Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP ...

learn more… | top users | synonyms

1
vote
2answers
207 views

HTTP login to iframe HTTPS/ MiTM attack

I would like to know if the credentials can be intercepted/MitM attack if the site is using HTTP to HTTPS login iframe. Here are some login details from my Chrome dev tools (Form Data) So I can see ...
3
votes
2answers
55 views

Application level proxy on HTML. Capabilities

I am studying for a network security exam. I found in an old exam the following question and I have no idea of the answer: A company is protecting its intranet by a multi-homed bastion host B, ...
0
votes
0answers
105 views

iSniff-GPS: Certificate Verification

iSniff-GPS I came across an interesting sounding project on GitHub, called iSniff-GPS. I decided to check it out, but i experienced some issues when trying to use the web interface. Instructions ...
2
votes
0answers
46 views

Is anonymous message delivery feasible? [closed]

I came across two papers written on this topic: Buses for Anonymous Message Delivery and Tokens for anonymous Communications in the Internet I am probably missing a lot of the nuance, and I could ...
2
votes
1answer
77 views

Is SSL really insecure on most of the web? This report seems to suggest so [duplicate]

The Wikipedia article on TLS article has a tremendously long list of attacks against SSL. A table on that article shows a survey from September 2015. If you look at that survey, it shows that nearly ...
8
votes
2answers
897 views

Are future TLS versions going to prevent traffic inspection?

Nowadays it is possible to inspect (unencrypt) TLS (HTTPS) traffic inside an organization. The mechanism consists in using a root CA that is configured in the web client and a network device that ...
24
votes
2answers
746 views

Bypassing HTTP to HTTPS cached 301 redirect to use SSLstrip

I'm doing some pen. tests on a HTTPS (443) server that does not have HSTS implemented (no HSTS headers on response and the address is not on Chrome HSTS preload list). The problem is that in my ...
3
votes
3answers
90 views

is g-zipping assets a security concern?

I recently noticed that the assets sent to clients aren't gzipped or minified on either my companies intranet or its public facing website. I brought this to the attention of the networking ...
8
votes
1answer
136 views

HTTP Response Splitting and PHP

There are numerous references to HTTP Response Splitting (HRS) vulnerabilities with PHP having been resolved since 4.4.2 and 5.1.2 (E.g. https://en.wikipedia.org/wiki/HTTP_response_splitting), or for ...
15
votes
2answers
10k views

Why is 'Bearer' required before the token in 'Authorization' header in a HTTP request?

What exactly is the difference between following two headers: Authorization : Bearer cn389ncoiwuencr vs Authorization : cn389ncoiwuencr All the sources which I have gone through, sets ...
4
votes
1answer
165 views

In practice, is it safe to set Strict-Transport-Security header on non-SSL requests?

Section 7.2 of RFC 6797 states: An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport. In practice, I have a lot of hosts that are behind an ...
1
vote
2answers
65 views

Do secure ciphers break multi-domain certificates?

In the past days, I was halfway successful with securing my websites. So far, I have achieved the following: Get a certificate from letsencrypt.org, securing the domains example1.com, example2.com ...
3
votes
1answer
119 views

What happens when CA server is down?

Let's assume that I have a server which accepts requests over HTTPS. The server resides in a closed environment, and relies on a local CA server. I am not sure if this is relevant, but the server is ...
0
votes
1answer
89 views

Using HTTP Basic Auth on a Personal Website

So I'm making a portfolio site with a blog which is accessed via a different URL slug and I'm wondering if using basic HTTP auth is enough for security on this website as I will be the only person ...
0
votes
2answers
309 views

HTTPS on streaming video

I notice that https://gaming.youtube.com/ is secure with https. Does the live content (videos) produced by a youtube's user is 'encrypt' too on the network ? what is the point ? For example, Twitch ...
1
vote
1answer
40 views

HTTPS everywhere rulesets confusion

When using HTTPS everywhere I frequently notice the ruleset counter next to the search bar. I understand the counter represents the number of rulesets for each page, which can be seen by clicking next ...
44
votes
3answers
4k views

Is it common practice for companies to MITM HTTPS traffic?

