Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [http]

Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP ...

7
votes
2answers
1k views

Why should someone block all methods other than GET and POST in a RESTful application?

TL;DR: Is there a valid reason to demand a software vendor to stop using HTTP PUT and DELETE methods in a web application and use only GET and POST? The application is security hardened, pen-tested ...
1
vote
1answer
46 views

Should HTTP Security headers be configured for all servers?

I recognise the importance of configuring HTTP security headers (X-Frame-Options, X-XSS-Protection and X-Content-Type-Options) for web servers (and other internet facing servers such as loadbalancers)....
0
votes
1answer
39 views

Bettercap 2.x SSLStrip Is Not Converting Links

I posted this before. I am creating a new post because of all the changes I would need to [edit] out. I have the latest version of bettercap. I have the latest version of Kali Linux using the latest ...
1
vote
0answers
17 views

Origin VS Authority and Domain certificates and Unique IPs

Disclaimer, I am new to InformationSecurity, so sorry if I not following rules as good as expected. I asked this post on stackOverflow, and I was suggested to transfer it here So far I get: Origin = ...
1
vote
1answer
45 views

Bettercap 2.x SSLStrip Is Not Breaking TLS (Without HSTS)

I have the latest version of bettercap. I have the latest version of Kali linux using the latest version of VirtualBox on the latest version of Windows 10. My target machine is the lowest possible ...
0
votes
0answers
16 views

Why would someone practically want access to a JSP servlet source?

I've seen online now a few times ways to exploit web servers like httpd using connectors like tomcat to expose the source code for a .jsp file when it is not supposed to. For example, appending %01 ...
0
votes
0answers
30 views

What is the term for this particular type of forum spamming attack

I've noticed that on webforums, users will post hundreds of copies of the same message, or worse yet, copies of the same initial thread post to disrupt the forum. Is this an example of an HTTP GET/...
-1
votes
1answer
35 views

If I send request with PUT, and server return valid page with 403 status. This is correct work? [closed]

I send PUT. Server returned 301 status to valid http-address(!), but next response 403 status to hhtp-address. If I copy/paste this address all works correct. Please, say me: this is correct response ...
1
vote
1answer
81 views

Internal HTTP(s) vulnerabilities

We use Rapidfire + network detective where I work, for doing non-intrusive internal scans on all of our clients' networks. Every week; half of the tickets I get for this are port 80/443 ...
1
vote
1answer
53 views

Is there an any risk with HTTP header value reflection?

This website has a header in the request (If-None-Match) and whatever you set the value to for it, the response will contain a header (ETag) with the value of the If-None-Match header. I understand ...
0
votes
1answer
37 views

Which HTTP Compression should I use (and how?)

I know that there are multiple HTTP Compression tools out there. In order to entirely prevent a site from being susceptible to BREACH, which HTTP Compression algorithm should I use? Also, how ...
1
vote
0answers
36 views

How to bypass NTLM HTTP authentication?

Is there any way to bypass HTTP authentication rather than brute-forcing ?
3
votes
1answer
170 views

How do I make safe login-emails? (GET/POST) [duplicate]

Vision I envision a login/signup-system, where the user enters his/her email, and receives an email with a link to sign in. The user clicks the link, and is automatically signed in (confirming the ...
1
vote
3answers
168 views

How to prevent unauthorized users from accessing an image on my server just by URL?

I have a few dynamically generated images on my server (of high business value), which are supposed to be viewed only via our mobile app. The image is simply loaded from the URL as PNG. How can I ...
3
votes
1answer
66 views

Why does not Referer header use “same-origin” by default?

Same origin policy is an important part of the security model so it is "on" by default for most things, but for the referer it does not seem to be so. The default for browsers seem to be no-referrer-...
0
votes
2answers
58 views

Does HTML Purifier (which converts & to &) prevent HTTP parameter pollution?

If a REST endpoint (http://example.com) reads the p query parameter and pass it along to another endpoint: http_get("http://example.com/api2?p=".$_GET['p']); I will be able to exploit it by ...
26
votes
10answers
10k views

How to secure passwords over HTTP?

