Questions tagged [header]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
2answers
94 views

Is there way to know what headers can be accepted by HTTP server?

Imagine that there is server required authentication for getting an access to some endpoint. And developer added some logic to bypass the authentication: if server recieve HTTP header give_me_access=...
0
votes
0answers
29 views

How to update the Return-Path that Facebook sends with?

Each facebook user gets legitimate facebook emails with a fixed Return-Path: notification+ABC123@facebookmail.com header. I.e., Bob will always get mails from ABC123, and Wilma from EFG456. There is ...
0
votes
0answers
37 views

How risky it is if a server allows client Javascript access to say an access token in header?

After authenticated by Google, a client browser attaches the idToken from Google to an application API server. Assuming google-auth-library auto-refresh an expired token, it now needs to send it back ...
0
votes
1answer
45 views

Is frame busting javascript required despite x-frame-options

I am using x-frame-options sameorigin header to prevent some of my websites from being loaded in iframes. Is this a foolproof method to prevent iframe loading? There have been several old threads on ...
1
vote
1answer
42 views

Multiple server fields in HTTP Response

Recently, during a pen-testing exercise, I noticed that the target server responded with multiple "Server" fields in the header. I was wondering what it could mean and if oddity is somehow ...
0
votes
1answer
59 views

Does an url that redirecting infinitely have any impact to website?

I am testing a bug bounty website, and found an endpoint like www.example.com/infinite. When open it, it keep doing 302 redirect to itself until browser stops it for redirecting too many times. For ...
2
votes
3answers
87 views

Is there any way for a client to view headers set by an NGINX reverse proxy?

I am setting up an NGINX reverse proxy, which sits in front of an API. I would like to use: proxy_set_header X-Secret-Key ${SECRET_VALUE}; to add a token to the request, which is then read by the API. ...
1
vote
0answers
66 views

HTTP: Headers vulnerability still showing after being added

A web vulnerability assessment was done on our web app by a third company that specializes in security, and we added common headers that we missing, and to check my headers internally before the third ...
0
votes
0answers
32 views

Is it possible for origin header to have alphaebtical port or parameters in real life scenario?

I'm testing this application which is properly validating origin header on the sever side. However, if I add any domain and the expect domain as port, application still consider this valid. Origin: ...
1
vote
1answer
163 views

HTTP Headers: Document Policy vs. Permissions-Policy/Feature-Policy

I'm checking the options to harden my web app by setting the appropriate HTTP headers. Besides the Content Security Policy (CSP) there are two another approaches: Document Policy and Permissions-...
0
votes
0answers
56 views

Are application using custom header instead of CSRF token safe?

This application sends data to the server in JSON and checks for the content-type header, but I was able to bypass this, but it sends another custom header which is not a secret token or something ...
2
votes
1answer
78 views

Should I check Host header or ServerName for CSRF defense when serving behind proxies?

In a CSRF defense based on checking forbidden headers, should I check Origin/Referer header against the ServerName configuration directive, or is it sufficient to simply check against the HTTP Host ...
2
votes
1answer
97 views

Content-Secure-Policy headers

I am performing a security assessment on a web application and I found it doesn't have the Content-Security-Policy, but instead it has Content-Secure-Policy. It is literally the first time I'm seeing ...
0
votes
0answers
46 views

What are the security risks of trace context propagation headers?

We are implementing zipkin tracing in our product and have some hesitation about accepting and returning the propagation headers for publicly accessible http requests. The zipkin server itself is not ...
0
votes
2answers
71 views

Can we read HTTP cookie value? [closed]

In one of the applications I'm testing, the cookie contains the username (set:cookie: username) in the HTTP header. Is it possible to read these cookie values using any methods? The site uses HTTPS.
0
votes
1answer
547 views

Is the IP address of the client present in the email headers for webmail services and for desktop clients?

When I receive an email sent by someone using a webmail service (e.g. Gmail, etc.), I can find the IP address of the sender's email server in the email headers. But do the email headers also contain ...
1
vote
0answers
272 views

Do object-src and base-uri bypasses still work on Content-Security-Policies?

