Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Join us in building a kind, collaborative learning community via our updated Code of Conduct.

Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP ...

1
vote
1answer
42 views

How do CORS proxy websites work?

While I was developing the front-end side of my web project, I got an CORS protection error. Not surprising since my front-end project was not in the same origin. After some search on how to bypass ...
1
vote
1answer
68 views

Suspiscious HTTP request to nginx server in server log, what is it?

I have an nginx server running an instance of and express/nodejs server. I was going through the logs to see what was being requested, and I noticed a few normal attempts for common flaws in things ...
4
votes
2answers
695 views

How does Google protect against scraping?

I'm trying to implement security against scraping on my website to prevent basic scraping techniques. Google seems to have a very good protection against scraping, but it's so good that I'm unable to ...
-1
votes
1answer
59 views

301 Moved Permanently on nginx server

If I request this: http://mysite.com/\/\http://evilzone.org Response: HTTP/1.1 301 Moved Permanently Location: https://mysite.com/\/\http://evilzone.org Is it a vulnerability?
0
votes
0answers
46 views

Hide data from wireshark on localhost

Assuming you're working with an old network protocol, or insecure/unencrypted protocol (HTTP for example), is there a way to make it difficult for network sniffers from capturing the packets? An MITM ...
3
votes
1answer
181 views

What is httpvh:// and is it the result of something malicious?

I was working on a client's old website and I noticed that some of their YouTube links were broken and looked like this: httpvh://www.youtube.com/watch?v=jNQXAC9IVRw At first I assumed it was some ...
1
vote
0answers
28 views

Security of AWS Lambda Communicating to Non-HTTPS API

Wondering what attacks might look like in the following scenario. I have a web service that pings an AWS lambda (behind API gateway), which makes a couple of transactions (sends email, adds to ...
3
votes
1answer
98 views

What information is still exposed when visiting an HTTPS website using DNS over TLS?

DNS over TLS is now supported in Android Pie, which allows a user to define a private DNS server, and by DNS providers such as CloudFlare's 1.1.1.1. This opens up the world of DNS security to more ...
14
votes
3answers
3k views

Is this bank website secure enough? No https in login page

Today I opened a bank account to invest my savings. Here's the link to the login page: http://www1.directatrading.com/ I noticed it doesn't use Https protocol (neither is that page nor in the landing ...
1
vote
1answer
50 views

Clickjacking vulnerability of file attachment downloads?

A portion of our system exposes an HTTP file handler that transmits a file to the client provided that authentication and file ID are correct, and no response if not. The ASP.net server this is ...
3
votes
0answers
118 views

Weird attack making my server CPU super high

I noticed that my server CPU is super high and the reason is grep "A" command After a deep look, that what I've found in my active internet connections list (netstat -tupn) tcp 0 0 ...
2
votes
2answers
119 views

Hydra gives right password if used after 3 minutes else gives wrong passwords

I have a D-Link DCS 5222LB IP camera. I am trying to bruteforce the IP camera. The camera uses basic HTTP authentication. I use the following command: hydra -l admin -P passlist.txt -t 3 http://...
-2
votes
0answers
95 views

Do HTTP response codes 406 and 302 while performing SQLi indicate a vulnerability?

While performing a SQLi test I've received HTTP response codes 406 and 302 from the server but don't see anything changing on the web page. Are these responses an indication that the application is ...
-1
votes
0answers
23 views

How does HTTP and TLS/SSL interact with each other? [duplicate]

I just finished reading a post explaining the relationship between HTTP and TLS, but I am still slightly confused about a few things. HTTP and TLS/SSL are application layer protocols, this layer of ...
-1
votes
4answers
114 views

Security concerns surrounding HTTP GET in Web Development

I'm currently a developer making my first foray into web development, mostly using C# ASP.NET services such as MVC and Web API. Getting into the HTTP side of things, I'm currently deciding whether or ...
0
votes
1answer
69 views

Sniffing an outbound HTTPS packet - only intercepted by certain software, can't decrypt

I'm trying to sniff an SSL-encrypted outbound packet. It's sent by the game Mass Effect 3 to an EA web service. When I sniff packets with Nirsoft SocketSniff, I can see the packet (positively ...
-2
votes
1answer
59 views

