Tag Info

Hot answers tagged

26

If a website does not use a custom built server to modify the HTTP headers, you can try by examining the order of arrangement in the HTTP response fields. From OWASP: Apache 1.3.23 server: HTTP/1.1 200 OK Date: ... Server: ... Last-Modified: ... ETag: ... Accept-Ranges: bytes Content-Length: ... Connection: ... Content-Type: text/HTML Microsoft IIS ...


7

You can try looking if you can get the server to display a native error page. Error pages can be customized by a web developer, but when they aren't, they often reveal a lot of information about the web server. For example, this is the 404 Not Found error page of Apache 2.2.4 running on Unix: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> ...


6

Per RFC2616, the OPTIONS method should return the supported methods. Keyword is should since this isn't always the case. As the prior posts have already pointed out each method needs to be tested separately to be sure.


6

As there are only few methods (OPTIONS, GET, HEAD, POST, PUT, DELETE, TRACE and CONNECT), you can use a script and nc to send a request to all allowed methods and parse the results: for method in OPTIONS GET HEAD POST PUT DELETE TRACE CONNECT ; do echo -e "\n\nTrying $method\n\n" echo -e "$method / HTTP/1.1\nHost: server-hostname\nConnection: ...


5

The only way to identify the methods supported by a web server is to try each one and evaluate the response to determine if it indicates the method is supported or not. You can't simply query to ask which methods it supports; it won't give you a list. That said, there are better tools than nc. Nmap and metasploit both support HTTP method scanning and ...


5

You cannot trust the client, ever. A malicious user may abuse legitimate client software (theirs, or someone else's) An attacker may reverse engineer enough of the API to pretend to be a legitimate client Instead of trusting the client, work to ensure that the client's input is trustworthy. input validation input sanitization schema compliance velocity ...


4

Redirection the user after a successful login is common in the most webapps. For instance when the user try to access the dashboard directly within its url, the system keeps the requested url and brings the user to the login page, after user signed in he is redirected to the dashboard not the homepage or something.


3

The security differences between an HTTP and HTTPS proxies varies depending on what you are routing through them: Clear text (ftp, telnet, HTTP): If the proxy is HTTP, the traffic is transmitted in clear text between your computer and the proxy, and clear text between the proxy and the final destination. If the proxy is HTTPS, the traffic is encrypted ...


3

No, you can't conclude that from the 403 error. If the server returns a 403 error for a directory, that just means you aren't allowed to list the directory contents, or that the directory has an index page that you aren't allowed to access; this is very common for cgi-bin directories. You can, however, conclude that you are not vulnerable because there are ...


3

The url encodes a Windows Codepage 1251 encoded string, containing (harmless) russian error messages. The transcoded url is: /767/browser-wars-side-show-how-natty-handles-the-load/+++++++++[+Активация+]+Result: использован никнейм "azazalolxd"; вошли; не нашлось формы для отправки; Google translator gives: [ activation ] Result: used the nickname ...


2

The operation performed is similar to server authentication with the following differences. After sending the message ServerKeyExchange, the server indicates to the client that it wishes to authenticate the client via a CertificateRequest message; the client then sends its certificate. The TLS handshake operation is performed normally but after sending the ...


2

I'm answering my own questions but for future seekers, I found this great article: http://www.thebuzzmedia.com/designing-a-secure-rest-api-without-oauth-authentication. Maybe I didn't explain my question well but this was the answer I was looking for. -- UPDATE -- Rory Alsop, asked to post a summary. You should definitely read the source. But in case you ...


1

10000 outstanding requests in a single HTTP connection is certainly evidence that something has gone wrong. There are three likely possibilities here: The server has partially crashed, such that it is accepting requests but no longer processing them. The client is sending requests faster than the server can process them. Something has changed in the ...


1

There are circumstances where a HTTP server will return a list of supported methods for a given resource in its Allow response header, according to RFC 7231 (the new RFC for HTTP 1.1 semantics): First in the response to an OPTIONS request, either on a specific resource path, or on the special * path (which would mainly describe the capabilities of the ...


1

TOTP is an HMAC. It just happens to be an HMAC of a timestamp with some granularity where the passwords need to be rotated. Note that with either a time-based HMAC or some other HMAC, an attacker with a copy of a legitimate client can extract the shared key and use that key to forge requests from their client.



Only top voted, non community-wiki answers of a minimum length are eligible