All Questions

Tagged with
Filter by
Sorted by
Tagged with
15
votes
4answers
1k views

Will the same Javascript fetched by HTTP and HTTPS be cached separately by the browser?

Say that a web server supports both HTTP and HTTPS, if a browser fetches the same Javascript with a HTTP GET and a HTTPS GET, and assume the Javascript is cache-able, will the browser caches two ...
0
votes
1answer
66 views

Deserialization Opportunity?

I have minimal experience exploiting deserialization vulnerabilities and I am working on and I have identified the following URL endpoint. This is it URL Decoded: /Account/Register?Count=0&Keys=...
3
votes
2answers
87 views

Are there potential risks to sending HEAD requests to user-supplied URLs?

I have an application that unshortens URLs by using the python requests library to send HEAD requests with allow_redirects=True. I don't do anything with the response except check the response URL. ...
2
votes
1answer
54 views

UUID as auth token [duplicate]

I am working on a small IOT device that basically is a status display, which includes data about my phone. That means that I have a simple web server running, which can be used to update the devices ...
1
vote
2answers
73 views

Is it possible too exploit CORS with double Origin value?

I found a website that has a well implemented CORS configuration, but for some reason I am able to insert two Origin headers in a POST request, and both of these values are reflected in the reponse. ...
0
votes
3answers
77 views

Self-signed vs. authority issued certificate for internal web services

From an information security perspective, which is best for private (on-premise) micro-services (web services) accessed via HTTPS? Are there an advantages in using certificates signed by a Third ...
1
vote
2answers
76 views

How safe is it to allow JS CDNs in a HTTP content security policy?

I am tasked with adding a content security policy to a whole bunch of Magento stores to protect against credit card scraping code, which can sneak in via the store admin or GoogleTagManager* when a ...
1
vote
1answer
227 views

HTTP request smuggling, basic TE.CL vulnerability

Im trying to learn about http request smuggling and Im trying out the labs for burp suite. Im stuck on the TE.CL vulnerability, Ive clicked on the solution (see below:https://portswigger.net/web-...
0
votes
0answers
49 views

How to read SlowHTTPTest range attack when Nginx is the server?

I'm running an application hosted on Firebase and did some tests using SlowHTTPTest. For SLOW HEADERS, SLOW BODY, and SLOW READ the output is quite similar, i.e. the service is available which makes ...
1
vote
1answer
39 views

Securing implicit tokens (Example: Moltin)

I'm fairly new to security but I'm trying to understand how companies have their APIs set. One such case is Moltin's Implicit Token. Basically they provide you with a read-only (for the most part) ...
1
vote
3answers
211 views

Is there a way around HTTPS being redirected to HTTP?

I have come across something of a curious situation that a website (Palestinian News Network) has a valid TLS certificate (see here) but that the website always forces loading of the site via http://. ...
1
vote
2answers
469 views

Is it possbile to conduct http header injection attack with a web site or web app uses https?

If a web site or web application is running with https, is it possible to conduct http header attacks like http header injections and so on?
0
votes
1answer
49 views

Whats should be TRACE response of an API (if it is not allowed on server)?

I am testing a website and noticed that when I change the GET method of the API request to TRACE, it returns an error 405-Method not allowed in Burp repeater. That's fine. The problem is, lots of ...
0
votes
0answers
235 views

Information disclosure with AWS response headers

I'm currently testing a web application hosted on AWS. In the response headers, I've noticed various Amazon-related headers, I've never really seen before. The headers include: x-amzn-RequestId: <...
1
vote
1answer
60 views

Remote detection of spring framework

I would like to know if there is a remote way to understand if a web app uses the Spring framework. In particular Spring security. Is there any kind of analysis on HTTP headers that can provide ...
0
votes
1answer
448 views

SameSite cookie attribute and Synchronizer Token Pattern

Recently most browser have added support to the SameSite cookie attribute to prevent CSRF attacks: https://www.owasp.org/index.php/SameSite Question if it is supported should we implement ...
16
votes
3answers
4k views

Why should someone block all methods other than GET and POST in a RESTful application?

TL;DR: Is there a valid reason to demand a software vendor to stop using HTTP PUT and DELETE methods in a web application and use only GET and POST? The application uses frameworks to whitelist ...
0
votes
2answers
293 views

Does HTML Purifier (which converts & to &amp;) prevent HTTP parameter pollution?

