, IIS has a default limit of 2048 characters for querystrings. ...
2
votes
1answer
135 views

Why do Browsers warn about self-signed certificates but not about plain HTTP (which is not even encrypted)? [duplicate]

Let's keep it short: On HTTP everyone can listen easily. MITM attacks are no problem. On HTTPS (self-signed) everything is at least encrypted, it's much harder to MITM-attack and only private key ...
2
votes
1answer
163 views

Capturing (1x Only) HTTP POST Request [tcpdump]

Every now and then; I like to fire up tcpdump and just watch the network traffic as the packets flow on by. For example: user@host:~$ sudo tcpdump -Aevvv Will parse & print all local ...
2
votes
1answer
136 views

Can cascaded routers protect inner network's machine from attacker from outer network?

Given: Outer Network router A wan ip 209.123.12.11 address 10.10.0.1 machine A address 10.10.0.10 gateway 10.10.0.1 Inner Network router B wan ip 10.10.0.100 address 192.168.10.1 ...
2
votes
1answer
247 views

Understanding a suspicious HTTP request

While debugging my server for issues, I checked my logs frequently. Here is one weird one I've found, which seems like an attempt to run something on my server. I am using nginx on Ubuntu 14.04. Below ...
2
votes
4answers
1k views

Does referrer header checking offer any real world security improvement?

At work we use a central portal that provides basic SSO functionality to other applications. In addition to verifying the SSO data sent, all of our existing in-house applications (used by the public) ...
2
votes
2answers
336 views

Are MITM attacks possible on HTTP loopbacks?

I have a web server running at example.com. The web server performs a server-side request to example.com which results in a loopback, so the request never passes over the network. Is this request ...
2
votes
2answers
304 views

How to prevent attacks before HSTS is established for the first time? [closed]

What is the best way to accomplish this and prevent attacks like SSL Strip?
2
votes
1answer
509 views

In Same Origin Policy, why are different protocols considered a security violation?

I can understand why content from different domains is considered to be unstrusted for the same origin policy. But, how can be content from diferent protocols from the same site/domain be dangerous? ...
2
votes
2answers
1k views

Token based authentication under http

I am doing a token based authentication but facing some security problems. In the system, a user will login as follows: Type username and password to login in a https login page If the login is ...
2
votes
1answer
4k views

In which ways could a javascript making a cross domain HEAD request be a threat?

I was just reading this answer to the question Why is the same origin policy so important? Basically, when you try to make an XMLHttpRequest to a different domain, the browser will do one of two ...
2
votes
2answers
690 views

HTTPOnly Cookies: Security Depends on Client Cooperation?

I've been implementing HTTPOnly cookie-based session handling and have some questions about what HTTPOnly means. I realise it's a flag that gets passed around in the HTTP header when setting cookies. ...
2
votes
1answer
74 views

Is SSL really insecure on most of the web? This report seems to suggest so [duplicate]

The Wikipedia article on TLS article has a tremendously long list of attacks against SSL. A table on that article shows a survey from September 2015. If you look at that survey, it shows that nearly ...
2
votes
1answer
327 views

302 redirect and the body on the page (you are redirected to …)

I have page which take URL on query and string and it. Then, you get redirected using 302 to another page, and the response of the page contains HTML code and the redirect header. Like this: ...
2
votes
1answer
43 views

Is this system of authentication secure for a mobile app? What can I do to improve it?

Users authenticate with their phone number, get a pin text, and if it is correct, they get an access token. Store the access token in a DB in a Token model. The client always sends the access token in ...
2
votes
1answer
310 views

Server side validations for file upload to prevent DoS on HTTP server

I am aware that client side validations can be easily bypassed by means like disabling javascript. I would like to know the things to be checked while doing a server side validation for file upload. I ...
2
votes
1answer
1k views

CSRF-protection using authentication token in HTTP header

I'm working on a web application which stores an authentication token in a cookie. The only CSRF-protection is referrer checking. I am considering improving this by moving the authentication token ...
2
votes
1answer
302 views

