Questions tagged [header]
The header tag has no usage guidance.
129
questions
0
votes
0
answers
16
views
Is different X-Forwarded-For values per site an indicator for something malicious?
I am using a mobile ISP to access the internet. I noticed something really weird: most sites (e.g. www.whatismyip.com, https://www.iplocation.net/http-browser-header) report my IP as let's say IP A: ...
- 163
0
votes
0
answers
40
views
Headers X-XSS-Protection issue
I want to clear my doubt that Is there any issues coming from adding 'Strict-Transport-Security' and 'X-XSS-Protection' headers ?
Header set Strict-Transport-Security "max-age=10886400;
Header ...
-2
votes
1
answer
31
views
CORS attack using authentication token [closed]
I found a website which is vulnerable to cors.(https://portswigger.net/web-security/cors)
GET /api/requestApiKey HTTP/1.1.
Host: vulnerable-website.com.
Origin: https://evil.com.
AUTHENTICATION: ...
1
vote
0
answers
29
views
Should I set "Ignore" cookie headers flagged from Akamai WAF or change its severity to Informational?
I've been seeing our AppScan tools tagging cookie headers from Akamai in low severity.
Mostly tagged as missing attributes of "HTTPOnly" and "Secure" flag.
The question here is ...
- 31
2
votes
1
answer
92
views
HTTP and HSTS Web Server
If I have HSTS enforced on a web server with HTTPS 443, but HTTP port 80 is still open, does this make HTTP still accessible, or only for the first time before it's added to the browser HSTS list?
I ...
- 23
0
votes
1
answer
97
views
Url only works from the browser it is generated from. Copying it into a Curl Command fails, and gives a 403 error. How can I fix this?
I am doing some web scraping for streaming files, .m3u8 mime type. In this particular instance, I can't create a functional request that does not end up with a 403 Forbidden error.
How to reproduce:
...
2
votes
3
answers
106
views
HttpResponse Headers Information Leakage on Server Error (Verbose Headers)
In the past I have dealt with security issues related to Default Service Banners/Verbose Headers/Information Leakage via HttpResponse Headers. These issues are quite common, and usually look ...
- 149
1
vote
2
answers
141
views
Do relative paths mitigate HTTP Host Header attacks?
I have been researching http host header attacks. There are many examples such as <a href="https://_SERVER['HOST']/support">Contact support</a>. Why would anyone use an absolute ...
0
votes
1
answer
168
views
Cookies Vs Headers For REST API User Authentication Token
I'm working on a small rest api project with user authentication.
But I'm wondering whether I should store the users authentication token in a header or a cookie.
The general idea is as follows:
User ...
- 3
1
vote
1
answer
158
views
Modifying UserAgent by a proxy?
For learning and testing purposes I'd like to change the UserAgent in the HTTP header.
In the desktop Firefox it is simple: there is an add-on for this task. But on android... it is impossible.
I ...
0
votes
0
answers
67
views
Is mime-sniffing still something to protect against with modern browsers (with X-Content-Type-Options)?
I have read about X-Content-Type-Options and it says often that it protects against IE mime sniffing problems.
I am wondering if in 2021 it is still valid and a problem for modern browsers? In other ...
- 2,167
0
votes
1
answer
164
views
Sending Post Requests Server to Server
I am creating a web application that is sending sensitive data between servers. I need to take user inputted web form data from website 1 (abc.com) and post the data to website 2 (xyz.com/api). ...
- 129
0
votes
0
answers
138
views
X-Permitted-Cross-Domain-Policies - allow certain URL patterns
I have a website where I am blocking it from being loaded via iframe into other websites.
What I want is to keep this in place, but allow certain URLs from my website, to be iframed anywhere.
For ...
- 1
1
vote
2
answers
143
views
Is there way to know what headers can be accepted by HTTP server?
Imagine that there is server required authentication for getting an access to some endpoint.
And developer added some logic to bypass the authentication: if server recieve HTTP header give_me_access=...
- 13
0
votes
0
answers
72
views
How to update the Return-Path that Facebook sends with?
Each facebook user gets legitimate facebook emails with a fixed
Return-Path: notification+ABC123@facebookmail.com
header. I.e., Bob will always get mails from ABC123, and Wilma from EFG456.
There is ...
- 101
0
votes
0
answers
79
views
How risky it is if a server allows client Javascript access to say an access token in header?
