Skip to main content
OverflowAI is here! AI power for your Stack Overflow for Teams knowledge community. Learn more

Questions tagged [http]

Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.

Filter by
Sorted by
Tagged with
0 votes
0 answers
29 views

Bettercap not detecting HTTPS websites (?)

The built-in sslstripping feature (http.proxy.sslstrip) in bettercap is not working against HTTPS websites in this issue I will be using cygwin.com and winzip.com as an example, as we can see they are ...
LuckyCoder3607's user avatar
0 votes
1 answer
44 views

Command Injection in URLs. Are response codes foolproof indicator of true/false positive?

Take this HTTP request as an example. GET /directory/blahblah/ping%20interact.sh Say this request receives any 3xx, 4xx, 5xx HTTP response code. Is it likely or even possible that a backend web server ...
jakechowder's user avatar
0 votes
0 answers
44 views

Overcoming Middleware: Exploiting XSS to Retrieve Data

I am attempting to perform an XSS attack on my server and have successfully bypassed the CSP. In my server code, I store all users in the following manner: .get("/users", adminReq, (req, ...
EPiez's user avatar
  • 13
0 votes
0 answers
33 views

Is it possible to see HTTPS traffic without intercepting? (With a copy of the traffic) [duplicate]

I have a WAF solution that can work both inline and out-of-band. And we want to try the OOB option first. And possibly want to see HTTPS traffic as well. But the vendor says if we want to see the ...
Sjomann's user avatar
0 votes
2 answers
51 views

Is There a way to exploiting / Make exploit scenario for Header based reflected XSS?

I've found a reflected XSS, but the problem is that the attack vector is the header (any header). Is there a way to develop an exploit scenario based on this?
0xdead 4f's user avatar
1 vote
2 answers
61 views

Preventing Data Tampering in HTTPS Requests: Safeguarding User-Initiated Donations

Could a Man-in-the-Middle (MITM) attack compromise the integrity of user-initiated transactions over HTTPS? Specifically, if a user selects an amount to donate on a website, is it possible for a ...
user23570085's user avatar
0 votes
3 answers
223 views

Using HTTP header to transmit client certificate for mTLS

My client says their API traffic must take the path WAF -> Custom Firewall -> Backend API. Also, mTLS must be terminated after the traffic has gone through the network appliance. I have created ...
chriaass's user avatar
  • 101
0 votes
1 answer
122 views

CRLF in HTTP/2 header value

I am attempting to inject a carriage-return + newline in a HTTP request header value. My understanding is that this is possible with HTTP/2 and HTTP/3. However, when I send a request with Burp I get ...
Sjoerd's user avatar
  • 30.8k
0 votes
0 answers
70 views

Is it possible to track cross origin redirection?

I can successfully iframe a page on origin B from origin A (no x-frame-deny, content security policy, etc). A page on origin B (page X) redirects to a page on origin C (page Y) with a server side ...
Hackermon's user avatar
0 votes
0 answers
98 views

Cache poisoning from rfc6455 (WebSockets) not requiring server message to be masked?

In RFC6455 section 10.3, it explains why they have made clients mask their outgoing frames (so that a malicious server cannot manipulate a client into sending something in plaintext, as the message ...
Secto Kia's user avatar
  • 101
0 votes
1 answer
71 views

Can token decryption endpoint response codes variability lead to security vulnerabilities?

To clarify the question, here's our case: We generate encrypted tokens by applying AES-CBC (256 bit) and Base64 to payload: encrypted_token = Base64.encode(AES_CBC_256.encrypt(key, iv, payload)). ...
vetements's user avatar
0 votes
0 answers
226 views

How to properly use cURL --data-binary to send a request payload

This question is out of pure curiosity. I know I can send multipart formposts using curl's --form/-F option. However, I was curious to see if the same can be done with the --data-binary option? For ...
Michael Sodeke's user avatar
4 votes
2 answers
1k views

HTTPonly token without CSRF is safe?

How can a hacker steal my session where my form does not have CSRF tokens but my session cookies are HTTPonly? how would he get my session cookie in this case? is this possible? for example, to be ...
H01F's user avatar
  • 43
0 votes
1 answer
146 views

A URL is followed by number, what is its vulnerability?

A URL is followed by a number. Changing the number will change the content of the web page. Now I know it's insecure direct object reference (IDOR). What should I do to fix this vulnerability?
Xiling's user avatar
  • 1
0 votes
1 answer
258 views

SSRF trough Gopher

Gopher protocol is used a lot when exploiting SSRF, but how? a Gopher URL takes the form: gopher://<host>:<port>/<gopher-path> but let's take this example: gopher://10.10.10.3:80/...
jeff's user avatar
  • 3
1 vote
0 answers
75 views

Can a proxy server view the request and response bodies? [duplicate]

I'm digging into proxies and VPNs to wrap my head around their security aspects. Wondering: can a proxy server sneak a peek at my raw requests and maybe even tweak them a bit? my connections are HTTPs
Sarkar's user avatar
  • 111
1 vote
1 answer
347 views

Is prohibiting cookies a viable CORS alternative?

