Questions tagged [http]
Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.
1,485
questions
1
vote
3
answers
133
views
Is there a security reason why few CAs offer IP-based SSL/TLS certificates?
I’ve heard numerous times that Few CAs offer IP-based SSL/TLS certificates.
This question seems extremely similar, but what the accepted answer says is:
Usual commercial CA won't accept to encode IP ...
- 1,454
0
votes
1
answer
86
views
Is it safe to use HTTP if no sensitive information is being transmitted? [duplicate]
In the interest of security, is it safe to use HTTP (and not HTTPS) on a website where no sensitive information is being transmitted?
On a website that is purely informational, for example, and doesn’...
- 1,454
1
vote
0
answers
80
views
I have an open redirect but it requires referer header
I have a question which I didn't find an answer for :
I have a request like https://mywebsite.com/redirect/**any website to redirect to it**
In the backend, there is a check, where if the website the ...
- 11
1
vote
1
answer
62
views
Basic monitoring of web applications (http headers, HSTS)
I would like to set up som basic monitoring of outgoing traffic for a number of web applications and api´s running in AWS. E.g.
Ensure specific http headers are in place (Content-Security-Policy and ...
- 141
2
votes
2
answers
99
views
How do I capture HTTPS requests with Python if I have full access to the user's computer
Before any of you answer, "HTTPS is built on top of TLS and everything is encrypted"
I need to specify a very important note: I have FULL access to the client's machine (Windows)
My ...
- 21
2
votes
2
answers
68
views
Should an HTTP error 500 triggered by an XSS payload be reported as a potential vulnerability?
So, long story short, I was using an automated vulnerability scanner on a website (bounty hunting is allowed and encouraged,) and it works by injecting payloads in forms and URLs etc., to trigger ...
- 1,454
2
votes
0
answers
40
views
Trying to send a POST request using curl to a HTB machine
I`m trying to perform a SSRF attack on a Hack The Box machine (editorial.htb). I'm trying to send a POST request using curl with the command
curl --data "hckyou.txt" -X POST http://...
- 21
19
votes
4
answers
8k
views
HTTP: how likely are you to be compromised by using it just once?
My question is, if somebody, today, in 2024, sent a password or a credit card number to some random HTTP website just once, how likely is that password or credit card number to be found on a hacker ...
- 188
1
vote
2
answers
207
views
CSRF Prevention Using Signed Cookies And Custom Headers
Recently I was reading about CSRF prevention techniques like Synchronizer Token, Cookie-to-header, and Double Submit Cookie. Cookie-to-header is good for websites using a lot of JavaScript, e.g. SPAs, ...
- 13
1
vote
1
answer
67
views
What are the risk of using http when capturing open events on an email
I want to configure a custom domain for open and click tracking in Amazon Simple Email Service (SES). However, I've encountered a limitation where Amazon SES only allows HTTPS domains for tracking ...
- 196
1
vote
1
answer
56
views
Does the CORS asteriks / wildcard include both encrypted and unencrypted origins?
Does the CORS asteriks / wildcard (*) include both encrypted (https) and unencrypted origins (http)? And is the null origin (i.e., when a local file is doing a xmlhttprequest, or within an iframe ...
- 11
1
vote
1
answer
89
views
Execution profile for web server
I would like to know if there is a way to run an app to exhaustion in terms of all possible outcomes that it can provide.
What do I mean by that:
Let's assume that someone has an (Apache) HTTP Server. ...
- 111
1
vote
0
answers
163
views
Bettercap not detecting HTTPS websites (?)
The built-in sslstripping feature (http.proxy.sslstrip) in bettercap is not working against HTTPS websites in this issue I will be using cygwin.com and winzip.com as an example, as we can see they are ...
1
vote
1
answer
70
views
Command Injection in URLs. Are response codes foolproof indicator of true/false positive?
Take this HTTP request as an example.
GET /directory/blahblah/ping%20interact.sh
Say this request receives any 3xx, 4xx, 5xx HTTP response code. Is it likely or even possible that a backend web server ...
- 11
0
votes
0
answers
75
views
Overcoming Middleware: Exploiting XSS to Retrieve Data
I am attempting to perform an XSS attack on my server and have successfully bypassed the CSP. In my server code, I store all users in the following manner:
.get("/users", adminReq, (req, ...
- 13
0
votes
0
answers
33
views
Is it possible to see HTTPS traffic without intercepting? (With a copy of the traffic) [duplicate]
I have a WAF solution that can work both inline and out-of-band. And we want to try the OOB option first. And possibly want to see HTTPS traffic as well.
But the vendor says if we want to see the ...
- 3
0
votes
2
answers
114
views
Is There a way to exploiting / Make exploit scenario for Header based reflected XSS?