I'm assessing the security level of a webapp and one of the test cases is the CSP header. I always use the Google CSP evaluator to assess the header. Let's consider the following CSP header: Content-...
1
vote
3answers
73 views

Should all the headers reported by securityheaders.io be considered as findings?

A lot of websites scanned with securityheaders.io are missing different headers. Should all of these headers be reported as findings or just few of them which are more critical?
0
votes
2answers
247 views

HTTP Request Smuggling Basics

I am currently trying to learn HTTP Request Smuggling vulnerability to further enhance my pen testing skills. I have watched a couple of videos on Youtube and read articles online regarding it but ...
1
vote
2answers
663 views

IP address leaked in email header?

Can my IP address ever be included in the header of emails I send? Or do email servers never include my IP address in my emails' headers?
1
vote
2answers
806 views

Authorization Header in dev tools

My web application need to make call to 3rd party REST API which is protected by Basic authentication on some user click. We are planning to use a technical user for the call. This will expose the ...
1
vote
1answer
217 views

Enabling HTTP Security headers in S/4 Hana web applications

We have 3-4 S/4 HANA applications in our environment and want to enable HTTP Security Headers, but couldn't figure out how to go about it. We then approached SAP directly and even their solutions are ...
0
votes
1answer
129 views

How to best limit SQL injection attacks that are being funneled through an Apache proxy I control

I use an Apache proxy to funnel traffic to an IIS server. The IIS server sends me emails if some bad actor attacks my site with an sql injection attack. It captures their IP address, and sends me the ...
0
votes
0answers
72 views

What happens if a sender changes the TCP window size over multiple packets that have the same ACK number?

I'm currently doing research on evasion attacks that seek to bypass a Deep-learning based Network Intrusion Detection System. In order to achieve this, I need to know what the constraints are for the ...
0
votes
1answer
296 views

CSRF Bypass using User-Agent

This is an unconventional approach of CSRF that I came across while doing the pentest for an Android mobile application. The original request is as follows (NB: Values have been edited): POST /edit/ ...
1
vote
1answer
67 views

Utility of HTTP headers for a REST API

Can somebody confirm me that the HTTP-XXS-protection header and the X-content-type header is useless in the case of a REST api who provide only json to clients ? Can someone explain me why exaclty ? ...
4
votes
1answer
638 views

Adding Expect-CT header to HTTP response

In the security test report, I have a recommendation to add Expect-CT header to the HTTP response from web application, additionally developers set this to: Expect-CT: max-age=0, report-uri= I am ...
-1
votes
2answers
84 views

Is CSRF possible if i know the value of the authorization bearer token?

If i know the value of bearer token of the victim, can i generate a get csrf page and set a custom Autorization: Bearer [token] header?
1
vote
2answers
582 views

Sending token through GET vs POST

Looking for recommendations for security in sending token (e.g. JWT Token) through a GET vs POST request to the server. There are two options: Sending token through Headers as part of HTTP GET ...
1
vote
1answer
949 views

How to determine start and end bytes of LUKS header?

How can I determine the exact start byte and exact end byte of a LUKS header on a block storage device? I use Linux Unified Key Setup (LUKS) for Full Disk Encryption (FDE), so all of the data on my ...
9
votes
3answers
776 views

Why does Chrome not allow the modification of these headers by extensions?

The Chrome WebRequests API mentions that specific request headers are not available to the onBeforeSendHeaders event, meaning that extensions cannot read and/or modify these headers. Here is an ...
12
votes
2answers
2k views

Secure HTTP Headers - where should be implemented, WAF or code level?

I have a REST API exposed to the Internet and another application with form-based authentication. These apps are behind a Web Application Firewall. Question is, where I should implement the below ...
2
votes
1answer
1k views

Is there any way to pretend like we are routing our request via cloudflare? [closed]

There is this Web App which uses cloudflare and to bypass certain things I had to find a way to access the actual web server directly. I tried numerous things and finally I think I have found the ...
0
votes
2answers
317 views

Is it a security issue that Nginx returns server name in errors?

