Questions tagged [http]

Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.

Filter by
Sorted by
Tagged with
0
votes
1answer
62 views

Is end to end encryption over HTTP safe?

If you wrap all your data in an end-to-end encrypted payload is it safe to transmit over HTTP or at worse case self signed HTTPS instead of traditional CA signed SSL?
0
votes
0answers
12 views

Is mime-sniffing still something to protect against with modern browsers (with X-Content-Type-Options)?

I have read about X-Content-Type-Options and it says often that it protects against IE mime sniffing problems. I am wondering if in 2021 it is still valid and a problem for modern browsers? In other ...
0
votes
0answers
35 views

How to configure Google to only search for SSL/TLS-encrypted websites? [migrated]

Is there a way to configure the Google Search Engine to only search for SSL/TLS-encrypted websites? What I mean by that is that when I google something, only websites with a valid HTTPS certificate ...
1
vote
1answer
37 views

Does enabling SharedArrayBuffers via service worker headers create Spectre vulnerability?

In browsers, use of SharedArrayBuffer is restricted to sites with the following HTTP headers because otherwise it exposes vulnerabilities to Spectre and Meltdown. Cross-Origin-Embedder-Policy: require-...
1
vote
1answer
66 views

THC Hydra sends GET request without parameter before actual request with parameter which causes authentication problems

I am using THC Hydra (v9.0) on GNU/Linux to pentest my private API. The GET route in question requires a key as GET parameter which returns an auth token if the correct key was submitted else "...
1
vote
1answer
97 views

Ramifications of including "localhost" in the subject alternative field of a x509 certificate?

Are we inviting any problems if we add localhost and 127.0.0.1 to the subject alternative name field of an x509 certificate? We are still trusting the appropriate root CA, but relaxing the rules of ...
0
votes
1answer
58 views

Is it bad practice or major security risk to cache decoded auth tokens in my backend?

I've set up a firebase passport strategy on a NestJS server which works fine, but I did not like the long load times it would incur on all requests that went through it. So I decided to cache decoded ...
2
votes
1answer
134 views

With HTTPS-only mode in Firefox, may I still need HTTPS Eveywhere addon?

Firefox has a built-in toggle in settings to enforce HTTPS-Only mode. When enabled, the browser attempts to redirect to HTTPS every time and, if fails, blocks access to the website in the same way ...
0
votes
0answers
46 views

How is web cache poisoning possible?

There is a lot of literature out there about this, and I've read many of it, but one question I couldn't rectify is this. Consider this quote from netsparker.com: Reflected unkeyed headers: If the ...
1
vote
0answers
18 views

Suspicious HEAD http requests [duplicate]

On my Windows 10 machine, I run mitmproxy on localhost:8080. I've changed the system proxy setting to point to my local proxy server. Apart from what I expect to see, I can also see the following HEAD ...
0
votes
1answer
59 views

How to encrypt http traffic in an offline enterprise network?

I am building a golang offline application for a company that will operate in their office internal Wireless / Wired Network. There will be one server computer and many client computers communicating ...
0
votes
0answers
49 views

Help with hydra https-post-form

I am doing portswigger labs with hydra https-post-form. I try to look for packets that don't have status code 200 OK, because when checked in burp my failed login with bad password and good username ...
1
vote
2answers
208 views

How to prevent spoofing of X-Forwarded-For header?

X-Forwarded-For header can capture the IP of the client and use this IP to implement access control. However, the X-Forwarded-For header can be easily spoofed or manipulated. How to prevent this or is ...
0
votes
0answers
41 views

CWE-915 (overpost/mass assignment) and antiforgery when not saving posted object to storage

Veracode has found overpost or mass-assignment flaws (CWE 915) in our MVC portal. Technically, this is true, but I am wondering how much of an effort we would need to put into this, especially since ...
0
votes
1answer
64 views

Does a http proxy (ziproxy/squid) encrypt communication between client and server

I've read a lot of similar questions, with long answer, and they are making me confused, so for a quick yes/no question. If I, access a https webpage via an http proxy (my own proxy) (like ziproxy/...
3
votes
1answer
247 views

Hijacking URL that ends with a trailing slash

I am pentesting an API which makes a backend call to https://example.org/ and appends any input you provide it (for example, if you provide test it will call https://example.org/test). I am trying to ...
0
votes
1answer
102 views

How could someone exploit a host header injection vulnerability that only effects the responses Location header?

