Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [http]

Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.

0
votes
0answers
11 views

How is Indonesia blocking images in e2ee applications?

Indonesia's minister in communication and informatics supposedly blocked the sending of images and videos through social media from 22nd May until 25th May, in order to prevent hoaxes from spreading ...
2
votes
1answer
50 views

Security implications of client TLS termination

I have a bunch of HTTP services/devices TLS unaware. I want to allow them to access WAN, but of course I do not want them to do it in plain HTTP. Updating them is unworkable due to legacy issues and ...
1
vote
2answers
42 views

How can the Same Origin Policy protect the user in times of CORS headers?

How can the Same origin policy protect something if you can bypass it via Cross Origin Resource Sharing headers? And why are those assigned by the server which is tried to access and not by the user? ...
3
votes
1answer
50 views

Is it easy to hijack browser session if you have access to someone else computer

If someone has access to my computer , can they easily get my session id by going to the browsers developer tools and taking a photo of the session id with a phone, if the session id is passed in a ...
1
vote
1answer
61 views

What is advantage of passing request / response data via cookies instead of regular query parameters?

I have a specification where its required to pass all the data in the requests to the server using cookies (instead of body or query parameters) and accept all data from the server using cookies (...
21
votes
3answers
5k views

Security vulnerabilities of POST over SSL

I work for a small company, developing an ASP.NET web-application. Recently, we've had the requirement of exposing an API endpoint come up, such that an automated script running in the cloud can ...
1
vote
0answers
62 views

What are the risks involved in blindly trusting all certificates for https requests over unknown proxy servers?

My use case is a Java application where no sensitive data being transmitted whatsoever, and the response being accurate (i.e. unmodified) is unimportant.
1
vote
1answer
111 views

Is it possbile to conduct http header injection attack with a web site or web app uses https?

If a web site or web application is running with https, is it possible to conduct http header attacks like http header injections and so on?
0
votes
0answers
71 views

JS keylogger listening to what is being typed in an iframe?

Having discovered the X-Frame-Options sameorigin that stops a website from being shown in a iframe, I am trying to understand how far not having this header can go. What I am not sure about is if it'...
0
votes
1answer
111 views

Router administration page is served over HTTP

My wireless router admin page does not include https option. It is always served over http. This is obviously a concern in case someone is sniffing the network and can read my password in plain text. ...
0
votes
0answers
73 views

Secure Http Connection With Authentication Header

I am trying to create an authentication header algorithm that can be used for authentication on HTTP server. Not sure it is good but it seems OK to me. I also used similar approaches for previous WS ...
3
votes
1answer
62 views

Why isn't the record of a TLS data application exchange signed by the server?

I am inspecting the TLS(1.2) protocol, and I notice that after the key exchange (handshake), data applications flows from server to client freely (because they have the session key). However, I ...
0
votes
1answer
34 views

Whats should be TRACE response of an API (if it is not allowed on server)?

I am testing a website and noticed that when I change the GET method of the API request to TRACE, it returns an error 405-Method not allowed in Burp repeater. That's fine. The problem is, lots of ...
0
votes
1answer
38 views

How to secure communication between docker container and an elasticsearch server?

I have a spring boot application running inside a docker container. This application communicates with another server which hosts Elasticsearch on it. How do I secure the communication between these ...
3
votes
0answers
52 views

How Can Exploit Xss and Sqli via HTTP Verb Tampering?

I was reading a paper about 'HTTP Verb Tampering' here: https://blog.jeremiahgrossman.com/2008/06/what-you-need-to-know-about-http-verb.html The author said: 2) HTTP Verb tampering is generally ...
0
votes
0answers
25 views

Requests to /android-app://com.twitter.android/twitter/user - what is the intention?

I wonder what requests to https://ourdomain.com/android-app://com.twitter.android/twitter/user are doing - is that a kind of attempt exploit a vulnerability? I encounter them in our web server logs ...
0
votes
1answer
95 views

Is it safe to login using HTTP on a WPA2 protected home network?

I have a small network infrastructure in my home on which I'm hosting some services such as a website, file server and such. Many of those services have an administration web interface which isn't ...
1
vote
1answer
71 views

What accounts for file accessed immediately after including link in Gmail?

