Questions tagged [http]
Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.
1,457
questions
0
votes
0
answers
51
views
Codeigniter website is hacked regularly by an unknown method [closed]
I have developed a website with codeigniter 3 and I have also updated it to the latest version of codeigniter.
My website has been hacked in the same way for several days.
The hacker puts two files in ...
- 101
0
votes
0
answers
19
views
Is POST-based XSSI possible?
With standard XSSI, an attacker can include a remote script which contains user-bound secrets across origins, and then read them out.
I have an endpoint which returns sensitive Javascript code, but ...
- 29.5k
24
votes
3
answers
5k
views
Why is the absence of a Content-Type header with a HTTP 204 response considered a security vulnerability and what should we do about it?
We have recently developed a web application with a RESTful API backend. This web app need to have a certain security certification (something called PCI-DSS), and thus it is being scanned ...
- 343
0
votes
1
answer
36
views
Burpsuite proxy does not get HTTP error 429 but vanilla python requests do?
When I make a normal python request to some site without any proxies I am getting a 429 response, too many requests. However when I open up burpsuite proxy and add
proxies = {
"http": &...
0
votes
1
answer
35
views
Is a random unknown HTTP request header 'Host' that is reflected in the HTTP response 'Location" header (3xx) a open redirect or DNS rebinding?
If I send an unknown domain name in the HTTP request header 'Host' to a webserver and the webserver responds with a HTTP status code 301/302 (redirect) along with a HTTP response header 'Location' ...
- 6,661
1
vote
1
answer
148
views
Should the use of the HTTP 'ETag' header be avoided for security and privacy concerns?
I'm looking into the risks associated with the use of the HTTP 'Etag' header and found the following relevant information already.
Information Disclosure (inodes)
This article titled: "...
- 6,661
11
votes
3
answers
5k
views
What security risks are involved in using older HTTP protocols such as HTTP/1.x that would justify upgrading to HTTP/2 or HTTP/3?
As of 2023, still many webservers support HTTP/1.0 and HTTP/1.1 while not supporting recent HTTP/2 and/or HTTP/3 protocols. I understand that newer HTTP versions offer various performance enhancements,...
- 6,661
0
votes
3
answers
166
views
Is HTTP/0.9 considered "End-of-Life" (EOL) due to security vulnerabilities or risks?
I'm exploring the history and evolution of the HTTP protocol and I know that HTTP/0.9 is generally not used anymore. It's clear how features evolved in newer HTTP versions and how primitive HTTP/0.9 ...
- 6,661
0
votes
1
answer
75
views
Is HTTP/1.0 inherently more susceptible to denial-of-service (DoS) attacks?
I'm looking into HTTP version specific risks. HTTP 1.0 lacks support for persistent connections, meaning each request/response pair requires a new TCP connection to be established.
Considering the ...
- 6,661
0
votes
0
answers
33
views
TLS session keys [duplicate]
I Have a confusion here.
From what I know, in TLS1.2, the Client sends Client Hello and then the Server Sends a Server Hello, Certificate(with its public key) and Certificate chain, and then a Server ...
- 133
1
vote
1
answer
53
views
Is it reasonable to have a product that requires LLMNR or mDNS?
I am trying to figure out the best way to manage security certificates for embedded devices who's webpage is accessed via IP address, and then the scenario for when that IP address changes.
Currently, ...
0
votes
2
answers
160
views
What are the security risks associated with hosting a web application that does not handle sensitive data without HTTPS?
Suppose one hosts a web application that does not handle any sensitive data (e.g. passwords, session cookies, etc.), without using HTTPS. What potential security issues arise as a direct consequence ...
- 11
0
votes
1
answer
28
views
Why does the DOM single-origin policy take into account protocol and port? What if it was just domain?
I'm learning the basics of network security and am trying to really understand the single origin policy. I was wondering what the vulnerabilities would be if an origin was only defined by domain, as ...
1
vote
2
answers
109
views
How to prevent attacks on a personal webserver
I'm currently working on some modules on hackthebox. In that regard, I recently set up a web service: sudo python3 -m http.server 8080
When I did a wget to my server, it showed up in the log as usual, ...
- 19
0
votes
0
answers
53
views
HTTP Request Smuggling Exploit - Need Clarification on Behavior of the 'Host' Header
I've been reading about HTTP Request Smuggling attacks and I've come across a situation that I don't fully understand. I've been studying the report by James Kettle where he describes an attack ...