Http redirect using Location, but using falsely supplied data from host header

If I have a domain www.mysite.com, and I am making a request to www.mysite.com on port 80 using telnet, but I send a host header with another domain name(www.wrong-domain.com), but the server doesn't ...
2
votes
1answer
113 views

Danger of having my website make arbitrary web requests

I'm setting up a small code-hosting web site, in the vein of github or bitbucket. I would like to allow users to specify an arbitrary URL from which my site's server will initially clone their ...
2
votes
2answers
298 views

Indirectly relaying intranet server to outside world

I have an internal network of IP network cameras. The feeds from these cameras are ingested by a single server and presented from a unified web interface both internally and to the outside world (both ...
2
votes
1answer
937 views

What method for CSRF token generation should I use in my scenario?

I'm working on a RESTful API to work with my AngularJS application. Authenticating works by generating an ASP.NET FormsAuthenticationTicket. It is stored in a cookie using ...
2
votes
1answer
1k views

Are there any vulnerabilities when making cross-domain HTTP requests during an SSL connection?

I recently starting using the Calomel SSL Validation plugin for Firefox to test the SSL security on the sites I visit. When navigating to American Express' log in page, I noticed Calomel reports the ...
2
votes
1answer
387 views

Route traffic from iPhone to desktop and back

I have some iOS app to pentest, and the target server is accessible only through the jailbroken iPhone's APN. My problem is, that I want to configure the traffic in such way so I can intercept and ...
2
votes
1answer
107 views

What's the best way to enumerate log/sign in attempts?

For sign in via a website, what is the best way to count the number of attempts that is: least vulnerable to tampering reliable quick The system would: use HTTPS throughout the sign on phase (at ...
2
votes
4answers
1k views

Should links to images contained in emails be secure?

We are generating emails which contain links to images: our client's branding, images showing other products offered by the client etc... What are the security pitfalls if these links in the emails ...
2
votes
1answer
9k views

How to use http-get-form in THC-Hydra?

I've been messing with Hydra (Brute Force) to solve the "Damn Vulnerable Web App" brute force section but the problem is when I use http-get-form it said: Warning: child 1 seems to have died, ...
2
votes
1answer
83 views

How to use HTTPS for servers whose IP and domain name change, potentially frequently?

We have devices (think "Internet of Things") that have a HTTP server installed. Those devices can change their IP and domain name quite frequently (or have no domain name at all). They have a GUID ...
2
votes
1answer
68 views

Blocking a redirect link in an iframe on a chat site

There is a shortened link being spread which contains an @ symbol. j.mp/s@mething, and it's used for phishing purposes. When trying to block it, for some reason it doesn't like the @ character I want ...
2
votes
1answer
114 views

Flaw in HTTP Digest Authentication

I am working through my textbook and I came across this question: Below is the message format for a browser response to access a password-protected web page using HTTP digest authentication. GET URI ...
2
votes
1answer
199 views

OAuth 2.0 client side redirect instead of HTTP redirect

I'm implementing an OAuth 2.0 authorisation server using the Authorization Code flow (i.e. users will authorise client apps to connect to our server). The auth server is the same as the resource ...
2
votes
1answer
170 views

How should I tunnel arbitrary protocol traffic over HTTPS?

I'm posting this question from a moving train! (Ok, maybe that's not so impressive.) This train has an annoying WiFi - it's low-throughput, high-latency, tends to lose packets, and blocks most kinds ...
2
votes
2answers
101 views

Can 3rd party JavaScript libraries access the http headers of the hosting html page

So, I have website, it uses a cookie stored in the http header of the downloaded html document to maintain the session while the end user is logged on and accessing there 'secure' data. This webpage ...
2
votes
1answer
211 views

Encrypting layers of OSI

I was reading that WPA2-PSK encrypts layer 2 of the OSI network model. What is the danger of having this layer in plaintext (I know it can be decrypted very easily from within the network)? Is there a ...
2
votes
3answers
170 views

Risks associated with HTTP content injection?

I'm curious about the risks associated with HTTP content injection, where an ISP injects content to pages accessed over non HTTPS connections. Some examples: ...