Questions tagged [header]
The header tag has no usage guidance.
97
questions
1
vote
2answers
57 views
Authorization Header in dev tools
My web application need to make call to 3rd party REST API which is protected by Basic authentication on some user click. We are planning to use a technical user for the call.
This will expose the ...
1
vote
1answer
40 views
Enabling HTTP Security headers in S/4 Hana web applications
We have 3-4 S/4 HANA applications in our environment and want to enable HTTP Security Headers, but couldn't figure out how to go about it. We then approached SAP directly and even their solutions are ...
0
votes
1answer
57 views
How to best limit SQL injection attacks that are being funneled through an Apache proxy I control
I use an Apache proxy to funnel traffic to an IIS server. The IIS server sends me emails if some bad actor attacks my site with an sql injection attack. It captures their IP address, and sends me the ...
0
votes
0answers
40 views
What happens if a sender changes the TCP window size over multiple packets that have the same ACK number?
I'm currently doing research on evasion attacks that seek to bypass a Deep-learning based Network Intrusion Detection System.
In order to achieve this, I need to know what the constraints are for the ...
0
votes
1answer
67 views
CSRF Bypass using User-Agent
This is an unconventional approach of CSRF that I came across while doing the pentest for an Android mobile application. The original request is as follows (NB: Values have been edited):
POST /edit/ ...
1
vote
1answer
47 views
Utility of HTTP headers for a REST API
Can somebody confirm me that the HTTP-XXS-protection header and the X-content-type header is useless in the case of a REST api who provide only json to clients ?
Can someone explain me why exaclty ?
...
0
votes
0answers
56 views
Adding Expect-CT header to HTTP response
In the security test report, I have a recommendation to add Expect-CT header to the HTTP response from web application, additionally developers set this to:
Expect-CT: max-age=0, report-uri=
I am ...
-1
votes
2answers
37 views
Is CSRF possible if i know the value of the authorization bearer token?
If i know the value of bearer token of the victim, can i generate a get csrf page and set a custom Autorization: Bearer [token] header?
1
vote
2answers
97 views
Sending token through GET vs POST
Looking for recommendations for security in sending token (e.g. JWT Token) through a GET vs POST request to the server.
There are two options:
Sending token through Headers as part of HTTP GET ...
0
votes
1answer
222 views
How to determine start and end bytes of LUKS header?
How can I determine the exact start byte and exact end byte of a LUKS header on a block storage device?
I use Linux Unified Key Setup (LUKS) for Full Disk Encryption (FDE), so all of the data on my ...
8
votes
2answers
422 views
Why does Chrome not allow the modification of these headers by extensions?
The Chrome WebRequests API mentions that specific request headers are not available to the onBeforeSendHeaders event, meaning that extensions cannot read and/or modify these headers. Here is an ...
12
votes
2answers
2k views
Secure HTTP Headers - where should be implemented, WAF or code level?
I have a REST API exposed to the Internet and another application with form-based authentication. These apps are behind a Web Application Firewall.
Question is, where I should implement the below ...
1
vote
1answer
331 views
Is there any way to pretend like we are routing our request via cloudflare? [closed]
There is this Web App which uses cloudflare and to bypass certain things I had to find a way to access the actual web server directly. I tried numerous things and finally I think I have found the ...
0
votes
2answers
205 views
Is it a security issue that Nginx returns server name in errors?
I have recently sat up an Nginx in a way that makes it not return a Server header and hide the version information from the error pages.
The error page looks like that now (and anyone can provoke it ...
0
votes
2answers
396 views
Why is it not possible to spoof referer and origin header with XHR?
Technically speaking, it is possible to spoof both headers using an intercepting proxy but that's useless because we are doing it ourselves as an attacker.
When we send an ajax request using JS from ...
2
votes
1answer
83 views
Is there any way to keep the request in intercepting proxy for atleast a min before application says check your connection?
I just bypassed SSL pinning on an android application but the problem is application won't let me play with the request on my intercepting proxy. It says something like problem with your network or ...
1
vote
1answer
74 views
Carrying two authorization tokens in a request
In my group we have been asked to implement an authentication-authorization flow in a new web portal that lives in a complex infrastructure.
