Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP ...
83
votes
8answers
4k views
Attacking an office printer?
I did an nmap scan on an advanced office printer that has a domain name and is accessible from outside the corporate network. Surprisingly I found many open ports like http:80, https:443, and ...
34
votes
7answers
9k views
Is BASIC-Auth secure if done over HTTPS?
I'm making a REST-API and it's straight forward to do BASIC auth login. Then let HTTPS secure the connection so the password is protected when the api is used.
Can this be considered secure?
29
votes
9answers
1k views
Use additional “password” in Referer to hide private site?
I have a private (= I'm the only user) site at example.com/private/. Nothing else is published at this host (it's my domain).
I don't want anyone to know that there is anything at example.com, ...
23
votes
5answers
1k views
Why is HTTPS not the default protocol?
Why is HTTP still commonly used, instead what I would believe much more secure HTTPS?
19
votes
4answers
1k views
Manually adding 's' to 'http'
I did a Wireshark capture of my login into a drupal-based website. The website does not use https. And so, quite obviously, I was able to capture my username and password in plain text by simply ...
19
votes
2answers
3k views
Why is it possible to sniff an HTTPS / SSL request?
I'm new to the realm of HTTP requests and security and all that good stuff, but from what I've read, if you want your requests and responses encrypted, use HTTPS and SSL, and you'll be good. Someone ...
18
votes
8answers
7k views
Can my company see what HTTPS sites I went to?
At work my company uses internet monitoring software (websense). I know if I visit a https ssl-encrypted site (such as https://secure.logmein.com) they can't see what I'm doing on the site since all ...
18
votes
4answers
1k views
Why aren't application downloads routinely done over HTTPS?
We all know we should be using SSL whenever we collect passwords or other sensitive information. SSL provides two main benefits:
Encryption: The data can't be read by a middle-man while in transit.
...
16
votes
4answers
309 views
Malicious Links that Respond to Browsers but not curl or wget
There are some emails with links to people's cracked websites with a malware download
Like this kind of email:
fake DHL pack station email
... the links often take the form of:
http:// ...
16
votes
2answers
1k views
Which HTTP status codes are interesting from a security point of view?
I'm looking to extract interesting information from webserver logs and I wonder which HTTP status codes should I filter out?
For example, 200 hits can be considered to be 'regular behavior' whereas ...
15
votes
4answers
543 views
Credit card forms on HTTP pages a MITM risk?
The other day, there was a web developer mailing list thread about a fundraiser page.
One person noted that the page with the credit card form was HTTP, not HTTPS.
In response, one person said that ...
15
votes
8answers
827 views
Ways to secure yourself from Firesheep kiddies and other sniffing
Just a few days ago I had my first encounter with Firesheep. Luckily I was the one using it. Well, it scared me into looking for ways to secure myself. So I have two questions:
In exactly what ...
15
votes
3answers
458 views
Vulnerable code suggested on OWASP?
Session Hijacking Prevention
It is good practice to bind sessions to IP addresses, that would prevent most session hijacking scenarios (but not all), however some users might use anonymity ...
14
votes
1answer
937 views
Does the practice of blocking an off-site “Referer:” HTTP requests improve website security?
Is there any benefit for a security-paranoid website to disallow HTTP requests that have a Referer: from 3rd party sites?
The pitch is that if such a HTTP request were to come in, then certain XSS ...
12
votes
6answers
2k views
How does a server obtain the IP Address of a user?
How does a server obtain the IP Address of a user? Is it possible to fool the server by spoofing the IP Address?
12
votes
1answer
304 views
Meaningless http request
We've been logging GET requests on our domain to the following:
XX/YY/ZZ/CI/MGPGHGPGPFGHCDPFGGHGFHBGCHEGPFHHGG
This has no meaning on our site. A search on the web revealed no information, but a few ...
12
votes
1answer
158 views
What is a “Trailing Host Header”, and how can I test for it?
My team's been doing some research into WAF protections based upon a WAF testing tool released at Black Hat this year. In the tool, there's a list of hostname evasion tests - that are really just an ...
