Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Make your voice heard. Take the 2019 Developer Survey now

Questions tagged [http]

Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.

1
vote
1answer
59 views

Is it possible to intercept HTTPS payload with a trusted CA but send it the wrong server?

I have a CA generate a cert and private key for my server. My server, however, does not have a domain name and its IP is dynamic and never static therefore validation of the host name must be ignored ...
0
votes
2answers
75 views

How to check Google SSL certificate?

I encountered this error on Google Chrome on my Windows 10. I solved it by installing the certificate and now it is working fine. I wonder, how do I know the certificate I have is legit? That is, ...
0
votes
2answers
68 views

Can my computer get hacked if I use a local server for development only? For example WAMP?

If I use software like WAMP to test and develop my PHP websites, can someone access my computer and steal data or view my in-development websites, or even hack my computer?
-1
votes
0answers
17 views

A strange problem about size limit in http header [closed]

Context: i maintain a kind of web service server, but with a particular implementation: all data sent by the web service are located in the http header. That means there is only http header in the ...
0
votes
0answers
42 views

Secure https communication between two applications on same system

I have two applications running on the same computer. These applications need to communicate with each other. One application acts like a server and the other like a client. Client <-> Server ...
0
votes
2answers
67 views

Why is the SSL message red?

The site Phonel.ir uses a SSL certificate. Why is the Error message in red? Is there a problem with the SSL certification? I sometimes use a proxy. Can that be the reason?
0
votes
1answer
33 views

HSTS mixed with HTTP resources

We have a container site which implements HSTS and a video sharing site which is using HTTP only and doesn't have TLS implemented, nor will it. How does one avoid mixed content in container site and ...
0
votes
1answer
92 views
+50

SameSite cookie attribute and Synchronizer Token Pattern

Recently most browser have added support to the SameSite cookie attribute to prevent CSRF attacks: https://www.owasp.org/index.php/SameSite Question if it is supported should we implement ...
1
vote
2answers
65 views

Why do browsers disallow accessing files from local file system even if the HTML document is also on the local file system?

Many browsers do not allow you to access files on the local filesystem with JavaScript (even if the HTML document is also on the local filesystem). (source) Yes I know that the solution is to "...
1
vote
1answer
77 views

What kind of redirect of websites is this? [closed]

Some websites can redirect you, but they're not using http 301 or 302. After that the url will be changed and you can't go back to the previous page using your web browser's back button. For example, ...
0
votes
0answers
16 views

Java http proxy burp

I have a web application which downloads and executes a jnlp file to launch an applet. Using javaws I set a proxy under the network settings at 127.0.0.1 port 8080. Is this enough to monitor through ...
3
votes
1answer
37 views

Is self signed certificate secure for personal use if verified before access? [duplicate]

I made a simple streaming server with self signed certificate. Is it secured enough if I manually check my certificate? My server also has password.
0
votes
0answers
38 views

Configure burp to intercept JNLP

I am monitoring a site where there is an applet. To use it, there is the download and the execution of a jnlp file. I would like to monitor the requests made from and to that file through Burp. I read ...
1
vote
0answers
15 views

Is HSTS necessary or can I just write .htaccess code to always redirect http to https? [duplicate]

Is HTTP Strict Transport Security (HSTS) necessary or can I just write regular .htaccess code to always redirect http to https?
0
votes
0answers
49 views

How can I found a source of HTTP request in Wireshark?

There are weird requests to/from the AWS: and another one to/from 177.143.198.104.bc.googleusercontent.com: ( http://whois.domaintools.com/177.143.198.104 ) I use Ubuntu 18.04 Desktop, web browsers ...
13
votes
3answers
2k views

Why should someone block all methods other than GET and POST in a RESTful application?

TL;DR: Is there a valid reason to demand a software vendor to stop using HTTP PUT and DELETE methods in a web application and use only GET and POST? The application uses frameworks to whitelist ...
2
votes
1answer
67 views

Should HTTP Security headers be configured for all servers?