I've found a reflected XSS, but the problem is that the attack vector is the header (any header). Is there a way to develop an exploit scenario based on this?
1
vote
2
answers
71
views
Preventing Data Tampering in HTTPS Requests: Safeguarding User-Initiated Donations
Could a Man-in-the-Middle (MITM) attack compromise the integrity of user-initiated transactions over HTTPS? Specifically, if a user selects an amount to donate on a website, is it possible for a ...
- 13
0
votes
3
answers
1k
views
Using HTTP header to transmit client certificate for mTLS
My client says their API traffic must take the path WAF -> Custom Firewall -> Backend API. Also, mTLS must be terminated after the traffic has gone through the network appliance.
I have created ...
- 101
0
votes
1
answer
210
views
CRLF in HTTP/2 header value
I am attempting to inject a carriage-return + newline in a HTTP request header value. My understanding is that this is possible with HTTP/2 and HTTP/3. However, when I send a request with Burp I get ...
- 32.9k
1
vote
0
answers
97
views
Is it possible to track cross origin redirection?
I can successfully iframe a page on origin B from origin A (no x-frame-deny, content security policy, etc). A page on origin B (page X) redirects to a page on origin C (page Y) with a server side ...
- 113
0
votes
0
answers
112
views
Cache poisoning from rfc6455 (WebSockets) not requiring server message to be masked?
In RFC6455 section 10.3, it explains why they have made clients mask their outgoing frames (so that a malicious server cannot manipulate a client into sending something in plaintext, as the message ...
- 101
0
votes
1
answer
94
views
Can token decryption endpoint response codes variability lead to security vulnerabilities?
To clarify the question, here's our case:
We generate encrypted tokens by applying AES-CBC (256 bit) and Base64 to payload:
encrypted_token = Base64.encode(AES_CBC_256.encrypt(key, iv, payload)).
...
0
votes
0
answers
414
views
How to properly use cURL --data-binary to send a request payload
This question is out of pure curiosity. I know I can send multipart formposts using curl's --form/-F option. However, I was curious to see if the same can be done with the --data-binary option? For ...
- 103
4
votes
2
answers
1k
views
HTTPonly token without CSRF is safe?
How can a hacker steal my session where my form does not have CSRF tokens but my session cookies are HTTPonly? how would he get my session cookie in this case? is this possible?
for example, to be ...
- 43
0
votes
1
answer
197
views
A URL is followed by number, what is its vulnerability?
A URL is followed by a number. Changing the number will change the content of the web page. Now I know it's insecure direct object reference (IDOR). What should I do to fix this vulnerability?
- 1
1
vote
1
answer
386
views
SSRF trough Gopher
Gopher protocol is used a lot when exploiting SSRF, but how?
a Gopher URL takes the form:
gopher://<host>:<port>/<gopher-path>
but let's take this example:
gopher://10.10.10.3:80/...
- 13
1
vote
0
answers
116
views
Can a proxy server view the request and response bodies? [duplicate]
I'm digging into proxies and VPNs to wrap my head around their security aspects. Wondering: can a proxy server sneak a peek at my raw requests and maybe even tweak them a bit? my connections are HTTPs
- 111
1
vote
1
answer
495
views
Is prohibiting cookies a viable CORS alternative?
I have been using lots of various APIs in my frontend lately and they all have to be properly configured with CORS and the browser always do extra OPTIONS request that only make debugging harder.
I ...
- 2,287
1
vote
1
answer
368
views
How do you verify if a request is from a genuine user or from a malicious user?
Consider clientA which wants to verify payments and serverB which verifies payments.
ClientA sends around a million requests to serverB's API in 1 day.
However, only 1% of the requests from clientA ...
- 141
5
votes
0
answers
195
views
Why are HMAC signatures frequently used for webhook authorization but not other HTTP API requests?
HMAC signatures are very commonly used for webhook authorization from service to consumer.
Examples:
Stripe
Slack
Twilio
Twitter
GitHub
and hundreds and hundreds more. This seems a near universal ...
- 1,020
2
votes
0
answers
111
views
How to retrieve TLS unique value from Apache?
TLS unique value is present in TLS 1.2 version.
In Golang, I can get the value of the TLS unique value from the http response through the field TLS.
I'd like know how I can get it from Apache.
Is ...
- 21
1
vote
1
answer
657
views
Is it secure to use session ID as authentication token received from an HTTP header?
I am writing a mobile application for an already existing web app.
In the backend, I implemented the usual cookie-based session ID authentication. with a CSRF token generated on login and sent with ...
- 13
0
votes
0
answers
84
views
Is POST-based XSSI possible?
With standard XSSI, an attacker can include a remote script which contains user-bound secrets across origins, and then read them out.