If I go to the http site e.g. http://www.example.com the site will redirect (code 301) to the https version https://www.example.com. On various pentests I observed that if I modify the Host header in ...
1
vote
2answers
96 views

Is there way to know what headers can be accepted by HTTP server?

Imagine that there is server required authentication for getting an access to some endpoint. And developer added some logic to bypass the authentication: if server recieve HTTP header give_me_access=...
1
vote
0answers
38 views

Security implications of an HTTP POST endpoint that accepts arbitrary HTML and returns it back

For generating PDFs in our web application we have a simple service that accepts a chunk of HTML from the client, wraps it in a standard template, does a couple of simple transforms (like replacing ...
2
votes
1answer
77 views

"Trusting" the Host header in a port-forwarding environment

A similar question has be answered here already, but I have a very specific scenario in which it didn't fulfil my requirements. I am setting up an environment which includes a web-service running on ...
0
votes
0answers
61 views

Can an SSL certificate be edited? [duplicate]

First of all I want to say that this question is not a duplicate. What I want to know(And possibly get reasons) is if it's able to edit SSL certificates. In more depth, let's say I have a server on my ...
0
votes
0answers
38 views

Should I hide the difference between Not Found error and Access Denied error in my API?

I have a system that has different entities stored in the database with an integer Id as a primary key. There are different scenarios for queries that cannot be processed: Get entity by id [Entity ...
0
votes
2answers
94 views

Is there any reason to block HEAD requests?

Apologies if this isn't the right place to ask this. I occasionally get alerts from my Django website along these lines: Internal Server Error: /posts/specific-post/ UnboundLocalError at /posts/...
0
votes
0answers
38 views

Running ARP Spoof disables internet access on target machine, doesn't intercept traffic as well

So I'm learning to run MITM attacks on my own WiFi network but I seem to be running into an issue. I'm following this tutorial. The process is simple and I'm running the attack from my Ubuntu laptop. ...
0
votes
0answers
56 views

What is this HTTP attack full of backslash encoded data? [duplicate]

I use nginx configured with HTTPS and an unsigned cert to send files to people sometimes. Despite being just an IP address listed no where, I get traffic from various crawlers and other bots. The ...
0
votes
0answers
58 views

What will happen if https traffic goes through the WAF? [duplicate]

A web application firewall (WAF) is an application firewall for HTTP applications. It applies a set of rules to an HTTP conversation. Generally, these rules cover common attacks such as Cross-Site ...
1
vote
1answer
55 views

Should I be concerned about timing attacks on HTTP service for passwordless signin?

I have an service that accepts an HTTP POST request from the end-user's browser. The user passes their only email. I intend the server to generate a token and store this in a database, and email them ...
0
votes
1answer
37 views

How strict should I be in rejecting unexpected HTTP request parameters redux?

I read this: How strict should I be in rejecting unexpected query parameters? Answer: No, do not error out on unexpected query string parameters. But I just got a requirement from our security guy ...
0
votes
0answers
27 views

Is Cache-control: no-store enough to prevent caching? [duplicate]

I have researched and understood that Cache-Control: no-cache is not sufficient alone to absolutely prevent caching, but what about Cache-Control: no-store alone? Since it will not allow storing of ...
0
votes
1answer
113 views

Changing $_SERVER['REMOTE_ADDR'] remotely

On a nginx web-server running the following config is to possible to change $_SERVER['REMOTE_ADDR'] remotely?: user www; pid /run/nginx.pid; error_log /dev/stderr info; events { ...
1
vote
1answer
51 views

Is this HSTS HTTP Response Header Misconfigured?

I recently discovered during a penetration test that the HSTS was returned by the application but in this format: "Strict-TransportSecurity" Instead of: "Strict-Transport-Security" ...
1
vote
0answers
51 views

How following URL's will get open-redirection?

Reading about open-redirection from web application hackers handbook came across a test case in which the server-side is validating user supplied data that the application uses to set target for ...
0
votes
1answer
266 views

Storing Session Id in application logs

Short version: Is it not recommended to store sessionId in log files/database in plaintext (considering it may put active sessions at risk)? If yes, why do I see many queries on how to log sessionId? ...
1
vote
1answer
590 views

Spam GET And POST Requests - Are They Dangerous?