12
votes
2answers
2k views
How to exploit HTTP Methods
Many security scanners like nikto, nessus, nmap, and w3af sometimes show that certain HTTP Methods like HEAD, GET, POST, PUT, DELETE, TRACE, OPTIONS, CONNECT, etc are vulnerable to attack.
What do ...
11
votes
3answers
1k views
How can I prevent tracking by ETAGs?
An ETAG is a HTTP header that is sent-behind-the-scenes between a web browser and an web server. This value is intended to control how long a particular file is cached on the client side.
There is ...
10
votes
6answers
1k views
Security review: “HTTP header user-agent has been set to (something)”
We got a security review done of our PHP code and they team advised this in their report (amongst other things):
/appdir/
Details
The HTTP header user-agent has been set to \" .
Request
GET ...
10
votes
1answer
2k views
My understanding of how HTTPS works (gmail for example)
I want to ask if my below understanding is correct or not regarding the HTTPS used for the webpage we are visiting.
I will use Gmail as an example:
My laptop tries to connect to the Gmail server ...
10
votes
2answers
687 views
What is the point of the same-domain rule for xmlhttprequest when script tags/JSONP can cross domains?
I get that I don't want a page loaded from stackoverflow.com to be able to request gmail.com on my behalf and read my email--but this seems to be simply a cookie issue.
Since JSONP bypasses ...
9
votes
2answers
2k views
Are there any statistics about webservers and browsers TLS support?
From Hackers break SSL encryption used by millions of sites:
The vulnerability resides in versions 1.0 and earlier of TLS, or transport layer security, the successor to the secure sockets layer ...
8
votes
9answers
340 views
What is the proper way to view the sourcecode of a website?
I recently heard that Firefox makes a second HTTP request when the sourcecode is requested. Is this true?
Does this mean the webserver may issue alternate source from the original?
Lastly, is ...
8
votes
4answers
463 views
How secure is HTTP / HTTPS over 3G?
Suppose I log into a website, such as Twitter, from a 3G-enabled smartphone or similar device. How secure is this from interception? Can someone steal my password or login?
What if I use HTTPS? What ...
8
votes
4answers
378 views
Can URLs be sniffed when using SSL? [duplicate]
I know that http requests can be sniffed, so sniffer can see the requested URL from the victim. So 2 days ago I my bank made me a web-account to see, send money etc...
The thing I saw is my session ...
8
votes
5answers
513 views
Apache/Linux server, DoS attack from own IP
I have an unusual problem I've been trying to diagnose for a while:
It's about a Debian server running a custom compile of apache 2.2 with PHP, Red5, MySQL 5.5 (standard binary), sendmail (distro ...
8
votes
2answers
184 views
User-specific Subdomains : JavaScript security
If I provide a public-facing website for users on my website at their own subdomain (e.g. bob.myapp.com) under their own control, can I allow them to execute arbitrary JavaScript without putting my ...
7
votes
2answers
531 views
Strange request URI with lot of + (spaces) and “chosen nickname”
Over the last six months or so (after publishing a certain article) my site has being pestered with a number of requests URIs that follow this pattern:
...
7
votes
4answers
1k views
Where does SSL encryption take place?
I checked the data transmission of an HTTPS website (gmail.com) using Firebug. But I can't see any encryption to my submitted data (username and password). Where does SSL encryption take place?
7
votes
2answers
444 views
When are HTTP session cookies at risk over Wi-Fi?
If I'm using websites that do not use HTTPS, but I'm on a WEP-protected Wi-Fi network, are my cookies safe from being sniffed by third-parties?
Are cookies only at risk during login, or am I at risk ...
7
votes
2answers
84 views
Can other customers on shared hosting see requests from/to my site?
I installed a wiki on my shared webhosting (using Apache) account. This wiki is set to private (no read/edit/create rights for unauthorized users) and I'm the only one with an account.
The wiki ...
7
votes
5answers
776 views
Websites that interactively test browser security (XSS, CSRF, Javascript, etc)
I'm looking for a comprehensive list of browser test sites so that I can visually prove that the browser is patched and configured for safe web browsing. My intent is to know what risks may exist ...
