Questions tagged [http]

Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.

Filter by
Sorted by
Tagged with
0
votes
0answers
36 views

What will happen if https traffic goes through the WAF? [duplicate]

A web application firewall (WAF) is an application firewall for HTTP applications. It applies a set of rules to an HTTP conversation. Generally, these rules cover common attacks such as Cross-Site ...
-1
votes
0answers
28 views

HTTP email links [closed]

Some emails that I receive have links that "route" through HTTP. I think that usually these links resolve with HTTPS "final" destinations. The emails that I speak of are from ...
0
votes
1answer
47 views

Should I be concerned about timing attacks on HTTP service for passwordless signin?

I have an service that accepts an HTTP POST request from the end-user's browser. The user passes their only email. I intend the server to generate a token and store this in a database, and email them ...
0
votes
1answer
35 views

How strict should I be in rejecting unexpected HTTP request parameters redux?

I read this: How strict should I be in rejecting unexpected query parameters? Answer: No, do not error out on unexpected query string parameters. But I just got a requirement from our security guy ...
0
votes
0answers
27 views

Is Cache-control: no-store enough to prevent caching? [duplicate]

I have researched and understood that Cache-Control: no-cache is not sufficient alone to absolutely prevent caching, but what about Cache-Control: no-store alone? Since it will not allow storing of ...
0
votes
1answer
63 views

Changing $_SERVER['REMOTE_ADDR'] remotely

On a nginx web-server running the following config is to possible to change $_SERVER['REMOTE_ADDR'] remotely?: user www; pid /run/nginx.pid; error_log /dev/stderr info; events { ...
1
vote
1answer
46 views

Is this HSTS HTTP Response Header Misconfigured?

I recently discovered during a penetration test that the HSTS was returned by the application but in this format: "Strict-TransportSecurity" Instead of: "Strict-Transport-Security" ...
1
vote
0answers
48 views

How following URL's will get open-redirection?

Reading about open-redirection from web application hackers handbook came across a test case in which the server-side is validating user supplied data that the application uses to set target for ...
0
votes
1answer
71 views

Storing Session Id in application logs

Short version: Is it not recommended to store sessionId in log files/database in plaintext (considering it may put active sessions at risk)? If yes, why do I see many queries on how to log sessionId? ...
0
votes
1answer
118 views

Spam GET And POST Requests - Are They Dangerous?

I am getting a lot of spam GET and POST requests lately which some of them look like this: "GET /config/getuser?index=0 HTTP/1.1" 404 143 "-" "Mozilla/5.0 (X11; Ubuntu; Linux ...
0
votes
0answers
48 views

Can Chrome's HTTP HEAD requests be misused to launch an attack?

When I used Chrome today via Burp, I noted that, apart from the tracking requests, three random HTTP HEAD requests are sent each time I open the browser. I already found How to find a process that is ...
0
votes
1answer
115 views

Torrent sites on the onion network being served over http

I've noticed that torrent websites like the Pirate Bay are served over http. This means that when using a network like the Tor onion network, where the first server in the response chain receives the ...
10
votes
4answers
4k views

Can a cloned page have HTTPS certificates?

Imagine that a hacker is cloning Twitter or Facebook. The attacker uses his own website, but it is going to be HTTP, right? So can he have the certificates that ensure that his website is "secure&...
0
votes
0answers
50 views

Uploading php webshell using Burp Intruder

I am using Burp Intruder to upload a webshell to different directories. These 400 responses tell me the requests are bad. I should be getting mostly 403 responses or maybe if I'm lucky the goal ...
1
vote
1answer
43 views

In which settings is it possible to launch a HTTP Response Splitting Attack but not completely replace the HTTP message?

I wondered in which settings is it possible to launch a HTTP Response Splitting Attack but not completely replace the HTTP message? The examples I saw all allowed full replacement of the HTTP response,...
0
votes
0answers
42 views

SSL stripping - how is it possible to send back the HTTP page? [duplicate]

Been trying to wrap my head around SSL stripping. An explanation here writes: Keep in mind, however, that when you install SSL, you’re essentially creating a duplicate of your website with HTTPS URLs....
0
votes
1answer
76 views

Default behavior cookie flags in 2021

I'm under the understanding that in 2019, Chrome and Firefox both planned to move to SameSite=lax default for all unspecified cookies. In addition, recently, Chrome decided to set defaults based on ...
0
votes
2answers
103 views

How can I find out whether my browser traffic can be intercepted?