Less than 60 seconds after sending an email w/ Gmail that contained a pasted https link to a .zip file, that file was accessed by two non-Google servers. Neither server belongs to the email recipient. ...
-2
votes
2answers
43 views

XSS with HTTP flag true

Since HTTP only flag is used to mitigate Cross Site scripting, we cannot perform XSS on the web application? If we can, What are some best real time examples to pentest XSS when HTTPOnly Flag is true?...
1
vote
2answers
76 views

How strict should I be in rejecting unexpected query parameters?

TL;DR Is it a "best practice" to return an HTTP 400 Bad Request response if extra parameters are sent with a request? I'm putting together a web app and doings some testing with OWASP ZAP. I'm pretty ...
0
votes
0answers
77 views

HTTPS MITM Proxy breaks HTTPS

I tried to reverse engineer an Android APP using MITMProxy, and the Server responds with an unauthenticated-error. If the whole authentication would be using headers (Basic, etc...), the Proxy should ...
0
votes
1answer
98 views

Wireshark - How to see the domain of HTTPS websites visited

How can I see the domain name of https websites that are visited on my network? I know I'm not able to see the full url, just the websites ip or domain. I think it my be possible with a reverse dns ...
5
votes
1answer
478 views

How to force a browser when connecting to a specific domain to be https only using only the client machine?

Is it possible to force a client (browser or host machine or etc) to only make https connections to a specific URL/domain? (preferably non-admin/root fixes if possible) Here is a fabricated ...
0
votes
1answer
74 views

PHP HTTP Reverse Shell?

Is there a PHP HTTP reverse shell? I haven't been able to find one, only ones that transmit using TCP packets (not HTTP). Note, I mean actually using HTTP packets as the C2, not just transmitting TCP ...
0
votes
1answer
70 views

Is there any standard that encrypts domain name of the certificate?

I guess widely used protocols today don't encrypt the domain names in TLS certificates. Does HTTP/3 and TLS 1.3 encrypt domain names of web sites?
0
votes
1answer
48 views

No certificate found alert in nodejs https server in mobile

I have created a website using nodejs . And using ssl certificate from sslforfree.com . It is working fine on desktop and i checked it in SSL Checker it is working fine . But in mobile it is showing ...
1
vote
1answer
140 views

Could my boyfriend be hiding his encrypted emails inside of my inbox? [closed]

is it possible that my boyfriend could be hiding his encrypted emails inside of my email inbox with my email address and I can't read them? And if it if that is possible is there way that I can ...
0
votes
0answers
79 views

Information disclosure with AWS response headers

I'm currently testing a web application hosted on AWS. In the response headers, I've noticed various Amazon-related headers, I've never really seen before. The headers include: x-amzn-RequestId: <...
1
vote
1answer
69 views

Custom Suricata's HTTP alert isn't triggered when using “..” as part of the scanned uri. Why? [closed]

I have a doubt with a Suricata custom rule. If I do: alert http any any -> any 80 (msg:"blabla"; content:"abc"; http_uri; sid:1000000;) I can get requests to http://x.x.x.x/abc uri in fast.log ...
1
vote
1answer
51 views

Remote detection of spring framework

I would like to know if there is a remote way to understand if a web app uses the Spring framework. In particular Spring security. Is there any kind of analysis on HTTP headers that can provide ...
0
votes
0answers
53 views

DNS Spoof Adware

Someone recently boasted about adware which can inject ads from most networks, and using DNS spoofing would make the providers think that the ads were on a website owned by me (i.e. www.myscamsite.com)...
3
votes
2answers
271 views

Does someone need to be connected to my network to sniff HTTP requests?

TL;DR Would a potential attacker need to have my Wi-Fi password and be connected to my network in order to read HTTP requests? Over the past year or so, I have made a few DIY home automation projects....
8
votes
3answers
711 views

A link redirect to http instead of https: how critical is it?

I just join a project, and while browsing the code, I realize that some links redirect to another web page, in HTTP instead of HTTPS. The linked website has an https version, and there was no reason ...
0
votes
0answers
38 views

Retrieve hostnames for IP addresses to connect to HTTP services, when no (reverse) DNS PTR records are available?