For historical reason the initial authentication of each ...
1
vote
0answers
1k views
Implementation of Simple CSRF in Spring Boot and Angular 6 With Complete Solution
I am Implementing CSRF i.e Cross-Site Request Forgery in my project but not getting proper way to implement in my project and i am using Angular for FrontEnd and Java for BackEnd in Spring Boot and I ...
1
vote
1answer
74 views
Is there a security benefit to testing HTTP header presence with Javascript?
I have found in one of the client side libraries that it is performing an AJAX call to an API and checking if response contains all of the following headers with corresponding values (as a security ...
2
votes
1answer
59 views
Why we should not allow our pages to be loaded through Iframe by unknown hosts?
One of OWASP recomendations is to set the header X-Frame-Options to allow our pages to be loaded in Iframes only by sameorigin.
One reason is because of phishing attacks, ok I understand. But if I ...
0
votes
1answer
60 views
Referer value reflected in location response? [duplicate]
I found a login form on a website that redirects you regardless if the insert credentials are correct or wrong (302 redirect). I noticed that the value of the header Referer: is sent to header ...
1
vote
1answer
43 views
Is a CSRF required if no direct state change operations are performed?
I'm currently developing a webservice that sits in between other webservices. In the process of securing this webservice I've gotten a bit stuck on whether or not we neeed to require a CSRF token on ...
1
vote
0answers
43 views
'Hard-to-guess' custom header (or similar) to whitelist via a firewall
My organisation is adding a firewall to our test stacks, using AWS WAF. We'd like to whitelist all traffic from the SDKs we've built to facilitate requests between our services.
We thought of doing ...
1
vote
3answers
166 views
How to tell if an email source is spoofed?
I've received an email to my gmail account from FCMB, a bank in Nigeria (flashing warning lights already). It's not addressed to me (i.e., the email starts off "Dear Daniel," [not my name]). But the ...
1
vote
1answer
92 views
Is using default-src * safe?
I have a website to do security testing. The CSP is as follows.
default-src * ;
style-src 'self' 'unsafe-inline' data: https://netdna.bootstrapcdn.com/ http://s3.amazonaws.com/ https://s3.amazonaws....
0
votes
0answers
68 views
Is it secure to prevent CSRF in API without using CSRF cookie (only CSRF token sent in header of ajax requests)?
There is a standard method of preventing a CSRF attack by comparing a value in a special cookie (that is posted automatically with each request) and some value that is coming either in form post (from ...
0
votes
1answer
69 views
What should be header response of XSS vulnerability upon form submission?
We have a PHP web application and all of the user inputs are sanitized. We tested it within Burp tool and found no XSS vulnerabilities.
One of our security adviser tells us that when you type down ...
4
votes
1answer
3k views
CSP: What is script-src-attr and script-src-elem?
script-src-attr and script-src-elem directives are new additions in CSP3.
I am not able to understand how are they different from the script-src directive.
https://w3c.github.io/webappsec-csp/#...
1
vote
2answers
377 views
How to extract intresting data from malicious e-mail header
Premise: I know pretty well how SMTP works, and how to read an e-mail header. I know what all the main fieds mean, but I couldn't know what to look for if I want to know if the mail is kind of ...
1
vote
2answers
1k views
Flow of a host header injection attack?
I am new to this field and would like to know how the flow happens in a host header injection attacks.
I believe it's as below:
Client generates the request.
Attacker manipulates the request and ...
1
vote
2answers
264 views
How can I use Message-ID in header to screen (filter) Emails?
Recently started receiving torrent of spam emails immediately after ISP (Charter-Spectrum) switched to an upgraded Email system. Five of my ISP email addresses getting the same spam every day. Some ...
0
votes
1answer
911 views
Hiding the “Allow” http header that comes with the response after an 405 API call
Hi so our security team said that we need to hide the Allow header
Is the request possible?
1
vote
1answer
531 views
SOAP Web Service: Basic Auth. vs Password in xml
I am testing a SOAP web service and the service sends username and password in every request as part of the XML body over SSL. I wanted to object to that and offer Basic Auth. but could not find any ...
