New answers tagged

4

Is it possible to perform MITM on HTTP POST? HTTP is not encrypted, so if you "get in the middle" you can read the communication and modify it. You can get in the middle by e.g. hacking a router or cutting a cable. Your ISP is already in the middle and can read your HTTP communication. This is true for all HTTP methods - POST, GET, etc. Is it possible to ...


0

If there is a Reverse Proxy Cache in front of this server this could easily lead to cache poisoning attacks. You could build the query with some response headers automatically stored in the cached response like: Content-Security-Policy headers Set-Cookie headers (but usually caches removes theses headers) Transfer-encoding or Content-Length could help ...


0

Instead of trying to fine-tune the behavior of CAPTCHAs on a form, consider that most users hate CAPTCHAs and you should look instead to solve the problem you are really trying to solve. Perhaps you can eliminate the CAPTCHAs entirely, which would make your users much happier than slightly less confusing CAPTCHA behavior. CAPTCHAs are primarily used to ...


2

I don't see how there could possibly be a security risk or other vulnerability as a result of implementing the feature you suggest. The reason is simple: since there is no security risk or other vulnerability to not having a CAPTCHA in the first place (with the possible exception of a DOS attack if the action the CAPTCHA protects is a slow action), any ...


1

Command line tools shouldn't be vulnerable to POODLE. The reason is that POODLE is a cross-domain attack where the attacker can send cross-origin requests to the vulnerable endpoint and then use their Man-in-the-Middle/eavesdropper position to read cookie data sent with the request. An attacker can run Javascript in any origin in a browser and cause ...


1

I would start by finding out which SSL library it is using. I wouldn't be surprised if it used (maybe embedded) an old openssl version, in which case there would be a number of vulnerabilities to take into account that could be easily extracted, not just poodle. As pointed out by schroeder, you could launch a webserver that doesn't speak anything newer ...


12

Thanks Alexandar O'Mara for pointing me in the right direction - it was a small tip, but it got me there. I ran nslookup with the domains and got: C:\Users\xxx>nslookup scorecardresearch.com Server: router.asus.com Address: 192.168.56.1 Name: scorecardresearch.com Address: 103.16.230.165 C:\Users\xxx>nslookup sb.scorecardresearch.com Server: ...


4

For testing and developing I allowed all Headers. ... It is not very clear what you mean here (maybe be more specific and do not only dump the config) but... Header set Access-Control-Allow-Origin "*" Header set Access-Control-Allow-Credentials "true" It is definitely not a good idea to allow cross origin access from everywhere. And it ...


0

Although Fluffy and Matthew both suggest that the reason for the policy is to prevent abuse of SourceForge's services, implying that someone with legitimate access to the content would abuse that privilege, it's also worth noting that it also provides protection for your content / site. If your site has an file injection/inclusion vulnerability, such as... ...


1

Why SourceForge's administrators block my web by a firewall? The answer on StackOverflow explains it all really. Previously, SourceForge allowed outgoing requests and this was abused, so they no longer allow it. Why Google can get some data from my website, as HTML page, easily? Because Google is not behind SourceForge's firewall (obviously) and ...


4

Google is an external service, connecting into your server. A web server's firewall will normally be configured to allow this. You are trying to connect out from your server, which may well be blocked, since most web servers don't need that ability. You don't need it, for example, to include a Twitter feed (that's client side loaded), to upload files to your ...


3

HPKP could be used for tracking in big scale since it has report URIs: Send HPKP header with includeSubdomains set and a report-uri with unique random generated parameter. Embed a hidden image from a subdomain that uses a invalid/not pinned certificate. Browser calls report-uri with unique parameter. Only issue I see is a new report-uri with new UID ...


1

This situation would not be possible in the first place. The certificate authority must verify that the person requesting a certificate for example.com actually owns example.com before issuing a certificate. If A is the owner of example.com, then B obviously isn't, assuming they are independent entities.


0

This question at Stack Overflow is nominally asking the same thing. You can use the URL Rewrite module to do your filtering by adding a condition around the {HTTP_X_FORWARDED_FOR} variable as described in this answer. Alternatively, the other answer describes a method by which you can set the IP address back to its pre-proxy value with a global rewrite ...


1

It may be possible to view HttpOnly cookie values during an XSS attack. Also known as, Cross-Site Tracing (https://www.owasp.org/index.php/Cross_Site_Tracing). Attack scenario Prerequisites: The site is vulnerable to XSS. Session cookies have the HttpOnly flag set so JavaScript (XSS) can not read the cookie. XSS and page that echos HTTP request on same ...


0

It's possible to spoof the destination IP, so when the server sends the TCP/IP payload, it goes to the SPOOF IP, and not your computer. You can also do this in the process of a MiTM attack, so you can change the payload before it's sent, and have it processed on the other computer. Or even the server it's self, which is illegal. IP Spoofing it's self is ...


0

Distinguishing header from content is usually not the hardest part of cryptanalysis. This is because headers usually come with a specific structure, common length range and limited value variety. Yes, SSL/TLS is leaking length details which might be used for multiple classes of attacks. In some cases an attacker might be even able to determine content ...


1

It may be possible to use this to craft malicious cookies for the website or to send insecure security headers in order to disable framing protection, open the cross domain policy or downgrade or disable cross site scripting protection, which would be very helpful when executing clicjacking, csrf or cross site scripting attacks. The effectiveness of this ...


1

There is a vulnerability called HTTP Response Splitting that may be exploitable, depending on whether newline characters are filtered out.


4

The firewall installed at my college's router allows me to surf the internet but never allows me to download any package that has a size more than 100mb. I wonder how exactly does it differentiate between the two. According to my concept, they're both a flow of http packets so they should not be differentiable. I presume they are intercepting your traffic ...


4

SSLstrip works by replacing HTTPS links in web pages returned by the server with HTTP links. This happens during a standard HTTP request, response exchange. While the initial HTTPS call isn't encrypted, it is part of the TLS handshake and is definitely not standard HTTP requests. The TLS handshake can only result in a TLS connection or a connection failure. ...



Top 50 recent answers are included