Say my password is abc. I want to send it to the server over HTTP. I could send it in plaintext and let the server hash it and compare it to the entries in its database, but then anyone that can see ...
0
votes
1answer
64 views

For servers that are not internet facing, do they need to be authenticated to each other and should their communication be over HTTPS? [duplicate]

My gut instinct is that best practice would be to ensure that all internal servers communicate over HTTPS and that all servers are authenticated to each other. That would indeed be dream case ...
0
votes
1answer
101 views

NIKTO: Requires Authentication for realm ''MD5''

I am trying to perform a scanning of a web server using Nikto using: nikto -id id:pass -h xxx.xxx.xx.xxx I am specifying HTTP Basic authentication credentials and indeed with this credentials I can ...
0
votes
0answers
38 views

Encryption Method for Open-Source “Decentralized” Network

I am currently creating an open-source decentralized chat system in Python. It originally started off as being something to train my programming skills, but after talking about it to some friends, I ...
0
votes
0answers
21 views

TRACE method returns GET

XST is a well known vulnerability and the reason that everyone always alerts: TRACE is allowed this is bad. But what I see often at clients is that a request using TRACE returns the same as a GET. Am ...
0
votes
2answers
66 views

Locale detection & huge Accept-Language header, can this be considered an atack vulnerability?

I was looking for some examples of automatic locale detection as I needed to do the same in my PHP app. Most of the answers I found were similar, only differing in the parsing methods. An example '...
1
vote
1answer
141 views

How to disable the use of HTTP verb tunneling using HTTP headers or query parameters?

The attacker request uses a trusted HTTP verb such as GET or POST, but adds request headers such as X-HTTP-Method, XHTTP-Method-Override, X-Method-Override, or a query parameter such as _method to ...
27
votes
1answer
7k views

Why should we sometimes use --+ instead of — in SQL injection to comment the rest of the query?

I have encountered some websites that when I used -- to comment the rest of the query it didn't work, but when I tried --+ it worked. In the MySQL official documentation there is no such thing as --+ ...
1
vote
1answer
97 views

Why do we use Oauth2 instead of Basic Auth in server to server communication using SSL?

Why do some API providers ask you to implement Oauth2 in server to server communication that's available only over HTTPS? In the frontend (app or webapp), Oauth2 is useful to protect the user ...
1
vote
1answer
74 views

How does VPN provider hide traffic from different users

I´m currently learning much about VPN security and now I got to that point where I would like to know how a VPN provider is able to hide my traffic from other user. I am connected to one gateway (as ...
2
votes
2answers
109 views

Nmap not following redirect when using “http-title” script

I am trying to scan a bunch of IPs for their http-title. Now the problem I have is that nmap pretty much never follows any redirects. Usually the title I want is behind that redirect though. For ...
0
votes
3answers
125 views

Can information sent over unencrypted http still be seen if I'm on an encrypted wifi?

I was booking a haircut online and noticed that when they made me sign up for an account, the credentials were not being encrypted (or at least that's what firefox was telling me). It's not a huge ...
0
votes
0answers
49 views

Are plaintext POST payloads over HTTPS safe? [duplicate]

My knowledge on information security is limited. I argued with a colleague more specialized in that area that, for the purposes of calling a login Web service, POST plaintext payloads sent over HTTPS ...
0
votes
1answer
25 views

Is there any other way through which an attacker can obtain user data from HTTP response except MITM and CORS attack?

I am doing some research for my college project and I want to ask is there any other way through which an attacker can obtain data from HTTP response except MITM and CORS attack. For an example, If I ...
1
vote
1answer
41 views

Dangers of Sending Onetime Pin numbers over http

Are there any dangers of sending a one time pin number from customer to my server over HTTP? Somebody is arguing that its okay since it will only be used once. So there's no chance of an attacker ...
0
votes
0answers
52 views

How does cryptcat work?

So I've read this article about using cryptcat to create a backdoor. But then I was wondering, how is the connection made? Like according to the tutorial you have to connect the computer's shell ...
1
vote
1answer
96 views

How to pass a localhost check for an incoming request?

I'm trying to send a request to an http server hosted on a machine. The http server is in C# and drops any packets that are not from localhost: public void Request(HttpListenerContext context) { ...
4
votes
3answers
115 views

client/server trust after authenticating over HTTPS then dropping to plaintext?

