Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP ...

learn more… | top users | synonyms

0
votes
0answers
5 views

Cleartext credentials proxy logs

I am wondering if anyone thought about this. Obviously, checking http get and post method calls is the starting point. Anything else than username:password format that should be sarched for in ...
0
votes
0answers
4 views

Who and where X-Forwarded-For header in user's request is added? [migrated]

X-Forwarded-For is a HTTP header which is used to identify the IP Address of originating user. I was wondering "where" this header is added in the request and "who" actually adds it? Is it your ...
0
votes
2answers
17 views

Integrity of downloaded Oracle JDK (/software in general)

Found something related Why aren't application downloads routinely done over HTTPS? This is a question about general security from a noob. I couldn't find anything relevant about this topic via ...
1
vote
3answers
56 views

Is it secure to have only https binding in IIS?

I have an API that I want to be accessible only by HTTPS. I know I can use URL-rewrite to force a redirect, but don't want to install additional modules. I was wondering whether only providing an ...
0
votes
1answer
71 views

View the access code, access token, and id token from Google during an OpenID Connect flow

Situation We're wanting to use an HTTP logger/proxy/analyzer to inspect the access code, access token, and id token that are part of the code flow. The flow is happening among Google (the ...
0
votes
1answer
55 views

Does HTTPS protect from session riding?

In a typical session riding scenario, the attacker tricks the victim into sending an HTTP request to a web site they are already logged in to. For example, tricking victim to click on a link to ...
10
votes
2answers
801 views

httpoxy - does TLS/SSL mitigate the vulnerability of HTTP Proxy header?

There's a new fancy-named, branded vulnerability called HTTPOXY. My question here: Are sites served via TLS also affected? Or is this an issue only for HTTP sites (unencrypted communication channel)? ...
1
vote
1answer
40 views

Best practices for securing open APIs from quota theft

I know that appKey is not a means of authenticating applications. But I am wondering what are the best practices for avoiding quota theft for open APIs, that are not associated with any user account. ...
0
votes
2answers
144 views

Website doesn't provide cookie (csrf token) when connecting over proxy. Why/how?

The Python code below should grab a "csrf token" cookie from Instagram.com, but I get an error message when running the program through any sort of https or socks5 proxy, informing me that the "csrf" ...
0
votes
1answer
71 views

How does ISP intercept web traffic?

My question originates from following articles: http://www.theregister.co.uk/2016/07/14/cloudflare_investigating_mystery_interception_of_site_traffic_across_india/ and https://medium.com/@...
0
votes
1answer
40 views

Suricata Signature Explanation

I am trying to figure out some Suricata(or Snort) signatures, more specifically, what they mean, what they prevent and have some problems about meanings of keywords. I will not write irrelevant parts. ...
22
votes
2answers
2k views

How does a website know the DNS server a client uses?

There are websites which claim to do "DNS leak tests". I don't care so much about DNS leaks but am curious, how does the website know which DNS server I am using? I guessed it would be a header sent ...
1
vote
1answer
45 views

Does encrypting HTTP header value provide additional security?

Payload before encryption : HTTP/1.1 200 OK Authorization: password Content-Encoding: UTF-8 Content-Length: 138 { "command" : "delete all records" } Payload after encrypting Authorization header : ...
12
votes
4answers
10k views

Detecting Tor proxy by reading request headers

I am a newbie to the field of security. As I was trying to explore more about HTTP request and response headers, I came across this website which provides a detailed analysis of the request header ...
2
votes
1answer
29 views

Is it safer to use the preloading feature of HTTP Strict Transport Security (HSTS)?

Is it safer to use the preloading feature of HTTP Strict Transport Security (HSTS) and if so, why? With preloading: Strict-Transport-Security: max-age=10886400; includeSubDomains; preload Without ...
8
votes
1answer
134 views

HTTP Response Splitting and PHP

There are numerous references to HTTP Response Splitting (HRS) vulnerabilities with PHP having been resolved since 4.4.2 and 5.1.2 (E.g. https://en.wikipedia.org/wiki/HTTP_response_splitting), or for ...
0
votes
2answers
101 views

How can I capture another IP's HTTP traffic with Wireshark network analyzer?

