Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP ...

learn more… | top users | synonyms

1
vote
2answers
740 views

http blocked over very low ports in Opera web browser

Opera blocks the user from making http requests over very low ports (below 1024). Why does Opera not allow the user to override this setting? What is wrong with running a web server on, say, port ...
1
vote
3answers
5k views

Facebook login on HTTP? [duplicate]

Possible Duplicate: Is the Facebook login form using SSL without https in the URL? If you access http://www.facebook.com/, in the top right side there is the login section. You can enter ...
1
vote
1answer
53 views

Force https without 301

For my website's .htaccess I currently have: RewriteCond %{HTTPS} !=on RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301] So that when someone visits the page over http they get a 301 ...
1
vote
3answers
245 views

Is browsing http sites insecure?

So for example this site, security.stackexchange.com, when I look in my browser it doesn't say that it uses https and it does say that my connection is not encrypted. The same goes for, say, ...
1
vote
1answer
92 views

Tamper with post data before it is sent

I am currently doing some pentesting for my work (not my job role but i always wanted to learn). I am trying to modify post and get data as it is sent (intercept, tamper), the web app I am trying to ...
1
vote
2answers
44 views

HTTP BA from a different Server [duplicate]

There is a weird situation that I am stuck with regarding HTTP Basic Authentication. Below is a hypothetical situation: Lets say there is a certain domain, say https://myfacebook.com and there is a ...
1
vote
4answers
319 views

Does referrer header checking offer any real world security improvement?

At work we use a central portal that provides basic SSO functionality to other applications. In addition to verifying the SSO data sent, all of our existing in-house applications (used by the public) ...
1
vote
2answers
498 views

Why is my Mac trying to connect to an http://akamai.com server

I am running a properly configured pf_config ( at least, sort of properly configured ) and have wiped my hard drive clean 3 times with a fresh install of OSX Maverick. I find it odd that my laptop ...
1
vote
2answers
115 views

non-MiTM Reverse SSL

Do non-MiTM Reverse SSL Proxies exist? Or do all proxies that do SSL-SSL mappings decode and then re-encode HTTPS traffic? If this is the case and I want to map https://mypublicdomain.com -> ...
1
vote
3answers
276 views

What information can be seen from HTTPS to HTTP?

Assuming a secured page https://google.com/redirect.php?keyword=apple which redirects the visitor to a non-secured website http://apple.com, would an eavesdropper (anyone watching over the network) be ...
1
vote
2answers
3k views

When can closing port 80 be a problem?

Since port 80 is typically used for HTTP must a web server have it open or otherwise configure links to specify a different port (e.g. http://www.example.com:8080/mypage.html)? For example this site ...
1
vote
2answers
1k views

Signed request vs HTTP digest auth for API authentication?

By signed request I mean something like this (simplified example): Client creates a sig in his request: $sig = hash('sha256', $api_key.$data); which generates 7409ur0k0asidjko2j for example. He then ...
1
vote
1answer
227 views

Securing communication

The problem: I have an open-source client (a Firefox add-on written in JavaScript) and a server containing somewhat sensible user information: username and user history (all from YouTube). The client ...
1
vote
1answer
56 views

creating a TLS encrypted API

I have an HTTP API endpoint on my server that is encrypted (TLS). It is not a public API; users must sign-in and validate their account/identity to access the API. When I connect with my test client ...
1
vote
1answer
62 views

Is there a way to mimic http request of a compiled program?

Lets suppose my program makes a http request and uses it response to update some values. Is it possible to somehow mimic the response in order to modify it so the program believes the server responded ...
1
vote
3answers
171 views

HTTP authentication: identify the client

We have a web-site, where each user has to log-in to access a private area. Inside the private area, there are some information about the user, a profile, including some sensitive information (home ...
1
vote
2answers
172 views

How Web-proxy and Virtual-Hosting are complications for HTTPS?