In theory, visiting a website with HTTPS and seeing the neat, little lock icon next to the address (e.g.: ) should give us a warm, cozy feeling of safety. However, how safe is it really? As it stands, ...
1
vote
3answers
111 views

ubuntu sources.list urls are not HTTPS — what risk does this present, if any?

I was looking at the installation instructions for VS Code today and found this step curious: sudo apt install apt-transport-https I see that there appears to be https transport available for apt: $ ...
1
vote
0answers
51 views

OAuth for command line application

I'm planning to add an "official" command line tool for developers to interact with our API. The tool is basically just a glorified curl client, interacting with the API via HTTPS ...
1
vote
2answers
113 views

Is it secure to send personal data via HTTPS?

On the website of some company, it is possible to send personal data using a form. The browser I'm using says that the connection is secure. Is it completely secure to send personal data via the form? ...
0
votes
0answers
44 views

Confidentially seperating web content under single IP address

I am interested in exposing web content to strangers on the internet (Reddit, Discord, ..). This content I wish to reside on the same web server under which personal web content resides. (None of this ...
0
votes
0answers
99 views

How to disable the use of verb tunneling using such headers or query parameters in .NET?

I'm failing a security scan that is saying my .NET application is allowing verb tunneling and the recommendation is to disable this. The application needs to accept PUT and DELETE headers as well as ...
1
vote
1answer
60 views

Making website queries and return a large amount of data, can it be exploited for DOS attack?

I am testing a website (bug bounty website) and found an endpoint like replycomment?cmt_id[]=1. When open on browser, this endpoint let me reply to comment with id 1 by fetching this comment into a ...
0
votes
0answers
103 views

JWT token. Send in a cookie or Auth header depending on Rest vs MVC?

Reading around I gather that for a Restful API since you don't use cookies,then you send the token in the Auth header.Correct so far? When on a traditional MVC app ,do you send the token inside a ...
0
votes
2answers
70 views

On a server to server SSL connection is there any trustable information identifying the calling server?

Imagine server A calling server B over SSL and that both servers have SSL certificates installed. Later server A again calls server B. Is there a way for server B to know that server A is the same ...
0
votes
1answer
62 views

What is a secure way to send credentials to the server?

I am currently making a file server (Based on HTTP) for my service. I want an upload key, so a key that is needed for uploading. To get this key, the client has to provide his login data. Let's say my ...
0
votes
0answers
52 views

Should I strip the “Origin” header from client requests?

I'm trying to setup an nginx reverse proxy to a web product I can't modify (it's an appliance). Client --> https://myapp.com --> nginx --> https://10.1.5.9 I managed to do so, but it ...
0
votes
1answer
56 views

Does an url that redirecting infinitely have any impact to website?

I am testing a bug bounty website, and found an endpoint like www.example.com/infinite. When open it, it keep doing 302 redirect to itself until browser stops it for redirecting too many times. For ...
1
vote
1answer
49 views

What is happening to second response in HTTP Splitting?

Doing the webgoat HTTP splitting exercise. I feel like I'm doing something wrong or there is something that I don't understand. The idea is that since we can control the referer parameter, we can ...
0
votes
3answers
195 views

Can HTTPS request parameters be seen by the PC client?

I've searched for it but couldn't find a direct answer to this relatively simple question. Most questions are about a 3rd party intersepting the HTTPS POST or GET parameters inbetween client and ...
1
vote
1answer
506 views

Suspicious HTTP Requests in my logs [duplicate]

I'm running a PHP application with a user management system called userspice. It basically allows you to include the userspice PHP file and then control access to a certain PHP page. As I have seen ...
3
votes
2answers
124 views

Targeted .git scanner?