If a REST endpoint (http://example.com) reads the p query parameter and pass it along to another endpoint: http_get("http://example.com/api2?p=".$_GET['p']); I will be able to exploit it by ...
27
votes
10answers
14k views

How to secure passwords over HTTP?

Say my password is abc. I want to send it to the server over HTTP. I could send it in plaintext and let the server hash it and compare it to the entries in its database, but then anyone that can see ...
1
vote
1answer
42 views

Dangers of Sending Onetime Pin numbers over http

Are there any dangers of sending a one time pin number from customer to my server over HTTP? Somebody is arguing that its okay since it will only be used once. So there's no chance of an attacker ...
3
votes
1answer
585 views

Is cache-control: no-cache enough for sensitive information like bank accounts, etc.?

I have read somewhere that when storing sensitive information on a website you should include cache-control: no-store for telling the browser not to store that information on the local system. But I ...
2
votes
2answers
484 views

What's the benefit of JWT if user needs to send his credentials once anyway?

JWT tokens seem like a very good idea. You can send a request to some API without using your username/password secret pair. Still, I don't fully understand the benefits that it gives. I have two ...
1
vote
4answers
688 views

Security concerns surrounding HTTP GET in Web Development

I'm currently a developer making my first foray into web development, mostly using C# ASP.NET services such as MVC and Web API. Getting into the HTTP side of things, I'm currently deciding whether or ...
13
votes
1answer
1k views

Current status of SameSite cookie

Recently I got to know about SameSite cookie attribute which is used to mitigate the CSRF attacks. AFAIK SameSite attribute for cookies is implemented in Chrome and some other browsers. Since I'm ...
-1
votes
1answer
71 views

How can this link (and links in general) run javascript through a Google link?

Very recently, the following link has come to my attention: hxxps://google.co.zm/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact=8&ved=...
5
votes
1answer
250 views

How to prevent MITM session fixation attack over plain HTTP upon first request?

Websites has various methods implemented to tell browser to always use HTTPS - HSTS header, server redirec to HTTPS, CSP policy. However, the first time a user visits the site it can be over palin ...
2
votes
3answers
152 views

What are some potential attacks that could be done to a website that doesn't manage url-encoding properly?

A month or so ago I was in the middle of one of my "Distributed Applications" classes and the professor was explaining us how to """properly""" authenticate users in a server. To demonstrate how to ...
2
votes
1answer
84 views

Is sending recaptchaPublicKey & RecaptchaToken in the post request a potential security threat?

I have implemented reCaptcha in login form to slow down the potential brute force attack. However, the application sends recaptchaPublicKey & RecaptchaToken in the post request along with the ...
2
votes
3answers
4k views

Is it more secure to close port 80 and leave port 443 open

I believe that this question is not duplicate of the following question. This is because the answer provided to that question only focus on user experience, while my question focus purely on security. ...
0
votes
1answer
54 views

Downloading a file on my website, with and without a secret. A room for improvement? [duplicate]

I'm trying to create a simple download system as a part of my website. Is there anything insecure in this route: GET https://my_website.com/downloads?file_id=AAA&user_id=BBB&secret=CCC ...
1
vote
0answers
727 views

HTTP security headers for native and webview based mobile applications

OWASP Security Headers Project recommends the following security headers for web applications. Out of the following which headers are relevant to mobile applications? HTTP Strict Transport Security (...
51
votes
6answers
9k views

Is there any difference between HTTP and HTTPS when using my home / own internet connection

First of all I am a web developer and not a security expert. I have read lots of articles about the difference between HTTPS and HTTP, including this site. The basic idea I got from them is, when ...
5
votes
3answers
58k views

How to add X-Frame-Options header to a simple HTML file?