I recognise the importance of configuring HTTP security headers (X-Frame-Options, X-XSS-Protection and X-Content-Type-Options) for web servers (and other internet facing servers such as loadbalancers)....
1
vote
1answer
133 views

Bettercap 2.x SSLStrip Is Not Converting Links

I posted this before. I am creating a new post because of all the changes I would need to [edit] out. I have the latest version of bettercap. I have the latest version of Kali Linux using the latest ...
1
vote
0answers
26 views

Origin VS Authority and Domain certificates and Unique IPs

Disclaimer, I am new to InformationSecurity, so sorry if I not following rules as good as expected. I asked this post on stackOverflow, and I was suggested to transfer it here So far I get: Origin = ...
1
vote
1answer
191 views

Bettercap 2.x SSLStrip Is Not Breaking TLS (Without HSTS)

I have the latest version of bettercap. I have the latest version of Kali linux using the latest version of VirtualBox on the latest version of Windows 10. My target machine is the lowest possible ...
-1
votes
1answer
36 views

If I send request with PUT, and server return valid page with 403 status. This is correct work? [closed]

I send PUT. Server returned 301 status to valid http-address(!), but next response 403 status to hhtp-address. If I copy/paste this address all works correct. Please, say me: this is correct response ...
1
vote
1answer
90 views

Internal HTTP(s) vulnerabilities

We use Rapidfire + network detective where I work, for doing non-intrusive internal scans on all of our clients' networks. Every week; half of the tickets I get for this are port 80/443 ...
1
vote
1answer
58 views

Is there an any risk with HTTP header value reflection?

This website has a header in the request (If-None-Match) and whatever you set the value to for it, the response will contain a header (ETag) with the value of the If-None-Match header. I understand ...
0
votes
1answer
44 views

Which HTTP Compression should I use (and how?)

I know that there are multiple HTTP Compression tools out there. In order to entirely prevent a site from being susceptible to BREACH, which HTTP Compression algorithm should I use? Also, how ...
1
vote
0answers
59 views

How to bypass NTLM HTTP authentication?

Is there any way to bypass HTTP authentication rather than brute-forcing ?
3
votes
1answer
176 views

How do I make safe login-emails? (GET/POST) [duplicate]

Vision I envision a login/signup-system, where the user enters his/her email, and receives an email with a link to sign in. The user clicks the link, and is automatically signed in (confirming the ...
1
vote
3answers
177 views

How to prevent unauthorized users from accessing an image on my server just by URL?

I have a few dynamically generated images on my server (of high business value), which are supposed to be viewed only via our mobile app. The image is simply loaded from the URL as PNG. How can I ...
3
votes
1answer
78 views

Why does not Referer header use “same-origin” by default?

Same origin policy is an important part of the security model so it is "on" by default for most things, but for the referer it does not seem to be so. The default for browsers seem to be no-referrer-...
0
votes
2answers
85 views

Does HTML Purifier (which converts & to &amp;) prevent HTTP parameter pollution?

If a REST endpoint (http://example.com) reads the p query parameter and pass it along to another endpoint: http_get("http://example.com/api2?p=".$_GET['p']); I will be able to exploit it by ...
26
votes
10answers
10k views

How to secure passwords over HTTP?

Say my password is abc. I want to send it to the server over HTTP. I could send it in plaintext and let the server hash it and compare it to the entries in its database, but then anyone that can see ...
0
votes
1answer
67 views

For servers that are not internet facing, do they need to be authenticated to each other and should their communication be over HTTPS? [duplicate]

My gut instinct is that best practice would be to ensure that all internal servers communicate over HTTPS and that all servers are authenticated to each other. That would indeed be dream case ...
0
votes
1answer
140 views

NIKTO: Requires Authentication for realm ''MD5''

I am trying to perform a scanning of a web server using Nikto using: nikto -id id:pass -h xxx.xxx.xx.xxx I am specifying HTTP Basic authentication credentials and indeed with this credentials I can ...
0
votes
0answers
23 views

TRACE method returns GET

XST is a well known vulnerability and the reason that everyone always alerts: TRACE is allowed this is bad. But what I see often at clients is that a request using TRACE returns the same as a GET. Am ...
0
votes
2answers
84 views

Locale detection & huge Accept-Language header, can this be considered an atack vulnerability?