I'm conducting a penetration test, where I'm facing the following problem: After having retrieved a set of IP addresses through tools like whois, I cannot successfully connect to the HTTP-based ...
0
votes
1answer
60 views

DNS Spoofing Detection with JavaScript

I've came across an interesting question today - how can a JavaScript detect that a DNS Spoofing attack has been made against the client its running upon? Scenario: Edit: wrong scenario was ...
0
votes
1answer
42 views

Preventing path traversal knowing only the input

I am tasked with preventing a path traversal attack over HTTP by intercepting and inspecting the (unencrypted) transported data without direct access to the target server. From some research it ...
38
votes
5answers
7k views

Should I use HTTPS on a domain that will only be used for redirection?

If I have a domain, https://www.example.com. It has an SSL certificate for that domain only. I also want to redirect people who only type example.com in their browser's address bar. Should I secure ...
0
votes
0answers
38 views

Is it okay to implement key files via HTTPS form?

I've been messing around in VeraCrypt and KeePassXC for a while now. And I'm trying to improve my privacy and security. I've been experimenting with different authentication methods. VeraCrypt and ...
2
votes
2answers
165 views

If two servers are in the same private network, is it better for them to talk to each other through HTTP or HTTPS?

Is anyone kind enough to tell me what actual companies do about the matter? This is assuming the company doesn't run the risk of having insiders sniffing the packets.
37
votes
2answers
8k views

How to prevent users from executing commands through browser URL?

I have very little experience with security (still learning) however was combing through my logs and I noticed the following request: "GET /index.php?s=/index/\\think\\app/invokefunction&function=...
-1
votes
1answer
51 views

How do I detect spoofed REST API responses in my webapp?

I am building an internal admin panel for my team that will communicate to the backend server using a REST API. One of the API calls that will be performed will be an "authorization check" where the ...
0
votes
2answers
147 views

Does it make sense encrypt an HTTP payload using JWE

I'm working in a project that the client must encrypt the HTTP messages payload to send to the server. In my first research I found the RFC 8188 and I think it solve my problem, but some people ...
2
votes
2answers
196 views

How do the CVE-2018-10562 and CVE-2018-10561 exploits work?

https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/ Firstly, the use of 'GPON' I find misleading because this vulnerability is to do with the routers and webservers and not the access ...
0
votes
2answers
104 views

Are there any security risks to accepting HTTP/0.9 style GET requests? (e.g. “GET /\r\n”)

I'm writing a web server for fun, and I'm first adding support for HTTP/1.0. The primary reference I'm using is RFC 1945 => Hypertext Transfer Protocol -- HTTP/1.0. In section 5.1 of the RFC, I ...
2
votes
2answers
47 views

Is it ok to send plain text credentials in a XHR GET request?

When testing my api server, I often requested the website http://domain.tld/api/?username=john&password=123456 to test things and after a while of course, my browser would autocomplete the url, ...
0
votes
1answer
173 views

What's the security concern of browsers using the HTTP CONNECT method?

The XMLHttpRequest spec says that attempted usage of the CONNECT method should throw a security error. Is there a security issue with client-side JavaScript sending CONNECT requests to servers? It ...
0
votes
0answers
28 views

How to deploy your web server's Web Application Firewall while limiting false positives

For objective discussion: We deploy several Web Application Firewalls where I work. I know that one particular on-prem product uses Apache [reverse] Proxy & ModSecurity to match HTTP POST traffic ...
1
vote
0answers
65 views

HTTP body E2E encryption protocol

I have 2 servers that communicate each other in HTTP and they are both behind an API gateway. Between the servers and their API gateways the communication is in HTTPS with mutual authentication using ...
25
votes
2answers
7k views

Why is my computer making requests to my Roku about spotify?

I'm new to inspecting packets with Wireshark so this might be something very stupid on my part. That said, I don't really understand the transaction between my computer and my Roku. 17 1.129097 ...
0
votes
0answers
59 views

server logs invalid HTTP_HOST header, Bad request, 400 [duplicate]

I created a Digital Ocean droplet recently, to learn how to make Django app. Eventually they say I should use Gunicorn to serve and Nginx to face the world, however, in very early stage of learning ...