Hot answers tagged

29

HEAD is not dangerous in itself, and it does have legitimate uses. The problem is with Java EE. It has a way to set security constraints using web.xml files - but those are only applied to GET and POST, not to HEAD. This means that it is can be possible to bypass authentication using HEAD. There is more information about this and other issues in this paper ...


7

There is no technical reason to limit HTTP/2 to TLS. Communication without TLS has its technical use, no matter if this is unencrypted traffic or if the traffic is encrypted by other means (VPN etc). Restricting HTTP/2 to TLS in the standard would bind the use of the HTTP/2 protocol to the use of TLS for political(*) reasons only. Such bindings for ...


6

... it sort of suggests the entire site must be https to be truly secure from these types of attacks? Yes, that is exactly the case. All relevant pages on this site (i.e. all in the path to submitting the sensitive information) must be https only, i.e. it should not even be possible to access these pages with http because otherwise tools like sslstrip ...


6

@John already descriped the passing of the password over the network very well (use HTTPS). To answer your question: Where should I hash them? Frontend or Backend? The backend. If you only hash them in the frontend, you are vulnerable to a pass the hash attack. The reason that you hash passwords in your database is to prevent an attacker who ...


5

Refer to the guidelines set up by the CA/Browser forum for extended validation. 8.5.1 General The CA MAY only issue EV Certificates to Applicants that meet the Private Organization, Government Entity,Business Entity and Non-Commercial Entity requirements specified below. 8.5.2 Private Organization Subjects An Applicant qualifies as a ...


5

You are confusing two things: transport security and database security. HTTPS using TLS only protects the transportation of the data from the client to the server. This means an eavesdropper does not know what client and server are sending each other (simplified). The storing of passwords is an entirely different topic. You want to make sure, that even if ...


4

No. It is trivial to change the value of the host header, but, depending on your server set up, this may cause the site not to work as intended. In particular, if you are using name based virtual hosts, the web server will look at the host header to determine which site (of many) to load, and (usually) default to the first defined one if it doesn't ...


4

Sounds like you mean 403 forbidden, not 401 unauthorized (since you say authorized access, not authentication). This source explains it in better detail: Daniel Irvine 401 Unauthorized, the HTTP status code for authentication errors. And that’s just it: it’s for authentication, not authorization. Receiving a 401 response is the server telling you, “you ...


4

Metasploit's http_login module doesn't support arbitrary HTTP headers. If the site only responds with the XHR header included, then you might want to use a more versatile tool like hydra. # indicates the beginning of the URI fragment. This isn't a part of the URI used for logins, but is typically used to pass options to the front-end web framework.


4

You can't, at least not until mobile OS developers stop prioritizing UX over security. For now the best you can do is to make sure the app you're using is from a legitimate and trusted developer, and the credentials it's asking for are related to the function of the app (a photo app asking for Instagram credentials to post on it seems alright, but the same ...


3

Several firewalls (or IDS, IPS, UTM, NGFW - whatever you call them) have limits on the length of content they analyze for malware (usually around 10MB, but sometimes even lower). Some include the length of the HTTP header into this computation. In this case the analysis of the HTTP body (containing the malware) can be bypassed when the HTTP header is already ...


3

[Disclaimer: I'm one of the mitmproxy authors. My opinions may be biased. :)] sslsplit sslsplit is a transparent proxy that can intercept TLS connections using a man-in-the-middle attack. sslsplit supports plain TCP, TLS and also HTTP to the extent that it removes HPKP, HSTS and Alternate Protocol response headers. Intercepted connections can be dumped ...


3

OWASP defines Information Leakage as a vulnerability, so the debate is really on whether or not the specific version information should be classified as "Information Leakage". As @Oasiscircle mentions, this information can be used as a starting point for attackers who know of specific vulnerabilities associated with specific versions. We know attackers use ...


3

tim is right. The exploit uses %0D%0A%20, which is URL-decoded to CR + LF + SPACE and thanks to the extra space could bypass the response splitting protection in some browsers. There was once a feature called line folding, that allowed HTTP headers to span over multiple lines by prepending every additional line with a space or tab. It was later dropped in ...


3

The host header will be the hostname of your web server, and is only used in HTTP requests by clients. It can not be used to validate if the source is authorized to upload images or not. I would develop a login mechanism to which users can authenticate (possibly with a directory service, as mentioned by Matthew) and if authorized, upload new pictures. Deny ...


2

HTTPS provides security for the transport layer only. It has nothing to do with the security mechanisms needed for the storage. You shouldn't crypt passwords. You should hash them, so you could not decrypt them later (nor an attacker). And the hash step is always done on the backend, since doing it on client-side would allow an attacker which got access to ...


2

You can set a cookie when the user requests watchvideo.php, containing a hash of values identifying the client, like user agent, IP address, and so: <?php $ip = $_SERVER['REMOTE_ADDR']; $browser = implode(':', $_SERVER['HTTP_USER_AGENT']); $userFingerprint = md5($browser . $ip); setcookie('userdata', $userFingerprint, time() + 10); //expires in 10 ...


2

Is this a security benefit It serves no real security purpose, but it serves a privacy purpose. By blocking the referrer then the sites you visit will not know what site you were previously on (maybe my visit to a clothing website was due to a link I found on a deviant sexual forum discussing how the clothing company has a sale on?). A lot of ...


2

Let's say that today a vulnerability got announced for all Microsoft IIS 7.5 servers with a small range of ASP Net versions. I'm a malicious attacker, and I want to figure out as many servers that I can exploit as possible before sysadmins patch up the vulnerability. Wouldn't it be a much easier problem to figure out if I could ask each individual server ...


1

Mandatory encryption presents at least one thing that non-encrypted communication doesn't. Truly encrypted communication (at least http over SSL) is impossible to cache and requires more bandwidth. Requiring SSL/TLS would limit the case for non-sensitive information from being cached by some intermediate proxy server. Encryption also has a cost. It adds ...


1

In kind of security you talk generally of 3 points: identification authentification authorization You are missing point 2/"never trust the client": You identify the client by the ID and give him the rights based on the ID sent from the client. Like you saw this fails because the client can lie. The most common solutions for authentification at websites ...


1

I assume you want to know if there is a way to execute the uploaded PHP file. Short Answer: No Long Anwser: As long as the web server is configured correctly only .php files gets executed as PHP. Most web servers will return as content type always the mime type derived from the file extension. The content itself of the HTTP response is typically the content ...


1

Using the PUT method, you can upload any file on the server. This can be used to perform Cross Site Scripting (XSS). Today, I have performed this attack, so replying here with my experience. How you do this is explained below. PUT /XSS.html HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT) Host: www.myblog.com Accept-Language: en-us ...


1

In your server returning not so much, you may have some software truncating or not working correctly, but there are few attack vectors using sending malformed/negative/crafted HTTP headers.. smuggling/splitting/poisoning .. you name it. You should be worried about receiving those.



Only top voted, non community-wiki answers of a minimum length are eligible