Starting yesterday, my honeypot has been getting a ton of git scans. I normally wouldn't think much of this, but a few weird things are happening: All of the IP addresses come from Amazon AWS They ...
1
vote
0answers
49 views

http smuglling how can i do a poc in a big websites?

i try to find http smuggling in big bug bouny program if i send this to the server POST /path HTTP/1.1 Host: subdomain.domain.com User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 ...
0
votes
1answer
91 views

Spoof IP address after a TCP handshake established

Is it possible to spoof the IP once a TCP handshake was performed successfully? For example: Perform the handshake Use the session with the same IP which performed handshake but on different machine ...
0
votes
2answers
95 views

If HTTPS only runs on a single port, why is SYN flooding an issue?

I've read online that SYN flooding is when "the attacker sends repeated SYN packets to every port on the targeted server." However, HTTPS only runs on port 443. Therefore, why is it ...
1
vote
1answer
63 views

Is it possible to completely obfuscate proxy servers?

Stripe's fraud detection documentation claims it has Proxy Detection When I search for how it might be detecting traffic from proxies, I see this great answer, which show how to detect that traffic. ...
0
votes
4answers
99 views

HTTP access from a single IP [closed]

If I were to configure a server that would be configured to only be accessible (HTTP) from a single IP address via a port, is it safe from unauthorized access?
1
vote
1answer
82 views

Do all files downloaded from the web, come with a checksum to verify the file?

Pretty straightforward question. Take the image here: https://i.imgur.com/oEdf6Rl.png Does it come with a checksum, which I can verify against after I have fully downloaded the file? This question ...
2
votes
1answer
40 views

Timeless timing attacks and response jitter

I've been researching timeless timing attacks, ie: timing attacks using concurancy rather than round trip time. Here is an article by portswigger with links to the origional article by Van Goethem. ...
1
vote
1answer
58 views

Can an error page (like 404) served without X-Frame-Options be exploited?

I'm checking some HTTP headers in the server response. I get a 404 error page. Could in some scenario an attacker leverage a missing X-Frame-Options header in a 404 page?
0
votes
2answers
124 views

How do servers protect against straight up sending a HTTP request that is actually some malware or HTML code? [closed]

I know servers have something to block you from just sending them an HTTP request that is actually some malware or a webpage that is malicious, because it would be so easy to just spam HTTP requests ...
1
vote
1answer
71 views

What exploit is trying to be leveraged here? (Apache access.log)

I've just deployed a barebones Apache server on Digital Ocean, only hosting static files. No PHP et al. I'm not too bothered to see random exploit attempts, but 99% of the requests are of this similar ...
0
votes
0answers
17 views

Security implications of protecting private data with a long URI exclusively [duplicate]

A website hosts private/personal information at a very long and unpredictable URI, yet access to this URI is completely unauthenticated. Are there any major security issues with this? I can think of ...
0
votes
0answers
40 views

Path of Set-Cookie HTTP Response Header

The Tangled Web notes: URL paths are not taken into account during same origin policy checks and, therefore, do not form a useful security boundary Given that, is there any reason to set the Path or ...
-1
votes
2answers
105 views

People say “false positives” in request smuggling. What does it mean? [closed]

I always see "false positives" or "false negatives" in HTTP request smuggling forum posts. What does it mean? Example: HTTP Desync Attacks: Request Smuggling Reborn
1
vote
1answer
112 views

How can a site preemptively notify browsers to enforce an SSL on their domain?

I learned about this years ago and don't remember enough of the keywords to search for it appropriately. Its where sites can tell the browser that the site must not allow the site to be downgraded to ...
0
votes
1answer
57 views

why the website cant understand my request in http smuggling?

hi I started to find bug bounty vulnerabilities and i think i found a te.cl vulnerability in a website. i send GET / HTTP/1.1 Transfer-Encoding: chunked Host: subdomain.domain.com User-Agent: Mozilla/...
2
votes
0answers
73 views

Is the HTTPS lock sign displayed if reasources are loaded from insecure sites?

We all know that if you visit a secure site which uses https, all modern browsers will show a padlock sign if it has a CA certified certificate. My questions are: Suppose there is an image loaded in ...
1
vote
1answer
49 views

Custom response for Web Application Firewall (WAF)

What should be the custom response code when WAF blocks a request due to matched rules or policy violation. We should kept the response code as 403 or 200 when WAF returns a response against a blocked ...

1
2 3 4 5
27