Tag Info

New answers tagged

3

Update May 2015: Facebook now uses HSTS. Good work. $ http -h get https://www.facebook.com Strict-Transport-Security: max-age=15552000; preload See also https://www.ssllabs.com/ssltest/analyze.html?d=facebook.com


3

It is true that bearer tokens and session tokens should not be passed int he url. The reasons are (according to OWASP): might disclose the session ID (in web links and logs, web browser history and bookmarks, the Referer header or search engines) In this specific case, I think Facebook did not care since the usage is logout - so after it has been ...


1

It may depend on how your certificate is installed. If your client doesn't recognize your certificate, then there's your problem. Go read up on how certificates work to understand what's happening here. If your certificate is installed as a globally-trusted root CA, then the browser will assume that a public CA is behaving badly again, and won't let the ...


2

These sites set the HSTS header (HTTP Strict Transport Security). If you have visited these site without the Burp proxy before, your browser knows (cached) the HSTS policy and sees a mismatch. The HSTS Policy specifies a period of time during which the user shall access the server in a secure-only fashion. HTTP Strict Transport Security (HSTS) is a web ...


3

I would recommend using Fiddler for this instead. First you will need to MITM yourself though as Facebook sends this request over HTTPS. You can do this in fiddler by going to Tools -> Fiddler Options -> HTTPS and ticking: Capture HTTPS Connects Decrypt HTTPS Traffic Then you will see a scary warning, as shown below: Clicking Yes will install an ...


9

As you guessed, Facebook uses HTTPS, what that means is that requests to Facebook.com regardless of whether they are GET or POST requests are not sent over HTTP, instead they are sent over HTTPS in an encrypted form which the 'http' filter in Wireshark wont be able to display as regular HTTP requests. If you want to view the encrypted HTTPS traffic including ...



Top 50 recent answers are included