Tag Info

New answers tagged

1

When I hear this question, my first response is don't. If you are at all concerned about your personal network and your personal data, don't expose any part of it directly to the internet by hosting services. If you feel you must, here are some steps: Host the website on an entirely separate machine with nothing else on it Put that machine on a DMZ (most ...


-1

Imagine, that your company has some CRM, which has "friendly" (suggestive) urls. And imagine, that employees click on embedded links. Now, everyone with access to logs of linked domains can see your referers: crm.internal/list-of-customers-to-block-if-no-purchase.php crm.internal/list-of-customers-with-stupid-annoying-and-problematic-representatives.php ...


6

site is only available in HTTPS HSTS in this case at least notifies that browser that the site will not be available in HTTP for the foreseeable future. Once the browser knows this (i.e. after the first visit) a downgrade attack like sslstrip will fail, because the browser will not connect with insecure HTTP to the site. The secure flag for cookies ...


6

How exactly is this protecting against a malicious DNS routing? Not at all. If an evil guy has a valid certificate (e.g. from a hacking a CA) and then manages to man-in-the-middle you, then your connection is hacked. I was expecting a challenge response using the public key of the server, but I cannot find it. In order to do this you would have ...


0

There are settings in Burp for not intercepting certain file types (like .jpeg, .css). I bet if you looked in the option tab of the proxy tool, you have .js as one of the skipped file types. If the page is requesting the results from a .js file, this would not be intercepted. In this image you can see the options for not intercepting certain extensions: ...


1

Are you intercepting all requests or just "in scope" requests? Could it be that the logic in the JavaScript code tries another domain if it does not get a timely response - one you are not intercepting. Another possibility is that there's a client-side cache of responses that is accessed if a timeout elapses. Maybe Burp Intercept is causing the timeout so ...


-1

why do I not get a https redirect in the first 302 reply Bad programming on the part of of whoever designed the system - bobbing out of https makes it trivial to carry out a MITM attack on the connection. How can I get it to connect to the next server in the chain leading to the final one Use a better program. HTTP is deceptively complex. You can ...


2

How to reproduce the same? There are multiple answers on this site for exactly that question. Typing HTTP method into the Search box pulls up: How to exploit HTTP Methods How to identify the HTTP methods supported by a web server? Testing for HTTP TRACE method How can I test that I have correctly disabled unnecessary HTTP methods? How ...


4

The point of difference between using HTTP Authentication vs Application specific authentication is where you want the authentication and authorization logic to be handled. HTTP Authentication means that the HTTP layer (apache, nginx, IIS, etc) will responsible for maintaining authentication. Application authorization means that the web application (java, ...


3

I like to tell people "HTTP Basic Auth is deprecated, don't use it!" in favor of forms-based authentication. However, over SSL it is indeed secure in transit and not vulnerable to easy interception. On the browser level, forms-based authentication tends to be more secure. For an android app using a REST api, I would recommend a token-based system. ...


3

Facebook achieves this with a HTTP Strict Transport Security (HSTS) policy. This is delivered over HTTPS and informs the browser to automatically "rewrite" HTTP requests to HTTPS for that domain. The max-age parameter specifies how long the browser will honour the policy for. It is also possible to list your site in the HSTS preload list. This list is ...



Top 50 recent answers are included