After authenticated by Google, a client browser attaches the idToken from Google to an application API server. Assuming google-auth-library auto-refresh an expired token, it now needs to send it back ...
- 101
0
votes
1
answer
278
views
Is frame busting javascript required despite x-frame-options
I am using x-frame-options sameorigin header to prevent some of my websites from being loaded in iframes. Is this a foolproof method to prevent iframe loading?
There have been several old threads on ...
- 107
1
vote
1
answer
85
views
Multiple server fields in HTTP Response
Recently, during a pen-testing exercise, I noticed that the target server responded with multiple "Server" fields in the header. I was wondering what it could mean and if oddity is somehow ...
- 606
0
votes
1
answer
118
views
Does an url that redirecting infinitely have any impact to website?
I am testing a bug bounty website, and found an endpoint like www.example.com/infinite. When open it, it keep doing 302 redirect to itself until browser stops it for redirecting too many times.
For ...
- 31
2
votes
3
answers
260
views
Is there any way for a client to view headers set by an NGINX reverse proxy?
I am setting up an NGINX reverse proxy, which sits in front of an API. I would like to use:
proxy_set_header X-Secret-Key ${SECRET_VALUE};
to add a token to the request, which is then read by the API. ...
- 121
1
vote
0
answers
109
views
HTTP: Headers vulnerability still showing after being added
A web vulnerability assessment was done on our web app by a third company that specializes in security,
and we added common headers that we missing, and to check my headers internally before the third ...
- 11
0
votes
1
answer
100
views
Can the Origin header have alphabetical port or parameters in a real-life scenario?
I'm testing this application which is properly validating origin header on the sever side. However, if I add any domain and the expect domain as port, application still consider this valid.
Origin: ...
- 1
2
votes
1
answer
289
views
HTTP Headers: Document Policy vs. Permissions-Policy/Feature-Policy
I'm checking the options to harden my web app by setting the appropriate HTTP headers.
Besides the Content Security Policy (CSP) there are two another approaches: Document Policy and Permissions-...
- 123
2
votes
1
answer
127
views
Should I check Host header or ServerName for CSRF defense when serving behind proxies?
In a CSRF defense based on checking forbidden headers, should I check Origin/Referer header against the ServerName configuration directive, or is it sufficient to simply check against the HTTP Host ...
- 328
2
votes
1
answer
157
views
Content-Secure-Policy headers
I am performing a security assessment on a web application and I found it doesn't have the Content-Security-Policy, but instead it has Content-Secure-Policy. It is literally the first time I'm seeing ...
0
votes
2
answers
134
views
Can we read HTTP cookie value? [closed]
In one of the applications I'm testing, the cookie contains the username (set:cookie: username) in the HTTP header. Is it possible to read these cookie values using any methods? The site uses HTTPS.
0
votes
1
answer
1k
views
Is the IP address of the client present in the email headers for webmail services and for desktop clients?
When I receive an email sent by someone using a webmail service (e.g. Gmail, etc.), I can find the IP address of the sender's email server in the email headers.
But do the email headers also contain ...
- 941
1
vote
0
answers
508
views
Do object-src and base-uri bypasses still work on Content-Security-Policies?
I'm assessing the security level of a webapp and one of the test cases is the CSP header. I always use the Google CSP evaluator to assess the header. Let's consider the following CSP header:
Content-...
- 187
1
vote
3
answers
115
views
Should all the headers reported by securityheaders.io be considered as findings?
A lot of websites scanned with securityheaders.io are missing different headers.
Should all of these headers be reported as findings or just few of them which are more critical?
- 477
0
votes
2
answers
389
views
HTTP Request Smuggling Basics
I am currently trying to learn HTTP Request Smuggling vulnerability to further enhance my pen testing skills. I have watched a couple of videos on Youtube and read articles online regarding it but ...
- 123
1
vote
2
answers
1k
views
IP address leaked in email header?
Can my IP address ever be included in the header of emails I send? Or do email servers never include my IP address in my emails' headers?
- 1,576
1
vote
2
answers
2k
views
Authorization Header in dev tools
My web application need to make call to 3rd party REST API which is protected by Basic authentication on some user click. We are planning to use a technical user for the call.
This will expose the ...
- 265
1
vote
1
answer
450
views
Enabling HTTP Security headers in S/4 Hana web applications
We have 3-4 S/4 HANA applications in our environment and want to enable HTTP Security Headers, but couldn't figure out how to go about it. We then approached SAP directly and even their solutions are ...