1
vote
2answers
902 views
How do web browsers detect XSS attempts when the X-XSS-Protection header is enabled?
Simple question but hard to understand how web browsers make the distinction between legitimate and malicious code when mode=block is enabled?
Of course, I would like to know how each rendering ...
2
votes
1answer
137 views
Should HTTP Security headers be configured for all servers?
I recognise the importance of configuring HTTP security headers (X-Frame-Options, X-XSS-Protection and X-Content-Type-Options) for web servers
(and other internet facing servers such as loadbalancers)....
1
vote
1answer
483 views
Is there an any risk with HTTP header value reflection?
This website has a header in the request (If-None-Match) and whatever you set the value to for it, the response will contain a header (ETag) with the value of the If-None-Match header.
I understand ...
2
votes
2answers
386 views
Content Security Policy Header not stopping attack
I created a simple test web application to test the use of the content security policy header. I included a vulnerability in my test app, such that submitting a basic XSS payload with script tags ...
0
votes
1answer
79 views
Getting confusion that this responce indicate CORS vulnerability
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 12
Connection: close
Date: Tue, 25 Sep 2018 12:59:56 GMT
x-amzn-RequestId: xxxxxxxxxxx
Access-Control-Allow-Origin: *
Access-Control-...
2
votes
1answer
1k views
Web-Application with CORS Origin: * using authorization header
As stated here, https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS at "Credentialed requests and wildcards". Quote:
When responding to a credentialed request, the server must specify an
...
4
votes
1answer
720 views
Is cache-control: no-cache enough for sensitive information like bank accounts, etc.?
I have read somewhere that when storing sensitive information on a website you should include cache-control: no-store for telling the browser not to store that information on the local system. But I ...
1
vote
1answer
293 views
Suspiscious HTTP request to nginx server in server log, what is it?
I have an nginx server running an instance of and express/nodejs server.
I was going through the logs to see what was being requested, and I noticed a few normal attempts for common flaws in things ...
17
votes
2answers
5k views
How did this email list a fake recipient? [duplicate]
My friend recently received a suspicious email for an iTunes gift card purchase from "Apple Store" with a header that displayed a fake "To:" address for orders@apple-store.com.
Unsurprisingly, this ...
2
votes
1answer
342 views
When implementing CORS, should I check for a correct HOST header in my webapp?
I have a backend web server that serves an API (over HTTPS) to a frontend browser client on a different subdomain. It uses CORS to allow this.
The CORS spec directs you to not send the CORS headers ...
1
vote
1answer
2k views
X-Frame-Options header on redirect
I have several web applications running on my server (Debian 8 running Apache). One of my customers wants to improve the security of his app, after having some security audits carried out by a third-...
1
vote
1answer
6k views
Damage of a leaked ETag
I've read multiple times that leaked ETags from Webservers are considered an information leakage vulnerability.
For example in the server response headers:
ETag: X/"1234-56789"
But I have not found ...
1
vote
1answer
2k views
How to bypass response Location in order to obtain content XSS?
In some basic steps:
POST Request containing a photo with multipart/form-data.
HTTP/1.1 302 Found respond with redirect back to formular
Redirect to initial formular.
In case 1 we are able to ...
0
votes
1answer
557 views
CSP header default-src: data:
I am testing CSP header implementation. The implemented header value is:
Content-Security-Policy: default-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-...
1
vote
1answer
2k views
Application/Octed-Stream header for XML file
My application when downloading XML file returns headers:
Content-Type: Application/Octed-Stream
Content-Disposition: attachment; filename=file.xml
Is this behavior correct form security point of ...
3
votes
1answer
1k views
Is host header injection possible without cache or password reset?
I am a beginner in security and reading about host header injection. I tested an application for this vulnerability and it is possible there for some request, but the developer implemented no-cache, ...
5
votes
1answer
192 views
Is it worth verifying the request hostname in API-to-API communications?
When authenticating from a browser application to an API layer, you can verify the request origin for CORS requests. I'm aware that this is primarily to prevent CSRF attacks. It doesn't prevent an ...
