Tag Info

Hot answers tagged

22

The basic distinction is between a certificate verifying control of a domain, and a certificate verifying the real-world entity behind the domain. With a standard SSL certificate, all that's verified is that the entity with the certificate legitimately controls that domain. It doesn't mean that that's the entity I think it is; I could register ...


10

When you type the URL in your browser, the browser will mainly do two things with it: Resolve the host name to get the associated IP address to be contacted, this allow the browser to send the request to the right server, Put the host name which has been actually typed in the Host HTTP header, this allows the server to send an appropriate reply in case ...


5

CAs (Certificate Authorities) charge extra fees for the "shiny green boxes" because they lead website owners/operators to believe that if your site has the best "shiny green box" then your visitors will trust you more. This propaganda tactic has generally been working very well for Certificate Authorities as people really do believe that the bigger the green ...


3

Since GZBK covered why, I will cover the single simple solution to minimize this and related problems that I and others such as StevenC use. Make your first or default virtual host small fast and light, returning errors on all requests (I have been known to allow a basic css and related resources). This has the advantage of minimizing resource consumption, ...


3

You're so very close to the name of the Firefox/Iceweasel plugin you need with your question title! Tamperdata: https://addons.mozilla.org/en-us/firefox/addon/tamper-data/ You could also use one of the Web proxies shipped with Kali, OWASP-ZAP or Burp Suite. You may want to gloss over the manuals for these, but in general you start them up, aim your ...


2

as @GZBK said, this happens because for whatever reason, people are being sent to your server when they try to open those sites. This has happened to many others, and is likely the GFW doing its dirty thing. Here is a nice post about some other guy who had the same thing happen to him. You can use this site to check if the dns is pointed to your server.


2

When webmasters buy a SSL cert. They have the option to purchase extended validation certificates. For IE, it would turn the address bar green, in Chrome it would show a green box before the URL of the site. While some CA offer a higher level of insurance if their certificates are broken, the main point of showing that green bar is to provide the end user ...


2

One easy thing you may do is limiting maximum POST size, as well as upload max file size. For exemple, using PHP, you may tweak : post_max_size integer Sets max size of post data allowed. This setting also affects file upload. To upload large files, this value must be larger than upload_max_filesize. If memory limit is enabled by your configure ...


2

Basically, a man-in-the-middle attack could occur. If someone were to listen in on your users when they submit their username and password, that person would be able to retrieve their login credentials. Any decent network password sniffer could easily pull this off.


2

Any node at any point along the traffic can sniff the traffic, including all the ISPs along the way. The question, then, is what threats you wish to mitigate? If you what to protect against "small-time" attackers, then any point within the ISP's network is safer and you only have to worry about the ingress and egress points (server, client, local network ...


1

It can be done using netcat nc www.myhost.com 80 TRACE /mypage.html HTTP/1.1 Host: www.myhost.com An example of output is HTTP/1.1 405 Method Not Allowed Server: Apache-Coyote/1.1 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1 Set-Cookie: JSESSIONID=rfyji7QBFFld7HwMGLVM+F8s.undefined; Path=/ Content-Type: ...


1

Your biggest risk would be older versions of Internet Explorer that attempt to auto-detect the encoding as UTF-7 - called Codepage Sniffing. It appears that Internet Explorer will only do this for webpages, and not for AJAX requests. Therefore JSON requests should be safe. Moreover, JSON requests do not cause rendering of content directly to the page - they ...


1

In the most over-the-top case, somebody could alter the BGP routing between networks so that your traffic flows through their network. This happened to Youtube where all their addresses were routed to Pakistan: https://www.ripe.net/internet-coordination/news/industry-developments/youtube-hijacking-a-ripe-ncc-ris-case-study Combined with a listening effort, ...



Only top voted, non community-wiki answers of a minimum length are eligible