Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP ...

learn more… | top users | synonyms

1
vote
1answer
166 views

Are HTML Components (HTC) files a potential attack vector?

I'm working on a site that has a higher-than-normal concern for user security. I've recently been working on some CSS issues with older versions of IE (we support 7 and higher) and found that an easy ...
0
votes
0answers
23 views

Slow Loris Get Request

From my understanding, a slow loris attack is an attack of incomplete GET requests to most famously an Apache server because the server does not timeout the connection made. GET / HTTP/1.1\r\nHost: ...
9
votes
3answers
428 views

External websites in logs [duplicate]

I have a website, let's call it www.good.com. I've been getting a lot of requests to www.good.com under completely different URLs than www.good.com. I suspect this traffic is also causing some site ...
2
votes
1answer
72 views

Whitelist for HTTP request

Malicious request can come in the form of user agent string, referrer or cookie. To prevent being pawned by zero day attacks such as Shellshock, I have created a whitelist of characters for user agent ...
10
votes
0answers
1k views

If you block all incoming connections, how can you still use the internet? [migrated]

If your ISP or firewall is blocking all incoming connections, how can web servers still send you data to your browser? You send the request (outgoing) and server sends data (incoming). If you block ...
-1
votes
0answers
21 views

Https and FTPS security [duplicate]

Since booth FTPS and HTTPS are protocols over SSL/TLS, is it correct to assume that both are 100% equivalent in terms of security? Or am I missing something?
3
votes
1answer
98 views

Can serving HTTPS to Internet Explorer on Windows XP be made secure?

Answers to Why is HTTPS not the default protocol? state that a lot of sites still use clear HTTP instead of HTTPS because all of these are true: A substantial number of visitors to the site use ...
1
vote
0answers
26 views

Cross Origin Resource Sharing question

I have some mockup html/javascript on my desktop, I made an ajax GET call to: http://www.bungie.net/platform/Destiny/TigerPSN/Account/4611686018429149347/Character/2305843009215132906/Activities/ ...
0
votes
2answers
77 views

Is it safe to set up IP address to domain name redirection?

We recieved the following e-mail with from one of the UI developers When we browser site with IP: http://x.x.x.x/, it doesn’t redirect to http://www.our_website_name.com. This could cause ...
2
votes
1answer
72 views

Http redirect using Location, but using falsely supplied data from host header

If I have a domain www.mysite.com, and I am making a request to www.mysite.com on port 80 using telnet, but I send a host header with another domain name(www.wrong-domain.com), but the server doesn't ...
0
votes
1answer
72 views

Is cloud server without HTTPS secure

I am running a Seafile Open Source Cloud server (v 4.0.6) on my Raspberry Pi 2. Currently it is set up to simply run without HTTPS or even a domain name on [myIP]:8000. I am also running an Apache web ...
12
votes
3answers
973 views

Why for some SSL websites browsers show extra info, while for others dont

While visiting some https websites (like online banks, etc) url string appear to have little extra green box on the left hand side, with some organisation details. While other https websites just ...
2
votes
1answer
42 views

Server side validations for file upload to prevent DoS on HTTP server

I am aware that client side validations can be easily bypassed by means like disabling javascript. I would like to know the things to be checked while doing a server side validation for file upload. I ...
0
votes
1answer
553 views

Testing Basic Authentication with ncrack

I'm conducting some basic pen testing against a page protected with Basic Authentication. I've sucessfully tested with Medusa and Hydra but am struggling to get the syntax correct for ncrack. The ...
1
vote
1answer
74 views

Is this behavior the result of malware?

I have setup a new set of servers to test a software in Amazon EC2, and had set up my application. I've given it public access and a DNS entry, so its easily reachable by those that need to test it ...
2
votes
4answers
834 views

Does http support encryption without https (like STARTTLS)?

Does http support encryption without https, akin to STARTTLS in smtp? This may sound like a stupid question, but just think about it. Banks require strong encryption, and cannot do business without ...
5
votes
3answers
94 views

Can you sniff traffic to ip address from outside of your network?