Disclaimer If this question is ridiculous it's because secure public key exchange sounds impossible before you learn about it. So I'm asking about things that may be impossible. Question Is it ...
2
votes
1answer
151 views

What are the benefits to HTTPS between two servers I control?

The current setup we have is two servers that are held internally in my building. One of these is only accessible internally, the other is public facing. The internal server communicates with the ...
2
votes
2answers
88 views

Bypassing rate limit on home router

I'm studying Info Security and was poking around my home router (it's a cheap one) with a python script trying to brute force the admin password for the web interface (it uses HTTP basic and the ...
1
vote
1answer
56 views

What is the safest method to send authentication data to API?

I use Vue.js on frontend and GoLang on backend. With Vue I'm sending AJAX request with credentials for sign in/sign up. Should I use HTTP Basic Auth, or just send them in request body? In case you are ...
0
votes
1answer
76 views

Signing webhooks with JWT — overkill with TLS?

I have a server that sends webhook notifications to client servers. Before the client server begins processing anything, it should be certain that the webhook originated from my server, and that it ...
3
votes
1answer
109 views

Spam link returns empty redirect to google.com - am I missing something?

In this question someone received what was clearly a spam link. Sometimes I'm curious enough to take a peek, which I usually do with curl or other command line tools (less risk of drive-by malware, ...
2
votes
1answer
72 views

After performing a SSL strip, can you upgrade back to HTTPS with your own encryption from the proxy?

Let's say you are performing a SSL strip. From what I can understand, it modifies either the client or server packets (in the http/https protocol), which indicate that it supports encryption to not ...
1
vote
0answers
32 views

Bloom filter to prevent replay attacks in signed HTTP requests

I'm thinking about an authentication sheme of a REST API in a setting where the only thing the server stores about a client, is their public key (the asymmetric encryption scheme should not matter). ...
-1
votes
1answer
95 views

Should HTTPS work automatically on my website or does it need to be allowed somehow? [closed]

If I simply type in security.stackexchange.com into my browsers URL bar, it uses HTTPS to fetch data from the server. Is it possible for a website to not work over HTTPS? Does it have to be ...
3
votes
1answer
98 views

Is cache-control: no-cache enough for sensitive information like bank accounts, etc.?

I have read somewhere that when storing sensitive information on a website you should include cache-control: no-store for telling the browser not to store that information on the local system. But I ...
3
votes
1answer
140 views

Injecting a TCP packet into existing connection

let's see a scheme: and I would like to consider two cases: All IP addresses are public, a cloud is symbol for the Inernet. The first one The H has an established TCP connection: C = (210.10.10....
0
votes
1answer
57 views

What party is protected by not turning on CORS?

Here's what I know about CORS: It allows you to access data on another domain from the frontend of any other website, as long as the access-control-allow-origin property is properly set on the machine ...
0
votes
1answer
83 views

Is there a way to send a password over JSONP (GET) over HTTPS (SSL)? Crypto maybe?

I understand sending passwords in the clear over GET is not considered secure because the query string can be logged by multiple eavesdroppers. However if I REALLY need to use JSONP to submit a ...
0
votes
0answers
92 views

difference between res.header(x-auth, JWTtoken) and res.cookies(JWTtoken)?

I have seen across all blogs and articles is that there is two ways to handle JWTtokens, put them inside localStorage which subjected for XSS attack or put them inside Cookies and set httpOnly and ...
0
votes
1answer
278 views

Can I get malicious malware in my computer or any kinds of virus by registering through Google/Facebook to a specifc site?

Lately, there is a start up company in Israel called Initiative Q and currently it gives out coins (that are similar to bitcoin but they don't run on Blockchain technology) in order to advertise their ...
2
votes
2answers
103 views

What's the benefit of JWT if user needs to send his credentials once anyway?

JWT tokens seem like a very good idea. You can send a request to some API without using your username/password secret pair. Still, I don't fully understand the benefits that it gives. I have two ...
2
votes
2answers
52 views

Network provider blocking URL, even though connection made to IP

I came across an interesting case today, which with my limited knowledge I'm unable to understand the working of. I was trying to access a bit.ly link, but it is blocked by my University. Knowing ...