New answers tagged

0

It depends on the kind of authorization request by the proxy. If this is Basic Authentication the username are passwords are transferred in mostly clear (i.e. base64) and thus can be extracted by passively sniffing the connection. This is no longer true with Digest Authentication or NTLM, although in the latter case there are other attacks to reuse the ...


0

HTTP is an insecure protocol, and passwords can be sniffed over it. At best the username/password might be base64 encoded (base64 is not an encryption mechanism).


1

The HTTP RFC does not fix the header length but is at least stating: Various ad hoc limitations on request-line length are found in practice. It is RECOMMENDED that all HTTP senders and recipients support, at a minimum, request-line lengths of 8000 octets. That was for the frst line. For headers you have (bold added): HTTP does not place a ...


33

This looks similar to the poetry that was being sent out at the Chaos Communications Congress in Hamburg. In particular, it starts using the HEAD as part of the poetry (the example below uses DELETE to start the line). https://nakedsecurity.sophos.com/2016/01/07/millions-of-servers-infected-with-poem-inviting-them-to-jump-in-the-river/


50

I don't know what the REDACTED part consisted of, but I can tell you that the bytes \xf0\x9f\x90\x90 correspond to a picture of a goat in UTF-8: Here it is: 🐐 Note: On a whim, I also looked up the Intel opcodes corresponding to these byte values. They don't do anything interesting at all — 0x90 is NOP (does nothing), 0x9f is LAHF (load FLAGS into AH ...


1

Well say there was a new, serious vulnerability discovered in ASP.NET 4.0.30319. Attackers can easily find vulnerable servers by using a search engine like Shodan: https://www.shodan.io/search?query=X-AspNet-Version%3A4.0.30319 Hiding the information banners protect you from non-targeted attacks when an attacker just wants some servers to compromise for ...


4

[Disclaimer: I'm one of the mitmproxy authors. My opinions may be biased. :)] sslsplit sslsplit is a transparent proxy that can intercept TLS connections using a man-in-the-middle attack. sslsplit supports plain TCP, TLS and also HTTP to the extent that it removes HPKP, HSTS and Alternate Protocol response headers. Intercepted connections can be dumped ...


4

I'm generally dubious about the benefits - as @MarkBuffalo says, lots of attackers will try every attack they know on every server they find, whether it's likely to work or not (even to the extent of trying Windows specific attacks against systems reporting that they're running RHEL). However, it's not information you need to give out, so I am generally in ...


6

OWASP defines Information Leakage as a vulnerability, so the debate is really on whether or not the specific version information should be classified as "Information Leakage". As @Oasiscircle mentions, this information can be used as a starting point for attackers who know of specific vulnerabilities associated with specific versions. We know attackers use ...


4

Let's say that today a vulnerability got announced for all Microsoft IIS 7.5 servers with a small range of ASP Net versions. I'm a malicious attacker, and I want to figure out as many servers that I can exploit as possible before sysadmins patch up the vulnerability. Wouldn't it be a much easier problem to figure out if I could ask each individual server ...


0

It seems they are different tools which achieve the same result. They don't really break TLS though. Both tools just perform a MITM, initiate the TLS handshake to the server and then send the victim a HTTP page. So if the victim is aware he will notice a missing green key in his browser. To avoid these types of attacks, HSTS was invented which forces the ...


6

... it sort of suggests the entire site must be https to be truly secure from these types of attacks? Yes, that is exactly the case. All relevant pages on this site (i.e. all in the path to submitting the sensitive information) must be https only, i.e. it should not even be possible to access these pages with http because otherwise tools like sslstrip ...


2

Mandatory encryption presents at least one thing that non-encrypted communication doesn't. Truly encrypted communication (at least http over SSL) is impossible to cache and requires more bandwidth. Requiring SSL/TLS would limit the case for non-sensitive information from being cached by some intermediate proxy server. Encryption also has a cost. It adds ...


8

There is no technical reason to limit HTTP/2 to TLS. Communication without TLS has its technical use, no matter if this is unencrypted traffic or if the traffic is encrypted by other means (VPN etc). Restricting HTTP/2 to TLS in the standard would bind the use of the HTTP/2 protocol to the use of TLS for political(*) reasons only. Such bindings for ...


