Hot answers tagged

12

Thanks Alexandar O'Mara for pointing me in the right direction - it was a small tip, but it got me there. I ran nslookup with the domains and got: C:\Users\xxx>nslookup scorecardresearch.com Server: router.asus.com Address: 192.168.56.1 Name: scorecardresearch.com Address: 103.16.230.165 C:\Users\xxx>nslookup sb.scorecardresearch.com Server: ...


4

Is it possible to perform MITM on HTTP POST? HTTP is not encrypted, so if you "get in the middle" you can read the communication and modify it. You can get in the middle by e.g. hacking a router or cutting a cable. Your ISP is already in the middle and can read your HTTP communication. This is true for all HTTP methods - POST, GET, etc. Is it possible to ...


4

The firewall installed at my college's router allows me to surf the internet but never allows me to download any package that has a size more than 100mb. I wonder how exactly does it differentiate between the two. According to my concept, they're both a flow of http packets so they should not be differentiable. I presume they are intercepting your traffic ...


4

SSLstrip works by replacing HTTPS links in web pages returned by the server with HTTP links. This happens during a standard HTTP request, response exchange. While the initial HTTPS call isn't encrypted, it is part of the TLS handshake and is definitely not standard HTTP requests. The TLS handshake can only result in a TLS connection or a connection failure. ...


4

For testing and developing I allowed all Headers. ... It is not very clear what you mean here (maybe be more specific and do not only dump the config) but... Header set Access-Control-Allow-Origin "*" Header set Access-Control-Allow-Credentials "true" It is definitely not a good idea to allow cross origin access from everywhere. And it ...


4

Google is an external service, connecting into your server. A web server's firewall will normally be configured to allow this. You are trying to connect out from your server, which may well be blocked, since most web servers don't need that ability. You don't need it, for example, to include a Twitter feed (that's client side loaded), to upload files to your ...


3

HPKP could be used for tracking in big scale since it has report URIs: Send HPKP header with includeSubdomains set and a report-uri with unique random generated parameter. Embed a hidden image from a subdomain that uses a invalid/not pinned certificate. Browser calls report-uri with unique parameter. Only issue I see is a new report-uri with new UID ...


2

I don't see how there could possibly be a security risk or other vulnerability as a result of implementing the feature you suggest. The reason is simple: since there is no security risk or other vulnerability to not having a CAPTCHA in the first place (with the possible exception of a DOS attack if the action the CAPTCHA protects is a slow action), any ...


1

Command line tools shouldn't be vulnerable to POODLE. The reason is that POODLE is a cross-domain attack where the attacker can send cross-origin requests to the vulnerable endpoint and then use their Man-in-the-Middle/eavesdropper position to read cookie data sent with the request. An attacker can run Javascript in any origin in a browser and cause ...


1

I would start by finding out which SSL library it is using. I wouldn't be surprised if it used (maybe embedded) an old openssl version, in which case there would be a number of vulnerabilities to take into account that could be easily extracted, not just poodle. As pointed out by schroeder, you could launch a webserver that doesn't speak anything newer ...


1

Why SourceForge's administrators block my web by a firewall? The answer on StackOverflow explains it all really. Previously, SourceForge allowed outgoing requests and this was abused, so they no longer allow it. Why Google can get some data from my website, as HTML page, easily? Because Google is not behind SourceForge's firewall (obviously) and ...


1

This situation would not be possible in the first place. The certificate authority must verify that the person requesting a certificate for example.com actually owns example.com before issuing a certificate. If A is the owner of example.com, then B obviously isn't, assuming they are independent entities.


1

It may be possible to view HttpOnly cookie values during an XSS attack. Also known as, Cross-Site Tracing (https://www.owasp.org/index.php/Cross_Site_Tracing). Attack scenario Prerequisites: The site is vulnerable to XSS. Session cookies have the HttpOnly flag set so JavaScript (XSS) can not read the cookie. XSS and page that echos HTTP request on same ...


1

It may be possible to use this to craft malicious cookies for the website or to send insecure security headers in order to disable framing protection, open the cross domain policy or downgrade or disable cross site scripting protection, which would be very helpful when executing clicjacking, csrf or cross site scripting attacks. The effectiveness of this ...


1

There is a vulnerability called HTTP Response Splitting that may be exploitable, depending on whether newline characters are filtered out.



Only top voted, non community-wiki answers of a minimum length are eligible