How can I capture another IP's HTTP(S) requests in a local network with Wireshark network analyzer? Is it possible?
49
votes
9answers
6k views

Why is HTTPS not the default protocol?

Why is HTTP still commonly used, instead what I would believe much more secure HTTPS?
5
votes
1answer
153 views

BREACH attack vs filtered reflected user input

I am in charge of the applicative security of our application and would like to test our exposure to the BREACH attack. Our django-based web application reflects filtered user-input and serves a CSRF ...
1
vote
1answer
156 views

Do my router and OS “know” which URLs I visit, if SSL is used?

Is it possible for a router or an operating system to get access to URLs I visit in my browser, if SSL-encryption is used between a browser and a webserver?
2
votes
2answers
66 views

How safe is accessing HTTP traffic(non-SSL) when using VPN and connected to public WiFi?

Suppose I am using public WiFi and connected to my office network through VPN. I am accessing some applications which are not SSL enabled. How easy it is for an attacker to see the traffic if he is ...
3
votes
2answers
79 views

Choice of authentication when both HTTP and HTTPS are supported

I am looking at a system where you are able to choose if you are going to connect to the web application via HTTP and/or HTTPS. You have to authenticate on either one. I know that the best option is ...
27
votes
5answers
3k views

What's the difference between using HSTS and doing a 301 redirection?

If I already have done a 301 redirection from all the HTTP inner pages to HTTPS, why should I use HSTS as well?
1
vote
3answers
97 views

Is HTTP POST any more secure than HTTP GET for AJAX?

All considerations of HTTPS/SSL, etc aside, if my user fills out a form and I send it by AJAX, it seems to me that POST & GET are equally interceptible, although GET is a teensy bit more ...
31
votes
3answers
3k views

Is HTTPS URL in plain text at first connection? [duplicate]

Let’s say I have never connected to the site example.com. If this site is https and I write https://example.com/supersecretpage will the URL be sent in clear text since it's the first time I connect ...
1
vote
1answer
75 views

Can you get a virus from sending a GET or POST request? [duplicate]

If I need to fix up my question in any way please let me know, this is my first question on the site So there's a game development website I use where you can develop with other people, and within ...
0
votes
1answer
59 views

Deobfuscating JavaScript Malware

Recently I was going over my network activity and came upon a PCAP that is directly related to a Trojan Dropper. Taking a quick look into the TCP stream of the packets, I found some malicious ...
0
votes
0answers
20 views

Using Nginx to block non-GET requests

I'm running a CouchDB instance on my server. A certain database within it (not the entire CouchDB instance) is exposed at a subdomain on my website via this Nginx configuration: server { listen ...
2
votes
1answer
102 views

Generating shared secret key using existing receivers public key and senders private key

I have the public key of the receiver, and the private key of the sender. I want to generate a new key by using the receivers public key and senders private key (also known as the signing key) to ...
6
votes
1answer
215 views

Does HTTPS protocol leak HTTP body length?

It seems that in a MITM attack, hackers may know the whole HTTPS packet size sent through the network (i.e. size of HTTP headers + HTTP body + overhead). Besides that, does the HTTPS protocol also ...
3
votes
1answer
126 views

How to get a green certificate bar if I'm not a company?

I'm not a company and do not represent one, but I would like to have a green bar on my website for several reasons. One of them, for example, is that I want to ensure that the information displayed in ...
1
vote
1answer
66 views

Security disadvantages of sending a password with GET? [duplicate]

Other than over your shoulder peeping, if a password is sent using GET in plaintext over an encrypted connection, are there any extra security disadvantages or is it the same as POST?
0
votes
1answer
64 views

Is HTTP POST insecure?

Is it possible to perform a MITM attack or even bruteforce a HTTP POST? If so how does one perform an attack and how can a developer protect his/her site from such an attack?
34
votes
2answers
61k views

Why is the Access-Control-Allow-Origin header necessary?