How to force authentication over HTTPS - Wordpress

During our last PCI scan, we received these 2 fail points: "Basic Authentication over HTTP" and "Web Page Transmits Login Credentials Without Encryption." Both were on Port 2077. Though our ...
1
vote
1answer
62 views

Hydra: Brute force an http form, all arguments are supplied but the login error has other string formats and is too big

I am using Hydra to brute force a login http form (Method: post), but I'm getting false positives (passwords that aren't valid) I believe I know the reason, I just don't know how to handle it: The ...
2
votes
1answer
85 views

Tunnel ssh over http with custom headers

I'm trying to set up corkscrew to make an SSH tunnel over HTTP, but I need to add custom headers after the "CONNECT" statement and before the ssh tunnel. Does corkscrew support it? If yes, how can I ...
0
votes
1answer
92 views

How is HTTP converted to HTTPS when no HSTS is present?

Suppose you have a website http://example.com Now, you also have an SSL certificate, which means users can access the site securely using https://example.com But if I just write http://example.com ...
2
votes
2answers
165 views

Given a secure channel, are there any benefits in using SCRAM over a username and password?

Given that a communication over HTTP uses SSL encryption uses public key pinning to prevent MiTM attacks is security in any way elevated by using Salted Challenge Response Authentication Mechanism (...
1
vote
1answer
53 views

Can my computer run malicious Javascript due to Man-in-the-middle attack on the connection with HTTP site?

There is an example for illustration purposes: Let's suppose that there is educational site about Celtic mythology. It's purely read-only site, not even comments are allowed. It's also very simple, ...
-1
votes
1answer
120 views

Secure version of httpd package [closed]

I am using Linux xyz.co 3.10.0-514.21.1.el7.x86_64 #1 SMP x86_64 x86_64 x86_64 GNU/Linux Tried to install latest version of httpd which is 2.4.33. But it is not available for RHEL7. That's why I ...
0
votes
1answer
131 views

HTTPS without SSL VS HTTP [duplicate]

I'm working on local server for Linux repositories. We have been using HTTPS without SSL Verification for establishing connection between the Server and the Agents. Are there really any differences ...
1
vote
2answers
91 views

E-commerce website that uses plaintext HTTP but redirects to PayPal during checkout

I need to purchase a few items (t-shirts, dvds, etc.) on an old e-commerce website that hasn't been updated in a while and doesn't use HTTPS to encrypt data in transit. The website does not have any ...
1
vote
2answers
137 views

Basic Auth over HTTP redirected to HTTPS - does it leak?

I'm creating a Flask API and I'm somewhat unfamiliar with the attack surfaces that exist in redirecting from HTTP to HTTPS, or requesting HTTP when HSTS header has been sent previously. Lets say a ...
1
vote
0answers
107 views

Is there any value to encrypting connections to localhost? [duplicate]

This is related to this question: Do I need to encrypt connections inside a network?, but I'm taking it a step further. We have an application that uses a lot of microservices that are hosted on the ...
0
votes
1answer
80 views

Strange HTTP GET Requests

My server has a static IP and listens to a port (8000) when it get's a file it automatically saves it with predefined extension. It's an internal project and no one knows about this server. I see few ...
1
vote
1answer
45 views

Can you forward TLS connections according to SNI domain without terminating the connection at the reverse proxy?

I am developing an application that needs to expose two services: REST API with https and client certificate authentication (https://api.device.example.org:4431, server certificate issued by private ...
1
vote
0answers
32 views

Why doesn't a CORS preflight request cause another?

According to MDN documentation, every non-simple request is doomed to fall into an infinite recursion: I want to send a non-simple CORS request (with the verb PUT e.g.) My browser tries to send a ...
0
votes
0answers
102 views

mitm with Docker

I'm trying to capture traffic between two Docker containers ("webserver" and "chrome_client"), using an "intermediate" container in MITM mode. So we have this basic topology: [chrome_client] --> [...
9
votes
1answer
247 views

Current status of SameSite cookie

Recently I got to know about SameSite cookie attribute which is used to mitigate the CSRF attacks. AFAIK SameSite attribute for cookies is implemented in Chrome and some other browsers. Since I'm ...
0
votes
0answers
37 views

Hydra ignore http header usage

My http responses produces a '0' when there a valid user is detected and '1' when an invalid user is detected. I used the following hydra commands: hydra URL http-form-post "/checkUser.php:username=^...
0
votes
1answer
43 views

Can you use Https to prove document was sent from domain?