I was looking for some examples of automatic locale detection as I needed to do the same in my PHP app. Most of the answers I found were similar, only differing in the parsing methods. An example '...
1
vote
1answer
217 views

How to disable the use of HTTP verb tunneling using HTTP headers or query parameters?

The attacker request uses a trusted HTTP verb such as GET or POST, but adds request headers such as X-HTTP-Method, XHTTP-Method-Override, X-Method-Override, or a query parameter such as _method to ...
27
votes
1answer
7k views

Why should we sometimes use --+ instead of — in SQL injection to comment the rest of the query?

I have encountered some websites that when I used -- to comment the rest of the query it didn't work, but when I tried --+ it worked. In the MySQL official documentation there is no such thing as --+ ...
1
vote
1answer
129 views

Why do we use Oauth2 instead of Basic Auth in server to server communication using SSL?

Why do some API providers ask you to implement Oauth2 in server to server communication that's available only over HTTPS? In the frontend (app or webapp), Oauth2 is useful to protect the user ...
1
vote
1answer
82 views

How does VPN provider hide traffic from different users

I´m currently learning much about VPN security and now I got to that point where I would like to know how a VPN provider is able to hide my traffic from other user. I am connected to one gateway (as ...
2
votes
2answers
161 views

Nmap not following redirect when using “http-title” script

I am trying to scan a bunch of IPs for their http-title. Now the problem I have is that nmap pretty much never follows any redirects. Usually the title I want is behind that redirect though. For ...
0
votes
3answers
127 views

Can information sent over unencrypted http still be seen if I'm on an encrypted wifi?

I was booking a haircut online and noticed that when they made me sign up for an account, the credentials were not being encrypted (or at least that's what firefox was telling me). It's not a huge ...
0
votes
1answer
26 views

Is there any other way through which an attacker can obtain user data from HTTP response except MITM and CORS attack?

I am doing some research for my college project and I want to ask is there any other way through which an attacker can obtain data from HTTP response except MITM and CORS attack. For an example, If I ...
1
vote
1answer
41 views

Dangers of Sending Onetime Pin numbers over http

Are there any dangers of sending a one time pin number from customer to my server over HTTP? Somebody is arguing that its okay since it will only be used once. So there's no chance of an attacker ...
1
vote
1answer
116 views

How to pass a localhost check for an incoming request?

I'm trying to send a request to an http server hosted on a machine. The http server is in C# and drops any packets that are not from localhost: public void Request(HttpListenerContext context) { ...
4
votes
3answers
116 views

client/server trust after authenticating over HTTPS then dropping to plaintext?

Disclaimer If this question is ridiculous it's because secure public key exchange sounds impossible before you learn about it. So I'm asking about things that may be impossible. Question Is it ...
2
votes
1answer
159 views

What are the benefits to HTTPS between two servers I control?

The current setup we have is two servers that are held internally in my building. One of these is only accessible internally, the other is public facing. The internal server communicates with the ...
2
votes
2answers
93 views

Bypassing rate limit on home router

I'm studying Info Security and was poking around my home router (it's a cheap one) with a python script trying to brute force the admin password for the web interface (it uses HTTP basic and the ...
1
vote
1answer
57 views

What is the safest method to send authentication data to API?

I use Vue.js on frontend and GoLang on backend. With Vue I'm sending AJAX request with credentials for sign in/sign up. Should I use HTTP Basic Auth, or just send them in request body? In case you are ...
0
votes
1answer
103 views

Signing webhooks with JWT — overkill with TLS?

I have a server that sends webhook notifications to client servers. Before the client server begins processing anything, it should be certain that the webhook originated from my server, and that it ...
3
votes
1answer
120 views

Spam link returns empty redirect to google.com - am I missing something?

In this question someone received what was clearly a spam link. Sometimes I'm curious enough to take a peek, which I usually do with curl or other command line tools (less risk of drive-by malware, ...
2
votes
1answer
77 views

After performing a SSL strip, can you upgrade back to HTTPS with your own encryption from the proxy?

Let's say you are performing a SSL strip. From what I can understand, it modifies either the client or server packets (in the http/https protocol), which indicate that it supports encryption to not ...