- 1
1
vote
1
answer
98
views
"PUT /SDK/webLanguage HTTP/1.1" on a server with only port 22 open
I've recently spun on a new droplet on Digital Ocean with Ubuntu 22 and enabled UFW and allowed only SSH, which reports being active even after a reboot:
sudo ufw status
Status: active
To ...
- 13
1
vote
1
answer
114
views
What happens first in a request having both CSRF Token and JWT token, authentication or authorization?
This question came across my mind when I sent an ajax request from html to a backend django server and forgot to add a csrf token to the request payload and recieved this error.
403 error means that ...
0
votes
1
answer
264
views
How secure is HTTP auth digest in 2023
I'm trying to figure out the time needed to crack an HTTP digest auth. According to the RFC2069, the digest in calculated according to this scheme :
HA1 = MD5(username:realm:password)
HA2 = MD5(method:...
- 569
0
votes
1
answer
73
views
Applying application-level signing in HTTP
I have to secure HTTP requests`s body on application layer, so I wanted to generate signatures with hash of body and the receiver will validate it.
But I can do it in different way and apply it into ...
- 309
0
votes
1
answer
75
views
CWE for "Misconfigured server allows insecure https request to IP-addressed URL"?
I'm doing a vulnerability assessment for a whole slew of web servers, and almost every single one of them (hundreds) are misconfigured like the following two examples:
Case 1: one or more hostnames ...
- 321
-2
votes
3
answers
382
views
Could someone hack into my website through http ports?
Let's say ports 80 and 443 open for my website hosted by Amazon AWS. Could someone figure out a way to exploit somehow or is that just nearly impossible and something no one would need to worry about?
0
votes
0
answers
33
views
I clicked on a SMS spam link. Am I safe? [duplicate]
I received an SMS from an unknown number with a link. Having just ordered stuff from AliExpress bit earlier so, thinking it was related to that, I clicked without doing due diligence. My bad.
I went ...
- 123
2
votes
2
answers
398
views
When using double submit cookies as protection against csrf, does it matter where the random key is created?
I have a stateless backend and a spa-frontend. Except for the login request, all requests are secured by a jwt in the header.
Additionally the application should now be secured against csrf. Since the ...
- 121
1
vote
1
answer
374
views
Are CORS headers useless?
It is common to say that CORS headers protect against CSRF, so that if you visit a malicious website, it cannot make a request to your web application because the referer header (the URL of the ...
0
votes
1
answer
211
views
What vulnerability query params or body outside a whitelist can allow?
For instance, suppose we have a request that uses the field name in a request's body or query params, but the client sends the params name and age. Some web server frameworks allow us to strip ...
0
votes
2
answers
523
views
What is a proper way to prevent parameter tampering and to make parameter secure
I'm developing a HTTP web server. I've used HTTPS as the protocol between client and server but I know that HTTPS can't prevent parameter tampering.
As we know, we can set parameters in URL, in HTTP ...
- 341
0
votes
0
answers
34
views
A Potential threat in HTTPS [duplicate]
HTTPS security is based on the chain of trust. The initial trusted party (root authority) signs a certificate for some other party and then it can sign for some other.
Does that mean If I have a valid ...
0
votes
1
answer
110
views
How to safely share data between 2 SPAs?
Let's say I have 2 SPAs (single page applications), SPA A and SPA B.
I want to share data between the 2 applications for an end-to-end flow.
How can I safely share data such that it would not be ...
- 113
0
votes
1
answer
158
views
How to reliably identify referrer on client browser?
Is there any way to reliably identify the referring site on modern browsers (not considering manual HTTP requests outside of a browser e.g. cURL, etc.)?
Referrer header will not work because the ...
- 113
0
votes
1
answer
145
views
Is API client responsible for HTTP security headers?
When client (Postman for example) is making the request to server, is the client responsible for including the HTTP security headers in the request?
Or is the server responsible for defining these ...
- 1
0
votes
0
answers
172
views
How to combine multiple HTTP requests into one on burp suite?
How do I combine multiple HTTP requests into one on burp suite? I am trying to do this in Burp Intruder in a way that each request is detected as a separate request but I send it all in one request ...
- 285
0
votes
2
answers
573
views
Is an API call to HTTPS endpoint encrypted?
If API client (Postman for example) makes a call to an exposed HTTPS API endpoint, is the communication between client and server encrypted?
- 1
1
vote
1
answer
350
views
How does DNS prefetching endanger security/privacy?