I'm aware that you can use tools like GPG to both encrypt and sign information. However HTTPS seems to only be used for encryption. The browser shows me the connection is secure, but there is no way ...
2
votes
0answers
50 views

Random Alphabetical String Added to URL

I originally asked this question over at Stack Overflow, but someone there suggested asking here because it might be possible that something malicious may be causing the following issue: Users have ...
1
vote
1answer
57 views

What is the security risks of increasing the maximum number of HTTP parameter?

I want to increase the maximum number of HTTP parameters (maxParameterCount) from 10000 to 20000 in the Tomcat configuration: https://tomcat.apache.org/tomcat-8.5-doc/config/http.html What is the ...
5
votes
1answer
60 views

Blind SQL Injection and HTTP Version Dependency?

I Recently came across a Virtual Machine that has Blind SQL Injection in the X-Forwarded-For header. I used sleep() to detect the vulnerability. The Payload worked in HTTP/1.0 and not in HTTP/1.1 . ...
-1
votes
1answer
52 views

How can this link (and links in general) run javascript through a Google link?

Very recently, the following link has come to my attention: hxxps://google.co.zm/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact=8&ved=...
26
votes
5answers
6k views

Any reason NOT to set all cookies to use httponly and secure

Assuming a site is using all HTTPS all the time (LB redirects port 80 to 443), is there any reason not to force every cookie set by the application to use BOTH secure AND httponly? Currently, for ...
1
vote
2answers
244 views

List of sites that still dont support HSTS?

I'm working on an article for work and seeking a list of the top ~500 websites (ranked by Alexa) that still don't have support for HSTS. Does such a list exist? I'm not getting any interesting hits ...
16
votes
2answers
2k views

Security benefit of browsers automatically rewriting HTTP to HTTPS? [duplicate]

I often use a guest WiFi which does the usual intercept; attempt to navigate to any HTTP website and it redirects you to the "Agree to our ToS" page, after which it will permit any traffic from your ...
-1
votes
1answer
95 views

What do DoS/ DDoS TCP SYN Floods and Layer 7/HTTP floods look like on a firewall log?

I am looking for some examples of log files for DoS or DDoS attacks that show a SYN Flood or a HTTP/Layer 7 Flood. I have had a google, but can't seem to find anything. Would the incoming packet ...
2
votes
1answer
136 views

Is some kind of CSRF possible using img/script tag to read sensitive information

Let's say i have an API at https://mysite/api/getSensitiveData that: Uses GET Protected with cookie authentication Returns JSON with some sensitive data A bad guy creates a site on his server that ...
3
votes
1answer
294 views

BeEF XSS - internal working

I am studying BeEf XSS as I think it is a very interesting tool for a penetration tester, but I have a couple of doubts about it, in particular when linking it to Cross Domain Request. So, in some ...
3
votes
2answers
118 views

Is switching protocols a security measure worth implementing?

We deploy our internet facing applications in multiple vlans and there is a rule that talking from one vlan to the next has to be done in another protocol or an other implementation of the protocol. ...
0
votes
0answers
61 views

Are these HTTP_REFERER from a bot-net? Are they harmful? How should I handle them?

We are getting a huge amount of requests that I can not explain. These request all go to admin.OURWEBSITE.com/api/analyze/, but we do not have an admin subdomain and we do not have an api/analyze ...
2
votes
2answers
74 views

Why return successfully to non-allowed origins

As I understand it, with CORS, on cross-origin requests, the browser will send an Origin header, and if the origin isn't allowed, the server will still send back a 200 response with a non-matching ...
0
votes
0answers
25 views

Implementation of HTTP Public Key Pinning [duplicate]

I am trying to implement HTTP Public Key Pinning and i am having some issues with the certificate. I followed this guide to create the HTTP Response in IIS: https://www.namecheap.com/support/...
4
votes
1answer
146 views

Linksys Router Tried To Access Local Website

I'm running a simple Node.JS HTTP server on my computer to test things before I push them to my real server, and forgot to close it when I stopped using it. I just looked at the logs and it shows ...
-1
votes
2answers
77 views

Why have distributions default HTTP package sources instead of HTTPS [duplicate]

Many distributions have HTTP links in their sources list for packages. Proof: https://docs.parrotsec.org/doku.php/mirrors-list https://docs.kali.org/general-use/kali-linux-sources-list-repositories ...