While studying HTTPS and related transport layer security protocols(SSL/TLS), I came to know that HTTPS suffers from two complications - Web-Proxy and Virtual-Hosting. I can understand how ...
1
vote
3answers
158 views

Https forms on tens of domains

What is the optimal way (cost-wise, too) to secure page forms (https) on a large number of domains&subdomains? Are certificates required for all domains? Is putting all the page forms on a single ...
1
vote
1answer
138 views

Suspicious http requests in my logs: *.html/RS=^

I see some strange (suspicious?) http requests in my webserver. Example: 192.161.x.x - - [14/Mar/2014:21:55:36 -0300] "GET /ce/c02i.html/RS=^ADAD3F3nOTvuESWLtAiP39aTQZiSRQ- HTTP/1.0" 404 881 ...
1
vote
1answer
659 views

Can closing port 80 lead to more security?

If a website is running on HTTPS only, is it reasonable to close port 80 of the web server and only leave port 443 open? Does this action provide more security for the website?
1
vote
3answers
269 views

Are Modern Servers susceptible to HTTP Splitting Attacks

Note: I know how HTTP Splitting works. Note 2: I am not working in WebGoat. I am trying to make this on my own. I am trying to imitate the HTTP Splitting attack on my machine. For that I wrote this ...
1
vote
2answers
792 views

Token based authentication under http

I am doing a token based authentication but facing some security problems. In the system, a user will login as follows: Type username and password to login in a https login page If the login is ...
1
vote
2answers
331 views

How to defeat CRIME, BREACH, TIME etc… server side (without sacrificing compression)

I am writing full-stack server side software and I have been researching CRIME attacks and it's relation to SPDY header compression as I am implementing the server side codecs for it at the moment. ...
1
vote
1answer
3k views

In which ways could a javascript making a cross domain HEAD request be a threat?

I was just reading this answer to the question Why is the same origin policy so important? Basically, when you try to make an XMLHttpRequest to a different domain, the browser will do one of two ...
1
vote
3answers
2k views

ModSecurity errors related to REQUEST_METHOD HTTP/1.1 and GET

I asked my host to switch on the log file, and it have increasing a lot since then. Its have been increasing with 700 mb for the last week. It’s filled with error messages related to Mod Security. ...
1
vote
1answer
162 views

Simple and secure remote installation method that accepts input via a web page?

When installing software on a remote server: Is it possible to let the admin (i.e. the user that installs the software) define admin username and password via a HTML page, in a secure manner? ...
1
vote
1answer
311 views

Following redirects from HTTPS to HTTP - Secure?

So I have an HTTP client which supports HTTPS. However, it doesn't follow the HTTP spec recommendation for redirects on POST(which is to ask the user before redirecting) This means, in theory, if you ...
1
vote
2answers
885 views

HTTP Response Splitting

Is this apart of a HTTP Response Splitting attack ? Here below is some code that gets put into a web browser after clearing the url while on the website javascript: var xhr = new XMLHttpRequest(); ...
1
vote
1answer
456 views

When distributing a CRL over HTTP, what is the optimal refresh time? What logic affects this decision?

When distributing a CRL over HTTP, what is the optimal cache and max age settings (etc) for this distribution mechanism? Related information on a different answer Consider using HTTP instead ...
1
vote
1answer
191 views

Will packet sniffing still work if all connections go through a local proxy?

Will packet sniffing work if all connections use a local proxy? You are forced to use this proxy to get a connection to the internet at all.
1
vote
1answer
766 views

How to determine whether the redirect link is secure or not?

I am checking about the security of redirect link, For the below link , how to determine whether it is secure? For the first link, the users are not allowed to change the url in the browser, but they ...
1
vote
3answers
68 views

Risks associated with HTTP content injection?

I'm curious about the risks associated with HTTP content injection, where an ISP injects content to pages accessed over non HTTPS connections. Some examples: ...
1
vote
3answers
210 views

{Secure} Telnet connect to a console server from webbrowser

I've got a terminal server set up in a data center that also serves as a console server. This console server only accepts regular telnet requests. To this server are a bunch of routers and switches ...
1
vote
1answer
112 views

Maximum number of Requests in HTTP keep alive connection

We are running a network analyzer . And we log info which are in the HTTP request headers and HTTP response code. Because in keep alive connection request may come without responses. I push requests ...
1
vote
1answer
67 views

Use TOTP to prevent simulating requests

I'm developing an API system which provides functionalities for a game. Currently, we are using HMAC to prevent simulating requests (let's say, prevent hackers from simulating the game) but because we ...
1
vote
1answer
224 views

Is my authentication persistence system design secure?