I am not sure what it is called or even if it is possible but here is the scenario I am curious about: I login to a site that does not use SSL/TLS to do some work (unfortunately I must use this site ...
98
votes
8answers
39k views

Is BASIC-Auth secure if done over HTTPS?

I'm making a REST-API and it's straight forward to do BASIC auth login. Then let HTTPS secure the connection so the password is protected when the api is used. Can this be considered secure?
12
votes
6answers
33k views

Testing for HTTP TRACE method

How can I test for HTTP TRACE on my web-server? I need to train a Tester how to verify that the HTTP TRACE method is disabled. Ideally I need a script to paste into Firebug to initiate a https ...
0
votes
1answer
116 views

Publicly Available API + Sensitive ID/Key Transmission Over HTTP

I've run into a predicament... I'm developing a mobile application that utilizes a server for various things. One portion is that it stores an id/key pair related to accessing and processing ...
2
votes
1answer
66 views

application/json Content-Type character set

According to the OWASP Application Security Verification Standard: V11.3 Verify that every HTTP response contains a content type header specifying a safe character set (e.g., UTF-8). According ...
4
votes
4answers
1k views

Is it possible to force a browser to use http in an ssl enabled (https) website?

I was doing a security research on storing the session id in local storage instead of storing it in cookies. I understand that it is not possible to tag the values in local storage as HttpOnly and so ...
12
votes
4answers
11k views

How do the processes for digital certificates, signatures and ssl work?

I have been trying to understand how ssl works. Instead of Alice and Bob, lets consider client and server communication. Server has a digital certificate acquired from a CA. It also has public and ...
6
votes
2answers
850 views

Know of any HTTP tarpits/blackholes to use for redirecting malicious traffic?

So I cleaned up some malicious PHP scripts from a client's site and I've been monitoring for follow up connections to the scripts. Of course, I've found a LOT of IPs requesting the files. Too many ...
1
vote
1answer
54 views

Tamper with post data before it is sent

I am currently doing some pentesting for my work (not my job role but i always wanted to learn). I am trying to modify post and get data as it is sent (intercept, tamper), the web app I am trying to ...
0
votes
2answers
108 views

intercepting AJAX request and response using BURP

I would like to intercept an AJAX request using BURP. I have used BURP for web applications testing before. This, however, appears to be a weird case. I am not certain what am I missing here. The ...
8
votes
2answers
690 views

Question About HTTPS Security [duplicate]

I recently read about how HTTPS work and I have some questions to clarify. Pardon me if this sounds silly but I just need to get this clear. Correct me if I am wrong. I got to know that as part of ...
14
votes
7answers
3k views

How to perform safe authentication via HTTP?

I have to log in on an HTTP website. There is a login form which contains inputs for username and password and as hidden inputs the sessionId. I am creating an application in which I have to access ...
-2
votes
1answer
77 views

is encrypted body http secure

I'm working on an embedded project that needs to communicate with a server. Both the server and the device have an AES key pre-installed. I have a network device that provides http services but not ...
0
votes
1answer
186 views

tcpdump filter expression POST packets

I'm trying to save only POST packets using tcpdump filter expressions. I started with 'tcp port 80' and I found on the web a specific expression to achieve that. tcpdump -i wlan0 -s 0 -A -vv ...
0
votes
1answer
39 views

rate limiting and access filter for web application

I had a requirement of rate limiting and dynamically access controlling access to web application dynamically I want to be able to rate limit access turned on / off dynamically black/white list ...
0
votes
2answers
91 views

Are CSRF tokens useful outside of web APIs?

I'm trying to understand CSRF tokens and one thing isn't making sense to me. For a web API, you can provide a CSRF token just once, on authentication, and expect the client to remember that token ...
2
votes
1answer
62 views

Best way to do security testing for a server behind nginx proxy [closed]

I'm trying to do some security testing for my server(not a web server) which is sitting behind a nginx proxy. To start with it, I've done some fuzz testing using Sulley. As expected, most of the ...
16
votes
2answers
5k views

What is the HTTP “Server” response-header field used for?