I understand the purpose of the Access-Control-Allow-Credentials header, but can't see what problem the Access-Control-Allow-Origin header solves. More precisely, it's easy to see how, if cross-...
1
vote
4answers
79 views

Server echoes HTTP headers back to client - any security issues with that?

Im troubleshooting a server that behaves a bit odd. If I make a request that looks like this: GET / HTTP/1.1 Connection: close Host: hostname Someheader: somevalue Location: Woot? Set-Cookie: test=...
2
votes
1answer
55 views

Getting error in Hydra

I'm trying to test someones website for them and I'm using hydra in cygwin on Windows. When I enter: hydra -L myusers.txt -P mypass.txt website.net http-get-form \ "/wp-login.php:user_login=^USER^&...
3
votes
2answers
80 views

CAPTCHA code refreshing vulnerability

Question is not programmatic but rather conceptual. When a user is trying to fill in a contact form and then CAPTCHA code, if he/she accidentally refreshes the page or doesn't fill a required input ...
24
votes
11answers
18k views

Prevent my site from being copied

Is it possible to protect my site from HTTrack Website Copier or any similar program? Without setting a max number of HTTP request from users.
0
votes
1answer
67 views

Deploy intranet application with SSL certificate

My company has an intranet application build on the WAMP stack - Windows / Apache / MySQL / PHP. This application is installed on a server at each customer's site, and is accessed via LAN IP address. ...
7
votes
1answer
2k views

HTTP Caching Headers: private vs no-cache

We're currently reviewing our set of "no-cache" security headers: Cache-Control "no-cache, no-store, must-revalidate Pragma "no-cache" Expires 0 Besides the "standard" set above, I found this ...
49
votes
9answers
42k views

Can my company see what HTTPS sites I went to?

At work my company uses internet monitoring software (websense). I know if I visit a https ssl-encrypted site (such as https://secure.logmein.com) they can't see what I'm doing on the site since all ...
2
votes
2answers
35 views

Testing non‐browser‐based https clients for Poodle

I have a command line tool that can download any URLs likewget (only for vcs systems) but not it’s source code, how can I test if it is vulnerable to POODLE? There are lot of online automated tools ...
13
votes
3answers
1k views

Why for some SSL websites browsers show extra info, while for others dont

While visiting some https websites (like online banks, etc) url string appear to have little extra green box on the left hand side, with some organisation details. While other https websites just ...
16
votes
7answers
5k views

How to perform safe authentication via HTTP?

I have to log in on an HTTP website. There is a login form which contains inputs for username and password and as hidden inputs the sessionId. I am creating an application in which I have to access ...
12
votes
4answers
9k views

Is it possible to pass TCP handshake with spoofed IP address?

Little time ago, me and my friends argued if TCP handshake can be passed with a spoofed IP address. Assume I have a https web server that allows only admin's IP numbers. Can anyone connect that web ...
5
votes
1answer
57 views

Can HPKP be used to track users?

There is already a large flora of "supercookies" and browser fingerprinting methods out there. I am wondering whether HPKP provides yet another method to track users? A server could send an extra ...
151
votes
2answers
94k views

What is the difference between https://google.com and https://encrypted.google.com?

Is it there any difference between the encrypted Google search (at https://encrypted.google.com) and the ordinary HTTPS Google search (at https://google.com)? In terms of security what were the ...
12
votes
1answer
240 views

Stack Exchange's javascript is malicious

I have, recently, discovered a rather annoying problem: every first-click I have on any Stack Exchange site creates an advertisement popup. This happens on my desktop, laptop, phone and even a VM. I ...
2
votes
1answer
56 views

Unsecure to allow all headers? [closed]

I'm currently developing an webapp. For testing and developing I allowed all Headers. Is this unsecure for productive use? Header unset Connection Header unset Time-Zone Header unset Keep-Alive ...
-4
votes
3answers
64 views

How to pass website firewall, in PHP? [closed]

Recently, I have posted a question, (http://stackoverflow.com/questions/37494896/how-to-save-file-from-url-to-web-server-by-php). And, there is an answer in question. In this answer, he said: "So the ...