This system is for a personal file upload and sharing web application made with PHP. When a user logs into the application, it has the option to "stay logged in" after closing and reopening their ...
1
vote
2answers
212 views

Why the Websense blocks same site when used with http & not when used https? [closed]

I have been working in a IT firm. I have access to some social sites. When I try to open site Links in mail (that are having http://), the websense prompts me that the access is blocked. However, when ...
1
vote
1answer
99 views

BREACH attack and content length

I've been researching BREACH, and while I can understand how it might work if you have access to the the browser (to send crafted requests) and the wire (to capture compressed response length), I ...
1
vote
1answer
79 views

Is this behavior the result of malware?

I have setup a new set of servers to test a software in Amazon EC2, and had set up my application. I've given it public access and a DNS entry, so its easily reachable by those that need to test it ...
1
vote
1answer
136 views

How do you identify a website's form-type?

How do you know which attack method to use when using software like thc hydra, brutus, etc? e.g. http-get, https-get, http-form-get, http-form-post, etc? For example, for sites like Yahoo, Gmail, and ...
1
vote
1answer
304 views

Legitimate use case of man-in-the-middle attack for DPI?

I am working on a device that should sit between the end-user and the server, and that will do deep packet inspection. It is basically a parental control node. This device will be sold to the user, so ...
1
vote
1answer
73 views

Can I reliably identify Apple devices that have not patched against the gotofail vulnerability based on user agent string?

The title pretty much says it. Do the security patches to address the gotofail security issue in multiple Apple products employing SSL change the User Agent string for the respective systems? And, of ...
1
vote
1answer
118 views

HTTP security headers on non HTML (images, JavaScript, etc)

Let's say, the HTTP security headers below are applied to all HTML pages of a site: HTTP Strict Transport Security (HSTS) X-Frame-Options (XFO) X-XSS-Protection X-Content-Type-Options Is it OK to ...
1
vote
1answer
105 views

Is it dangerous to sync my data with my personal server through unencrypted http?

Since Apple force iPhone users to use iCloud to sync contacts & calendar, I moved to a local ownCloud instance that works well. However, it would be more convenient if I could sync everywhere and ...
1
vote
2answers
321 views

Anomaly detection in HTTP REFERER

I'm trying to put some anomoly detection in place and I'm looking at referrer data (I know that this is optional, and can be fudged in some circumstances). But I'm seeing too many cases of what I ...
1
vote
1answer
243 views

How to check whether a link is safe or not? [closed]

I've been working on a task to find threats in a social network called Skyrock. For which, I've managed to retrieve a significant amount of URLs by crawling various user profiles and parsing the data ...
1
vote
1answer
1k views

What are the ports used by Online Email Accounts such as Yahoo Mail, Gmail, etc.?

Let us say that I send an email using Yahoo Mail or GMail. Can this email be intercepted using a packet sniffer? On which port does the email travel? HTTP, SMTP, POP3?
1
vote
0answers
31 views

Metasploit reverse_http(s) PAYLOAD for linux target

During exploitation via metasploit's browzer_autopwn, I need to set a payload using http or https channel on a linux target. But there is no reverse_http(s) available in linux payload category. What ...
1
vote
0answers
29 views

What are the security implications of enabling a SNI-hole on a web server?

A web server (let's say Apache 2.4) implements SNI. It is configured with a 4096 bit SHA384-signed Wildcard Certificate (*.land.org) with a Subject Alternative Name (land.org). The Certificate ...
1
vote
0answers
55 views

Has HTTP bogus request type “COOK” been used in any known website attacks?

An apache web server access weblog shows a request type "COOK" where POST or GET are normally found. Is such a request part of any known web-based site attacks?