It was not until recently that I began to question the use for the Server field in the HTTP Response-Header. I did some research: RFC 2616 states: 14.38 Server The Server response-header ...
22
votes
9answers
3k views

Why can protocols on higher layers be left unchanged?

In his answer to "How does SSL/TLS work?", Luc gives an explanation of how SSL works: SSL (and its successor, TLS) is a protocol that operates directly on top of TCP (although there are also ...
3
votes
8answers
546 views

Are URL shorteners “vulnerable” due to open redirects?

The OWASP state that open redirect is a vulnerability: An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This ...
4
votes
3answers
120 views

How is HTTPS/SSL able to hide destination website that one is connecting to?

I understand how it is able to create a secure connection via the handshake, but how is it able to initiate a secure connection without first sending an unencrypted request, thus revealing the ...
0
votes
2answers
87 views

Safe to use setuid with absolutely no input?

I have a shell script which syncs some files from a remote source and I have a pretty typical HTTP server set-up. There is a user who owns the files served by the HTTP server and a user which runs the ...
16
votes
4answers
3k views

Can someone using Wireshark obtain the full URL if my program uses HTTPS?

While perusing the contents of pcap files I've noticed some URLs appear to be visible despite being HTTPS. These mainly occur inside payloads that contain cert URLs too, but I also see HTTPS URLs ...
0
votes
0answers
30 views

What to use to encode JSON Web Token?

I'm using JWT to create access tokens for a Sinatra API. My question is, what should I use to sign the token? Right now I'm trying to use the user's password hash, but bcrypt-ruby changes the ...
1
vote
2answers
76 views

Security of HTTP proxies

If POST requests are being made to a website via a browser using an HTTP proxy from sslproxies.org, is it possible to trace the origin of those AJAX requests without having access to the proxy being ...
3
votes
3answers
853 views

Content-Security-Policy hash of script

<?php header("Content-Security-Policy: default-src 'sha256-".base64_encode(hash('sha256', 'console.log("Hello world");', true))."'"); ?> <script>console.log("Hello world");</script> ...
1
vote
1answer
82 views

FTP over SSL vs HTTPS implemention

Consider two implementations of SSL on a HTTP server and on an FTP server. With the same cipher suites used and the exact same protocols used. Is one more secure than the other. I have heard that it ...
2
votes
2answers
155 views

How can I be sure that I'm downloading over SSL?

Maybe I'm asking absolutely dumb question, but I couldn't find the answer yet. I know when I'm sending or getting a data in a browser over https, both server and client (browser) checks each other ...
2
votes
1answer
102 views

HTTP Host Header redirect traffic

Recently, I've seen periodic floods of traffic to my web servers with various Host headers that do not belong to us. The traffic appears to come primarily from China and a decent number seem to think ...
17
votes
5answers
2k views

What is the point of the same-domain rule for xmlhttprequest when script tags/JSONP can cross domains?

I get that I don't want a page loaded from stackoverflow.com to be able to request gmail.com on my behalf and read my email--but this seems to be simply a cookie issue. Since JSONP bypasses ...
4
votes
2answers
167 views

Long character sequence in first string of HTTP GET request breaks the web service's HTTP response. Buffer overflow?

During my current security audit test I've stumbled on something I can't possibly comprehend. The behavior exhibits signs of a buffer overflow in the target or in some intermidiate service (HTTP ...
0
votes
1answer
92 views

How could one defeat Webtrackers

I was just wondering why some pages refuse to load completely while surfing with no-script Plug-in when I don’t allow specific Java scripts. I was wondering if there is some way to hold the tracker ...
1
vote
2answers
41 views

HTTP BA from a different Server [duplicate]

There is a weird situation that I am stuck with regarding HTTP Basic Authentication. Below is a hypothetical situation: Lets say there is a certain domain, say https://myfacebook.com and there is a ...
2
votes
1answer
71 views

CSRF-protection using authentication token in HTTP header

I'm working on a web application which stores an authentication token in a cookie. The only CSRF-protection is referrer checking. I am considering improving this by moving the authentication token ...