4

The host header will be the hostname of your web server, and is only used in HTTP requests by clients. It can not be used to validate if the source is authorized to upload images or not. I would develop a login mechanism to which users can authenticate (possibly with a directory service, as mentioned by Matthew) and if authorized, upload new pictures. Deny ...


5

No. It is trivial to change the value of the host header, but, depending on your server set up, this may cause the site not to work as intended. In particular, if you are using name based virtual hosts, the web server will look at the host header to determine which site (of many) to load, and (usually) default to the first defined one if it doesn't ...


2

You can set a cookie when the user requests watchvideo.php, containing a hash of values identifying the client, like user agent, IP address, and so: <?php $ip = $_SERVER['REMOTE_ADDR']; $browser = implode(':', $_SERVER['HTTP_USER_AGENT']); $userFingerprint = md5($browser . $ip); setcookie('userdata', $userFingerprint, time() + 10); //expires in 10 ...


30

HEAD is not dangerous in itself, and it does have legitimate uses. The problem is with Java EE. It has a way to set security constraints using web.xml files - but those are only applied to GET and POST, not to HEAD. This means that it is can be possible to bypass authentication using HEAD. There is more information about this and other issues in this paper ...


4

Metasploit's http_login module doesn't support arbitrary HTTP headers. If the site only responds with the XHR header included, then you might want to use a more versatile tool like hydra. # indicates the beginning of the URI fragment. This isn't a part of the URI used for logins, but is typically used to pass options to the front-end web framework.


4

You can't, at least not until mobile OS developers stop prioritizing UX over security. For now the best you can do is to make sure the app you're using is from a legitimate and trusted developer, and the credentials it's asking for are related to the function of the app (a photo app asking for Instagram credentials to post on it seems alright, but the same ...


2

Is this a security benefit It serves no real security purpose, but it serves a privacy purpose. By blocking the referrer then the sites you visit will not know what site you were previously on (maybe my visit to a clothing website was due to a link I found on a deviant sexual forum discussing how the clothing company has a sale on?). A lot of ...


1

In kind of security you talk generally of 3 points: identification authentification authorization You are missing point 2/"never trust the client": You identify the client by the ID and give him the rights based on the ID sent from the client. Like you saw this fails because the client can lie. The most common solutions for authentification at websites ...


2

I assume you want to know if there is a way to execute the uploaded PHP file. Short Answer: No Long Anwser: As long as the web server is configured correctly only .php files gets executed as PHP. Most web servers will return as content type always the mime type derived from the file extension. The content itself of the HTTP response is typically the content ...


0

HTTPS (HTTP over TLS/SSL) provides security over data in transit/data in motion it does NOT provide encryption on data at rest (Database, Files on a Hard Drive)-> Encrypted with AES, 3DES, BlowFish, etc. You can provide encryption on the Database, but not the whole database as this will eat up your resources (Encrypted Files are larger than Unencrypted). ...


6

@John already descriped the passing of the password over the network very well (use HTTPS). To answer your question: Where should I hash them? Frontend or Backend? The backend. If you only hash them in the frontend, you are vulnerable to a pass the hash attack. The reason that you hash passwords in your database is to prevent an attacker who ...


2

HTTPS provides security for the transport layer only. It has nothing to do with the security mechanisms needed for the storage. You shouldn't crypt passwords. You should hash them, so you could not decrypt them later (nor an attacker). And the hash step is always done on the backend, since doing it on client-side would allow an attacker which got access to ...


5

You are confusing two things: transport security and database security. HTTPS using TLS only protects the transportation of the data from the client to the server. This means an eavesdropper does not know what client and server are sending each other (simplified). The storing of passwords is an entirely different topic. You want to make sure, that even if ...


4

Sounds like you mean 403 forbidden, not 401 unauthorized (since you say authorized access, not authentication). This source explains it in better detail: Daniel Irvine 401 Unauthorized, the HTTP status code for authentication errors. And that’s just it: it’s for authentication, not authorization. Receiving a 401 response is the server telling you, “you ...


1

Using the PUT method, you can upload any file on the server. This can be used to perform Cross Site Scripting (XSS). Today, I have performed this attack, so replying here with my experience. How you do this is explained below. PUT /XSS.html HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT) Host: www.myblog.com Accept-Language: en-us ...



Top 50 recent answers are included