I am getting a lot of spam GET and POST requests lately which some of them look like this: "GET /config/getuser?index=0 HTTP/1.1" 404 143 "-" "Mozilla/5.0 (X11; Ubuntu; Linux ...
0
votes
0answers
52 views

Can Chrome's HTTP HEAD requests be misused to launch an attack?

When I used Chrome today via Burp, I noted that, apart from the tracking requests, three random HTTP HEAD requests are sent each time I open the browser. I already found How to find a process that is ...
0
votes
1answer
132 views

Torrent sites on the onion network being served over http

I've noticed that torrent websites like the Pirate Bay are served over http. This means that when using a network like the Tor onion network, where the first server in the response chain receives the ...
10
votes
4answers
4k views

Can a cloned page have HTTPS certificates?

Imagine that a hacker is cloning Twitter or Facebook. The attacker uses his own website, but it is going to be HTTP, right? So can he have the certificates that ensure that his website is "secure&...
0
votes
0answers
70 views

Uploading php webshell using Burp Intruder

I am using Burp Intruder to upload a webshell to different directories. These 400 responses tell me the requests are bad. I should be getting mostly 403 responses or maybe if I'm lucky the goal ...
1
vote
1answer
48 views

In which settings is it possible to launch a HTTP Response Splitting Attack but not completely replace the HTTP message?

I wondered in which settings is it possible to launch a HTTP Response Splitting Attack but not completely replace the HTTP message? The examples I saw all allowed full replacement of the HTTP response,...
0
votes
0answers
50 views

SSL stripping - how is it possible to send back the HTTP page? [duplicate]

Been trying to wrap my head around SSL stripping. An explanation here writes: Keep in mind, however, that when you install SSL, you’re essentially creating a duplicate of your website with HTTPS URLs....
0
votes
1answer
114 views

Default behavior cookie flags in 2021

I'm under the understanding that in 2019, Chrome and Firefox both planned to move to SameSite=lax default for all unspecified cookies. In addition, recently, Chrome decided to set defaults based on ...
0
votes
2answers
113 views

How can I find out whether my browser traffic can be intercepted?

In theory, visiting a website with HTTPS and seeing the neat, little lock icon next to the address (e.g.: ) should give us a warm, cozy feeling of safety. However, how safe is it really? As it stands, ...
1
vote
3answers
171 views

ubuntu sources.list urls are not HTTPS -- what risk does this present, if any?

I was looking at the installation instructions for VS Code today and found this step curious: sudo apt install apt-transport-https I see that there appears to be https transport available for apt: $ ...
1
vote
0answers
56 views

OAuth for command line application

I'm planning to add an "official" command line tool for developers to interact with our API. The tool is basically just a glorified curl client, interacting with the API via HTTPS ...
1
vote
2answers
119 views

Is it secure to send personal data via HTTPS?

On the website of some company, it is possible to send personal data using a form. The browser I'm using says that the connection is secure. Is it completely secure to send personal data via the form? ...
0
votes
0answers
45 views

Confidentially seperating web content under single IP address

I am interested in exposing web content to strangers on the internet (Reddit, Discord, ..). This content I wish to reside on the same web server under which personal web content resides. (None of this ...
0
votes
0answers
233 views

How to disable the use of verb tunneling using such headers or query parameters in .NET?

I'm failing a security scan that is saying my .NET application is allowing verb tunneling and the recommendation is to disable this. The application needs to accept PUT and DELETE headers as well as ...
1
vote
1answer
66 views

Making website queries and return a large amount of data, can it be exploited for DOS attack?

I am testing a website (bug bounty website) and found an endpoint like replycomment?cmt_id[]=1. When open on browser, this endpoint let me reply to comment with id 1 by fetching this comment into a ...
0
votes
0answers
274 views

JWT token. Send in a cookie or Auth header depending on Rest vs MVC?

Reading around I gather that for a Restful API since you don't use cookies,then you send the token in the Auth header.Correct so far? When on a traditional MVC app ,do you send the token inside a ...
0
votes
2answers
72 views

On a server to server SSL connection is there any trustable information identifying the calling server?

Imagine server A calling server B over SSL and that both servers have SSL certificates installed. Later server A again calls server B. Is there a way for server B to know that server A is the same ...

1
2 3 4 5
27