I have an endpoint which returns sensitive Javascript code, but ...
- 29.7k
24
votes
3
answers
6k
views
Why is the absence of a Content-Type header with a HTTP 204 response considered a security vulnerability and what should we do about it?
We have recently developed a web application with a RESTful API backend. This web app need to have a certain security certification (something called PCI-DSS), and thus it is being scanned ...
- 343
0
votes
1
answer
294
views
Burpsuite proxy does not get HTTP error 429 but vanilla python requests do?
When I make a normal python request to some site without any proxies I am getting a 429 response, too many requests. However when I open up burpsuite proxy and add
proxies = {
"http": &...
0
votes
1
answer
221
views
Is a random unknown HTTP request header 'Host' that is reflected in the HTTP response 'Location" header (3xx) a open redirect or DNS rebinding?
If I send an unknown domain name in the HTTP request header 'Host' to a webserver and the webserver responds with a HTTP status code 301/302 (redirect) along with a HTTP response header 'Location' ...
- 6,745
2
votes
1
answer
940
views
Should the use of the HTTP 'ETag' header be avoided for security and privacy concerns?
I'm looking into the risks associated with the use of the HTTP 'Etag' header and found the following relevant information already.
Information Disclosure (inodes)
This article titled: "...
- 6,745
12
votes
4
answers
7k
views
What security risks are involved in using older HTTP protocols such as HTTP/1.x that would justify upgrading to HTTP/2 or HTTP/3?
As of 2023, still many webservers support HTTP/1.0 and HTTP/1.1 while not supporting recent HTTP/2 and/or HTTP/3 protocols. I understand that newer HTTP versions offer various performance enhancements,...
- 6,745
0
votes
4
answers
569
views
Is HTTP/0.9 considered "End-of-Life" (EOL) due to security vulnerabilities or risks?
I'm exploring the history and evolution of the HTTP protocol and I know that HTTP/0.9 is generally not used anymore. It's clear how features evolved in newer HTTP versions and how primitive HTTP/0.9 ...
- 6,745
0
votes
1
answer
270
views
Is HTTP/1.0 inherently more susceptible to denial-of-service (DoS) attacks?
I'm looking into HTTP version specific risks. HTTP 1.0 lacks support for persistent connections, meaning each request/response pair requires a new TCP connection to be established.
Considering the ...
- 6,745
0
votes
0
answers
117
views
TLS session keys [duplicate]
I Have a confusion here.
From what I know, in TLS1.2, the Client sends Client Hello and then the Server Sends a Server Hello, Certificate(with its public key) and Certificate chain, and then a Server ...
- 133
1
vote
1
answer
160
views
Is it reasonable to have a product that requires LLMNR or mDNS?
I am trying to figure out the best way to manage security certificates for embedded devices who's webpage is accessed via IP address, and then the scenario for when that IP address changes.
Currently, ...
0
votes
2
answers
213
views
What are the security risks associated with hosting a web application that does not handle sensitive data without HTTPS?
Suppose one hosts a web application that does not handle any sensitive data (e.g. passwords, session cookies, etc.), without using HTTPS. What potential security issues arise as a direct consequence ...
- 11
0
votes
1
answer
122
views
Why does the DOM single-origin policy take into account protocol and port? What if it was just domain?
I'm learning the basics of network security and am trying to really understand the single origin policy. I was wondering what the vulnerabilities would be if an origin was only defined by domain, as ...
1
vote
2
answers
197
views
How to prevent attacks on a personal webserver
I'm currently working on some modules on hackthebox. In that regard, I recently set up a web service: sudo python3 -m http.server 8080
When I did a wget to my server, it showed up in the log as usual, ...
- 39
1
vote
1
answer
273
views
"PUT /SDK/webLanguage HTTP/1.1" on a server with only port 22 open
I've recently spun on a new droplet on Digital Ocean with Ubuntu 22 and enabled UFW and allowed only SSH, which reports being active even after a reboot:
sudo ufw status
Status: active
To ...
- 13
1
vote
1
answer
345
views
What happens first in a request having both CSRF Token and JWT token, authentication or authorization?
This question came across my mind when I sent an ajax request from html to a backend django server and forgot to add a csrf token to the request payload and recieved this error.
403 error means that ...
1
vote
1
answer
524
views
How secure is HTTP auth digest in 2023
I'm trying to figure out the time needed to crack an HTTP digest auth. According to the RFC2069, the digest in calculated according to this scheme :
HA1 = MD5(username:realm:password)
HA2 = MD5(method:...
- 589
0
votes
1
answer
223
views
Applying application-level signing in HTTP
I have to secure HTTP requests`s body on application layer, so I wanted to generate signatures with hash of body and the receiver will validate it.
But I can do it in different way and apply it into ...
- 371