I am having trouble adding X-Frame-Options header to a simple HTML file. Is there any way to do it using JavaScript?
1
vote
1answer
12k views

This page includes a password or credit card input in a non-secure context

I am in doubt whether this is a programming or security issue. I have noticed that Google Chrome is sending this message in the console: This page includes a password or credit card in a non-secure ...
2
votes
2answers
2k views

Manually exploiting blind SQL injection in SELECT statement in X-Forwarded-For header

I am struggling exploiting this vulnerability in the code below: <?php ini_set('display_errors', 0); define("INDEX", 1); include '../db.php'; if(isset($_SERVER['HTTP_X_FORWARDED_FOR']) &&...
0
votes
1answer
84 views

Better protocol for Web app [duplicate]

I have many Web applications developed as Node.js based servers horizontally scaled with a Load Balancer in front of them. At the beginning all my Web applications exposed HTTP endpoints and the Load ...
2
votes
2answers
618 views

Beginner-friendly tool to simulate HTTP flood on my website

Is there any easy-to-use tool available I can use to produce an HTTP GET flood on a website I maintain? If so, can you also explain in steps how to use it? I need to do this for testing purposes. Our ...
0
votes
2answers
456 views

Setting Access-Control-Allow-Origin: * when session identifiers are injected in the HTTP headers

Is it considered as secure for an application to set a header access-control-allow-origin: * if during the normal usage of the application, the client credentials are injected in the headers by the JS ...
17
votes
2answers
8k views

How is the lack of the “SameSite” cookie flag a risk?

Nowadays cookies can have HTTPOnly, Secure and SameSite flags. The purposes of HTTPOnly and Secure flags are pretty clear. But what does SameSite scripting prevent exactly and how? Additionally, how ...
37
votes
7answers
8k views

Is it acceptable for an internal HR site to run over HTTP? [closed]

Our internal HR site - which has our personal details, payslips, holiday details etc. runs entirely off a basic http site. The site is only accessible within the company network, and can't be ...
51
votes
9answers
30k views

Is it bad practice to use GET method as login username/password for administrators?

I work on web applications and as you know, having an administrator panel is a must in most cases. We can see that a lot of web applications have a specific login page for administrators in which ...
3
votes
1answer
6k views

Is HTTP to localhost safe? [duplicate]

Google is reportedly planning to make Chrome report all web site connecting using http:// as unsafe. But is this really true if the host in question is localhost and the server is only listening for ...
1
vote
1answer
553 views

Is a SPA vulnerable to the BREACH https security exploit?

I have a Single Page Application (SPA) that consists of static resources (HTML, JS, CSS, images fonts ...) that are served from an Apache web server and several API endpoints (serving JSON from a ...
8
votes
2answers
839 views

Is sending “Access-Control-Allow-Origin: http://localhost:8888” dangerous?

I recently found the following HTTP headers on a site that could at the very least be described as a high value target: Access-Control-Allow-Origin: http://localhost:8888 Access-Control-Allow-Methods:...
2
votes
1answer
423 views

Overwrite File in Browser Cache

I heard about a security incident where someone had accidentally placed sensitive information inside a cached JSON file. I was wondering, for the purpose of containment, what is the best way to force ...
1
vote
1answer
456 views

HTTP header error message looks wired. Is this a buffer overflow attack?

My gerrit error log shows the following shell code like characters: [HTTP-64] WARN org.eclipse.jetty.http.HttpParser : Illegal character 0x5 in state=START for buffer HeapByteBuffer@af151b6[p=1,l=3,...
9
votes
3answers
3k views

Why does HSTS not automatically apply to subdomains to enhance security? For what reason would someone not want HSTS on every subdomain?

HSTS restricts the connection to be always HTTPS if deployed by any domain, however for it to be applied to sub-domains the 'includeSubDomain' attribute is needed. Why doesn't the policy itself make ...
2
votes
2answers
1k views

Should I expose HTTP status code 500 on a REST application?

In my Spring MVC 3 application, I am following REST patterns and lots of logic is based on HTTP status codes. For instance 500 defines a server error. But OWASP modsecurity says not to expose this ...
1
vote
3answers
369 views

Why big websites don't secure their front page with SSL? [closed]

Big websites for things such as banks (eg www.cimbclicks.com.my) and online shopping (eg www.lazada.com.my) don't seem to care to secure their front page with SSL but their login page is secured with ...
26
votes
4answers
6k views

Understanding HTTP GET attack requests

I have captured some web attacks. I am trying to understand what purpose does each attack request achieve. GET /site/public/timing?<!+XSS="><img+src=xx:x+onerror=alert(14721850.00337)//"> ...