I would like a comprehensive explanation of the security and privacy risks that come with DNS prefetching. There are already other posts about this topic, but I want current information and feedback ...
- 113
4
votes
7
answers
5k
views
Understanding of HTTP GET request
I am initiating and doing a basic penetration testing course and have come across one doubt.
For example in this URL:
http://webapp.thm/index.php=?page=1
I get that I am requesting the index.php file ...
1
vote
3
answers
983
views
What exactly are Hidden HTTP Parameters?
I read a lot of reports where 'hackers' potentially exploited a 'Hidden HTTP Parameter'. There are also tons of tools which are developed for this exact purpose.
Example : https://blog.yeswehack.com/...
- 41
1
vote
1
answer
140
views
How does the client get the certificate (and public key) of the delegated authority (OCSP responder) to confirm the response in OCSP?
I have one question regarding the OCSP protocol to check if the certificate is revoked or not. The question is about checking whether the intermediate CA certificate immediately below the root CA is ...
- 113
1
vote
2
answers
198
views
Using asymmetric encryption as authentication over HTTP?
I've read questions targeting the usage of basic authentication over HTTPS. Since the connection is already secure, except e.g. a compromised certificate, communication should be rather safe.
But I ...
1
vote
1
answer
431
views
What are these http requests trying to break?
I recently started receiving some really strange http traffic, and I'd like to understand what it's trying to do. Some of it seems like sql injection attempts, but the strings are appearing in the ...
0
votes
0
answers
215
views
Trying to understand HTTP request containing base64 encoded part and email address
I have public webserver serving static html pages and when analyzing error logs I found type of attempted GET that I don't understand.
They are formed like this and fail because request is too long:
/...
- 101
1
vote
2
answers
438
views
Malware prevention of data received in a POST endpoint
Problem
Having one HTTPS api which has an endpoint i.e POST data how can we prevent/check that the data received is not malicious or possibly detrimental?
To consider (please read)
POST data receives ...
- 65
1
vote
3
answers
885
views
POST over HTTP: Is it ever safe to post sensitive information?
I know HTTP is insecure because the data transmitted is not encrypted.
I made a web application, however, that the frontend and backend are hosted on different servers. The backend itself is ...
- 133
1
vote
3
answers
265
views
How to build a PSK website
Pre-Shared Key (PSK) with simple symmetric encryption is a popular way of solving both client and server authentication when SSL cannot be used for some reason (for example, can't trust or deal with ...
- 379
1
vote
1
answer
181
views
Why doesn't iptables command take effect on my embeded Linux?
I'm running an embedded Linux system, whose kernel is 3.18.21, with some applications on top it on MIPS. When I run iptables & ip6tables on the Linux, such as the following:
iptables -A INPUT -p ...
- 123
1
vote
0
answers
60
views
Does it ever make sense to use TLS for communication that only happens internally on one machine? [duplicate]
If two processes on the same machine communicate over TCP, is it possible for different users to listen in on this communication?
- 537
0
votes
1
answer
122
views
Signed but Unencrypted HTTP Traffic
A lot of the web is moving to HTTPS, which to my understanding does two things: Making the data unreadable by third parties, and verifying it's coming from the expected sender.
The latter seems ...
- 101
0
votes
1
answer
233
views
How dangerous is it to visit a website?
I visited theannoyingsite (not hyperlinked because it is a nightmare)
It tells you to press space for three seconds, and then it unleashes hell upon your senses. Loud noises, bouncing windows, ...
3
votes
1
answer
392
views
Are HTTP security headers only for web browsers?
There are some HTTP security headers in the world of cyber security of web applications. These are e.g.:
X-Content-Type-Options
X-Frame-Options
Content-Security-Policy
Referrer-Policy
Strict-...
- 529
0
votes
0
answers
1k
views
Best port to setup Outline VPN for obfuscation
Many outline access keys use a random port but some do 443, I’ve found out since port 443 is for http its harder to find out that port is using a vpn.
So the question is, why don’t other Outline ...
- 11
13
votes
3
answers
6k
views
Understanding suspicious HTTP GET Request
I was looking through my Apache log files and besides other GET requests with response status codes of 4XX (error), I've found this one which has a 200 (success) response status code:
"GET /?...
- 163
2
votes
2
answers
350
views
If a computer gets infected with malware, can the host firewall block the malware from communicating back to its controller on the internet?
I'm trying to figure out how secure a host firewall is, hence the question in the title.
I read that many firewalls allow outbound connections to port 80 to allow browsing, would that be enough for ...