7
votes
2answers
415 views
What is the HTTP “Server” response-header field used for?
It was not until recently that I began to question the use for the Server field in the HTTP Response-Header.
I did some research:
RFC 2616 states:
14.38 Server
The Server response-header ...
6
votes
7answers
831 views
What chars should I not allow in passwords?
I am planning to develop a website that require that the users register a username and a password. When I let the user choose a password, what chars should I allow the users to have in the password? ...
6
votes
7answers
531 views
Should I prevent sending of GET requests for urls that are normally operated with POST request?
There is an url that is normally operated using POST requests (i.e. POST request is sent when user submits form). But attacker can form GET request with parameters that are sent in POST request. This ...
6
votes
5answers
2k views
Can I block based on Mac Address?
Incase of dynamic IP's the hacker can work around by taking a new IP or use a Proxy, is it possible to make a ban based on Mac Address ?
I want to block at the Webserver level so that unwanted users ...
6
votes
2answers
721 views
Why does HTTP Basic authentication encode the username and password with base64?
RFC 2617 requires that in HTTP Basic authentication, the username and password must be encoded with base64.
To receive authorization, the client sends the userid and password,
separated by a ...
6
votes
3answers
284 views
What sort of delay will deter a robot from crawling my site?
I use what I believe is the standard method of identifying bad bots that do not respect my robots.txt (i.e. disallowing crawling the bad-bots subdirectory, then logging those who still go there).
So ...
6
votes
2answers
504 views
GET with additional parameters leads to “code injection” in html displayed
We got a security review done of our PHP code and the security company sent this in their report:
Request
GET ...
6
votes
2answers
122 views
HTTP daemon and Webroot permissions
We have a contracted web developer that uses deployment scripts to update and deploy web sites. In order for them to work they require write access to the whole webroot through the httpd user.
I have ...
6
votes
2answers
809 views
Is it possible to do HTTP header injection if CR/LF are stripped?
In HTTP response there is the following header with attacker controlled content:
Content-Disposition:attachment; filename="attacker_controlled.html"
The only characters that can't appear in ...
6
votes
2answers
205 views
An adequate message authentication code for REST
My REST service currently uses SCRAM authentication to issue tokens for callers and users.
Tokens issued by the SCRAM exchange have an expiry time after which a repeated sign-in is required. We also ...
6
votes
1answer
584 views
ASP.NET HTTP Response Splitting Attack
By default ASP.NET checks for HTTP Response Splitting attack when you do Response.Redirect:
...
6
votes
1answer
343 views
Strict Transport Security — max_age value
I've been wondering what max-age should the HTTP Strict Transport Security header have.
Both paypal and lastpass sites leave it very low: 500 (seconds = bit over 8 minutes)
market.android.com has it ...
6
votes
1answer
76 views
Are there any situations when one can only mount a passive MITM?
This came up while discussing Web & insecure HTTP - Using RSA for encrypting passwords on the client side
Is there any such situation possible when requesting an HTTP page where an attacker is ...
6
votes
1answer
382 views
Inconsistencies found in OpenID Provider's HTTP Headers. Which one is the most secure that I should imitate in my STS, and Relying Party?
I'm comparing the HTTP headers of the various providers (LiveID, Google, Yahoo, etc) and notice a broad inconsistency in implementation on the sign in page, sign out page, and subsequent pages.
...
6
votes
1answer
238 views
Do I need to keep the NTLM token in the HTTP Authorization header a secret?
I'm troubleshooting a problem with one of our vendors and plan to send them a Fiddler trace of the http traffic between the client and our servers while replicating the issue.
Our servers use NTLM ...
5
votes
3answers
223 views
Is it possible to “protect” against MITM attacks over HTTP?
In a conversation on twitter I warned a site about a security vulnerability. Specifically, the possibility of a MITM (Man in the Middle) attack used to compromise their registration form.
The ...
5
votes
4answers
3k views
How do the processes for digital certificates, signatures and ssl work?
I have been trying to understand how ssl works. Instead of Alice and Bob, lets consider client and server communication.
Server has a digital certificate acquired from a CA. It also has public and ...