I have been using lots of various APIs in my frontend lately and they all have to be properly configured with CORS and the browser always do extra OPTIONS request that only make debugging harder. I ...
Ilya Chernomordik's user avatar
1 vote
1 answer
240 views

How do you verify if a request is from a genuine user or from a malicious user?

Consider clientA which wants to verify payments and serverB which verifies payments. ClientA sends around a million requests to serverB's API in 1 day. However, only 1% of the requests from clientA ...
Team B.I's user avatar
  • 141
4 votes
0 answers
173 views

Why are HMAC signatures frequently used for webhook authorization but not other HTTP API requests?

HMAC signatures are very commonly used for webhook authorization from service to consumer. Examples: Stripe Slack Twilio Twitter GitHub and hundreds and hundreds more. This seems a near universal ...
Paul Draper's user avatar
  • 1,010
2 votes
0 answers
86 views

How to retrieve TLS unique value from Apache?

TLS unique value is present in TLS 1.2 version. In Golang, I can get the value of the TLS unique value from the http response through the field TLS. I'd like know how I can get it from Apache. Is ...
MoBe's user avatar
  • 21
1 vote
1 answer
370 views

Is it secure to use session ID as authentication token received from an HTTP header?

I am writing a mobile application for an already existing web app. In the backend, I implemented the usual cookie-based session ID authentication. with a CSRF token generated on login and sent with ...
TommyGun's user avatar
0 votes
0 answers
70 views

Is POST-based XSSI possible?

With standard XSSI, an attacker can include a remote script which contains user-bound secrets across origins, and then read them out. I have an endpoint which returns sensitive Javascript code, but ...
tim's user avatar
  • 29.6k
24 votes
3 answers
5k views

Why is the absence of a Content-Type header with a HTTP 204 response considered a security vulnerability and what should we do about it?

We have recently developed a web application with a RESTful API backend. This web app need to have a certain security certification (something called PCI-DSS), and thus it is being scanned ...
Dantre's user avatar
  • 343
0 votes
1 answer
215 views

Burpsuite proxy does not get HTTP error 429 but vanilla python requests do?

When I make a normal python request to some site without any proxies I am getting a 429 response, too many requests. However when I open up burpsuite proxy and add proxies = { "http": &...
Lorde213423432e43434's user avatar
0 votes
1 answer
163 views

Is a random unknown HTTP request header 'Host' that is reflected in the HTTP response 'Location" header (3xx) a open redirect or DNS rebinding?

If I send an unknown domain name in the HTTP request header 'Host' to a webserver and the webserver responds with a HTTP status code 301/302 (redirect) along with a HTTP response header 'Location' ...
Bob Ortiz's user avatar
  • 6,665
1 vote
1 answer
491 views

Should the use of the HTTP 'ETag' header be avoided for security and privacy concerns?

I'm looking into the risks associated with the use of the HTTP 'Etag' header and found the following relevant information already. Information Disclosure (inodes) This article titled: "...
Bob Ortiz's user avatar
  • 6,665
11 votes
3 answers
6k views

What security risks are involved in using older HTTP protocols such as HTTP/1.x that would justify upgrading to HTTP/2 or HTTP/3?

As of 2023, still many webservers support HTTP/1.0 and HTTP/1.1 while not supporting recent HTTP/2 and/or HTTP/3 protocols. I understand that newer HTTP versions offer various performance enhancements,...
Bob Ortiz's user avatar
  • 6,665
0 votes
4 answers
416 views

Is HTTP/0.9 considered "End-of-Life" (EOL) due to security vulnerabilities or risks?

I'm exploring the history and evolution of the HTTP protocol and I know that HTTP/0.9 is generally not used anymore. It's clear how features evolved in newer HTTP versions and how primitive HTTP/0.9 ...
Bob Ortiz's user avatar
  • 6,665
0 votes
1 answer
205 views

Is HTTP/1.0 inherently more susceptible to denial-of-service (DoS) attacks?

I'm looking into HTTP version specific risks. HTTP 1.0 lacks support for persistent connections, meaning each request/response pair requires a new TCP connection to be established. Considering the ...
Bob Ortiz's user avatar
  • 6,665
0 votes
0 answers
92 views

TLS session keys [duplicate]

I Have a confusion here. From what I know, in TLS1.2, the Client sends Client Hello and then the Server Sends a Server Hello, Certificate(with its public key) and Certificate chain, and then a Server ...
RRHS's user avatar
  • 133
1 vote
1 answer
123 views

Is it reasonable to have a product that requires LLMNR or mDNS?

I am trying to figure out the best way to manage security certificates for embedded devices who's webpage is accessed via IP address, and then the scenario for when that IP address changes. Currently, ...
StrangerDanger's user avatar
0 votes
2 answers
201 views

What are the security risks associated with hosting a web application that does not handle sensitive data without HTTPS?

Suppose one hosts a web application that does not handle any sensitive data (e.g. passwords, session cookies, etc.), without using HTTPS. What potential security issues arise as a direct consequence ...
registry4059's user avatar
0 votes
1 answer
77 views

Why does the DOM single-origin policy take into account protocol and port? What if it was just domain?