I have recently sat up an Nginx in a way that makes it not return a Server header and hide the version information from the error pages. The error page looks like that now (and anyone can provoke it ...
0
votes
2answers
2k views

Why is it not possible to spoof referer and origin header with XHR?

Technically speaking, it is possible to spoof both headers using an intercepting proxy but that's useless because we are doing it ourselves as an attacker. When we send an ajax request using JS from ...
2
votes
1answer
86 views

Is there any way to keep the request in intercepting proxy for atleast a min before application says check your connection?

I just bypassed SSL pinning on an android application but the problem is application won't let me play with the request on my intercepting proxy. It says something like problem with your network or ...
1
vote
1answer
79 views

Carrying two authorization tokens in a request

In my group we have been asked to implement an authentication-authorization flow in a new web portal that lives in a complex infrastructure. For historical reason the initial authentication of each ...
1
vote
0answers
2k views

Implementation of Simple CSRF in Spring Boot and Angular 6 With Complete Solution

I am Implementing CSRF i.e Cross-Site Request Forgery in my project but not getting proper way to implement in my project and i am using Angular for FrontEnd and Java for BackEnd in Spring Boot and I ...
1
vote
1answer
79 views

Is there a security benefit to testing HTTP header presence with Javascript?

I have found in one of the client side libraries that it is performing an AJAX call to an API and checking if response contains all of the following headers with corresponding values (as a security ...
2
votes
1answer
88 views

Why we should not allow our pages to be loaded through Iframe by unknown hosts?

One of OWASP recomendations is to set the header X-Frame-Options to allow our pages to be loaded in Iframes only by sameorigin. One reason is because of phishing attacks, ok I understand. But if I ...
0
votes
1answer
115 views

Referer value reflected in location response? [duplicate]

I found a login form on a website that redirects you regardless if the insert credentials are correct or wrong (302 redirect). I noticed that the value of the header Referer: is sent to header ...
1
vote
1answer
53 views

Is a CSRF required if no direct state change operations are performed?

I'm currently developing a webservice that sits in between other webservices. In the process of securing this webservice I've gotten a bit stuck on whether or not we neeed to require a CSRF token on ...
1
vote
0answers
47 views

'Hard-to-guess' custom header (or similar) to whitelist via a firewall

My organisation is adding a firewall to our test stacks, using AWS WAF. We'd like to whitelist all traffic from the SDKs we've built to facilitate requests between our services. We thought of doing ...
2
votes
3answers
214 views

How to tell if an email source is spoofed?

I've received an email to my gmail account from FCMB, a bank in Nigeria (flashing warning lights already). It's not addressed to me (i.e., the email starts off "Dear Daniel," [not my name]). But the ...
1
vote
1answer
160 views

Is using default-src * safe?

I have a website to do security testing. The CSP is as follows. default-src * ; style-src 'self' 'unsafe-inline' data: https://netdna.bootstrapcdn.com/ http://s3.amazonaws.com/ https://s3.amazonaws....
0
votes
0answers
71 views

Is it secure to prevent CSRF in API without using CSRF cookie (only CSRF token sent in header of ajax requests)?

There is a standard method of preventing a CSRF attack by comparing a value in a special cookie (that is posted automatically with each request) and some value that is coming either in form post (from ...
0
votes
1answer
109 views

What should be header response of XSS vulnerability upon form submission?

We have a PHP web application and all of the user inputs are sanitized. We tested it within Burp tool and found no XSS vulnerabilities. One of our security adviser tells us that when you type down ...
6
votes
1answer
5k views

CSP: What is script-src-attr and script-src-elem?

script-src-attr and script-src-elem directives are new additions in CSP3. I am not able to understand how are they different from the script-src directive. https://w3c.github.io/webappsec-csp/#...
1
vote
2answers
910 views

How to extract intresting data from malicious e-mail header

Premise: I know pretty well how SMTP works, and how to read an e-mail header. I know what all the main fieds mean, but I couldn't know what to look for if I want to know if the mail is kind of ...
2
votes
2answers
2k views

Flow of a host header injection attack?

I am new to this field and would like to know how the flow happens in a host header injection attacks. I believe it's as below: Client generates the request. Attacker manipulates the request and ...