- 13
0
votes
1
answer
213
views
How to best limit SQL injection attacks that are being funneled through an Apache proxy I control
I use an Apache proxy to funnel traffic to an IIS server. The IIS server sends me emails if some bad actor attacks my site with an sql injection attack. It captures their IP address, and sends me the ...
- 105
0
votes
0
answers
130
views
What happens if a sender changes the TCP window size over multiple packets that have the same ACK number?
I'm currently doing research on evasion attacks that seek to bypass a Deep-learning based Network Intrusion Detection System.
In order to achieve this, I need to know what the constraints are for the ...
0
votes
1
answer
533
views
CSRF Bypass using User-Agent
This is an unconventional approach of CSRF that I came across while doing the pentest for an Android mobile application. The original request is as follows (NB: Values have been edited):
POST /edit/ ...
- 189
1
vote
1
answer
226
views
Utility of HTTP headers for a REST API
Can somebody confirm me that the HTTP-XXS-protection header and the X-content-type header is useless in the case of a REST api who provide only json to clients ?
Can someone explain me why exaclty ?
...
- 11
4
votes
1
answer
1k
views
Adding Expect-CT header to HTTP response
In the security test report, I have a recommendation to add Expect-CT header to the HTTP response from web application, additionally developers set this to:
Expect-CT: max-age=0, report-uri=
I am ...
- 1,097
-1
votes
2
answers
185
views
Is CSRF possible if i know the value of the authorization bearer token?
If i know the value of bearer token of the victim, can i generate a get csrf page and set a custom Autorization: Bearer [token] header?
- 19
1
vote
2
answers
1k
views
Sending token through GET vs POST
Looking for recommendations for security in sending token (e.g. JWT Token) through a GET vs POST request to the server.
There are two options:
Sending token through Headers as part of HTTP GET ...
- 13
2
votes
1
answer
2k
views
How to determine start and end bytes of LUKS header?
How can I determine the exact start byte and exact end byte of a LUKS header on a block storage device?
I use Linux Unified Key Setup (LUKS) for Full Disk Encryption (FDE), so all of the data on my ...
- 806
9
votes
3
answers
1k
views
Why does Chrome not allow the modification of these headers by extensions?
The Chrome WebRequests API mentions that specific request headers are not available to the onBeforeSendHeaders event, meaning that extensions cannot read and/or modify these headers. Here is an ...
- 1
12
votes
2
answers
2k
views
Secure HTTP Headers - where should be implemented, WAF or code level?
I have a REST API exposed to the Internet and another application with form-based authentication. These apps are behind a Web Application Firewall.
Question is, where I should implement the below ...
- 151
2
votes
1
answer
2k
views
Is there any way to pretend like we are routing our request via cloudflare? [closed]
There is this Web App which uses cloudflare and to bypass certain things I had to find a way to access the actual web server directly. I tried numerous things and finally I think I have found the ...
- 21
0
votes
2
answers
425
views
Is it a security issue that Nginx returns server name in errors?
I have recently sat up an Nginx in a way that makes it not return a Server header and hide the version information from the error pages.
The error page looks like that now (and anyone can provoke it ...
- 2,167
0
votes
2
answers
4k
views
Why is it not possible to spoof referer and origin header with XHR?
Technically speaking, it is possible to spoof both headers using an intercepting proxy but that's useless because we are doing it ourselves as an attacker.
When we send an ajax request using JS from ...
2
votes
1
answer
124
views
Is there any way to keep the request in intercepting proxy for atleast a min before application says check your connection?
I just bypassed SSL pinning on an android application but the problem is application won't let me play with the request on my intercepting proxy. It says something like problem with your network or ...
- 21
1
vote
1
answer
130
views
Carrying two authorization tokens in a request
In my group we have been asked to implement an authentication-authorization flow in a new web portal that lives in a complex infrastructure.
For historical reason the initial authentication of each ...
1
vote
0
answers
3k
views
Implementation of Simple CSRF in Spring Boot and Angular 6 With Complete Solution
I am Implementing CSRF i.e Cross-Site Request Forgery in my project but not getting proper way to implement in my project and i am using Angular for FrontEnd and Java for BackEnd in Spring Boot and I ...
- 111
1
vote
1
answer
120
views
Is there a security benefit to testing HTTP header presence with Javascript?
I have found in one of the client side libraries that it is performing an AJAX call to an API and checking if response contains all of the following headers with corresponding values (as a security ...
- 2,167