I'm learning the basics of network security and am trying to really understand the single origin policy. I was wondering what the vulnerabilities would be if an origin was only defined by domain, as ...
hyperrealisticcarrot's user avatar
1 vote
2 answers
168 views

How to prevent attacks on a personal webserver

I'm currently working on some modules on hackthebox. In that regard, I recently set up a web service: sudo python3 -m http.server 8080 When I did a wget to my server, it showed up in the log as usual, ...
ojo's user avatar
  • 29
0 votes
0 answers
154 views

HTTP Request Smuggling Exploit - Need Clarification on Behavior of the 'Host' Header

I've been reading about HTTP Request Smuggling attacks and I've come across a situation that I don't fully understand. I've been studying the report by James Kettle where he describes an attack ...
jack's user avatar
  • 1
1 vote
1 answer
201 views

"PUT /SDK/webLanguage HTTP/1.1" on a server with only port 22 open

I've recently spun on a new droplet on Digital Ocean with Ubuntu 22 and enabled UFW and allowed only SSH, which reports being active even after a reboot: sudo ufw status Status: active To ...
Fanu's user avatar
  • 13
1 vote
1 answer
290 views

What happens first in a request having both CSRF Token and JWT token, authentication or authorization?

This question came across my mind when I sent an ajax request from html to a backend django server and forgot to add a csrf token to the request payload and recieved this error. 403 error means that ...
Aryaman Gupta's user avatar
1 vote
1 answer
449 views

How secure is HTTP auth digest in 2023

I'm trying to figure out the time needed to crack an HTTP digest auth. According to the RFC2069, the digest in calculated according to this scheme : HA1 = MD5(username:realm:password) HA2 = MD5(method:...
hotips's user avatar
  • 589
0 votes
1 answer
165 views

Applying application-level signing in HTTP

I have to secure HTTP requests`s body on application layer, so I wanted to generate signatures with hash of body and the receiver will validate it. But I can do it in different way and apply it into ...
Szyszka947's user avatar
0 votes
1 answer
143 views

CWE for "Misconfigured server allows insecure https request to IP-addressed URL"?

I'm doing a vulnerability assessment for a whole slew of web servers, and almost every single one of them (hundreds) are misconfigured like the following two examples: Case 1: one or more hostnames ...
Bitbang3r's user avatar
  • 331
-2 votes
3 answers
945 views

Could someone hack into my website through http ports?

Let's say ports 80 and 443 open for my website hosted by Amazon AWS. Could someone figure out a way to exploit somehow or is that just nearly impossible and something no one would need to worry about?
ThrownRedstone's user avatar
0 votes
0 answers
38 views

I clicked on a SMS spam link. Am I safe? [duplicate]

I received an SMS from an unknown number with a link. Having just ordered stuff from AliExpress bit earlier so, thinking it was related to that, I clicked without doing due diligence. My bad. I went ...
bracco23's user avatar
  • 123
2 votes
2 answers
689 views

When using double submit cookies as protection against csrf, does it matter where the random key is created?

I have a stateless backend and a spa-frontend. Except for the login request, all requests are secured by a jwt in the header. Additionally the application should now be secured against csrf. Since the ...
samjaf's user avatar
  • 121
1 vote
1 answer
524 views

Are CORS headers useless?

It is common to say that CORS headers protect against CSRF, so that if you visit a malicious website, it cannot make a request to your web application because the referer header (the URL of the ...
Vitor Figueredo Marques's user avatar
0 votes
1 answer
366 views

What vulnerability query params or body outside a whitelist can allow?

For instance, suppose we have a request that uses the field name in a request's body or query params, but the client sends the params name and age. Some web server frameworks allow us to strip ...
Vitor Figueredo Marques's user avatar
0 votes
2 answers
1k views

What is a proper way to prevent parameter tampering and to make parameter secure

I'm developing a HTTP web server. I've used HTTPS as the protocol between client and server but I know that HTTPS can't prevent parameter tampering. As we know, we can set parameters in URL, in HTTP ...
Yves's user avatar
  • 361
0 votes
0 answers
34 views

A Potential threat in HTTPS [duplicate]

HTTPS security is based on the chain of trust. The initial trusted party (root authority) signs a certificate for some other party and then it can sign for some other. Does that mean If I have a valid ...
Sachin Chauhan's user avatar
0 votes
1 answer
219 views

How to safely share data between 2 SPAs?

Let's say I have 2 SPAs (single page applications), SPA A and SPA B. I want to share data between the 2 applications for an end-to-end flow. How can I safely share data such that it would not be ...
Adam Thompson's user avatar
0 votes
1 answer
289 views

How to reliably identify referrer on client browser?

Is there any way to reliably identify the referring site on modern browsers (not considering manual HTTP requests outside of a browser e.g. cURL, etc.)? Referrer header will not work because the ...
Adam Thompson's user avatar
0 votes
1 answer
229 views

Is API client responsible for HTTP security headers?

When client (Postman for example) is making the request to server, is the client responsible for including the HTTP security headers in the request? Or is the server responsible for defining these ...
Ewidence's user avatar

1
2 3 4 5
30