My company has just introduced a new VPN policy whereby once connected all traffic is routed the company network. This is to allow for improved monitoring of data theft. It would appear that this ...
3
votes
1answer
97 views

Detecting botnets that use HTTP instead of IRC

I know most bots use either IRC or HTTP to communicate with the C&C, and http unlike IRC can't be blocked. So if a botnet is using HTTP, how can this be prevented? Just theoretical!
2
votes
1answer
156 views

Why do Browsers warn about self-signed certificates but not about plain HTTP (which is not even encrypted)? [duplicate]

Let's keep it short: On HTTP everyone can listen easily. MITM attacks are no problem. On HTTPS (self-signed) everything is at least encrypted, it's much harder to MITM-attack and only private key ...
0
votes
3answers
404 views

What information can my network admin see when I visit a website? [duplicate]

This question is similar to this but for my network admin. For example, when I enter this URL: https://www.google.com/search?q=example or ... I can see the word example that I was searching on ...
7
votes
1answer
659 views

Is an HTTP 301 redirect to HTTPS, insecure?

For a website, I force a 301 redirect from http://login.example.com to https://login.example.com using a .htaccess file. As I read in this question this still imposes a security threat. I'm wondering ...
1
vote
1answer
42 views

Does DNSCrypt mask/hide the URLs I visit

I use DNSCrypt (https://dnscrypt.org/) and I'd like to know whether it's useful to mask/hide from my ISP (Telecom) the HTTP requests I make in my browser. And how does it protect me? Thanks
5
votes
4answers
798 views

What information can my ISP see when I visit a website? [duplicate]

For example, when I enter this URL: https://www.google.com/search?q=example or http://www.google.com/search?q=example I can see the word example that I was searching on Google. Can the ISP see this ...
0
votes
1answer
57 views

Setting certain response headers only if Referer is invalid

I came across this technique and I'm curious if there are any flaws in this design. A site sets the X-Frame-Options response header to deny only if the Referer header is not define or does not match ...
0
votes
1answer
65 views

Collect XML files from web server with secure authentication

I need to collect XML files from a 3rd party's web server. These XML files are generated by said 3rd party on a daily basis (e.g. data_2015-11-26.xml) and should therefore be fetched at least daily ...
0
votes
1answer
149 views

How to store a token of a restful API?

It's a basic question, but I see in a lot of tutorials of authentication in restful webservices that some user goes to a website and register yourself with an ID and a password, after this ...
13
votes
2answers
2k views

Are SHA-2 certificates considered obsolete, or current?

A guide on this site on how to make a decent Certificate Signing Request (CSR) says that I should be using SHA-2 certificates to secure a HTTPS webserver. Are SHA-2 certificates considered obsolete, ...
2
votes
1answer
74 views

Is using Gravatar in a web application with “private” URLs a security issue?

In our application, there is a kind of a "share" feature that sends an email to a user-provided address. This email contains a link with a secret access token (as part of the URL) that is valid for a ...
-3
votes
2answers
149 views

How is it that SSL/TLS is so secure against password stealing? [duplicate]

I know that it is very easy to steal a username and password from someone who is signing in to some website over HTTP, but we protect against that with just SSL/TLS. ​ How's that possible? I mean, ...
3
votes
3answers
1k views

Is it safe to access http sites from Tor?

Somewhere I read that you should only open HTTPS links on Tor because otherwise your ISP for example could read the webpages you visit. I searched on the subject and somewhere else I read that the ...
0
votes
2answers
35 views

What is the security measure that prevents me from posting using script and I must use browser to execute HTTP POSTs successfully [closed]

I'm using python to log into kijiji.ca with cookies enabled. The login is successful and passes (verified). I then use python to post an ad, however the ad posting keeps failing and redirects me to ...
1
vote
3answers
61 views

Is there any danger from CSRF if a webservice doesn't impact server data?

I've been reading about CSRF and how it works, and, if I understood correctly, the 'only' thing an attacker can do is force the user to perform actions he didn't intend. I understand the danger if ...
3
votes
1answer
134 views

HTTP Response splitting - is it browser caching or server caching issue?

I am trying to wrap my head around HTTP Response splitting. Although using WebGoat etc. I was able to learn how to do it in practice, but I guess I am still confused with some very fundamental ...
2
votes
1answer
84 views

How to use HTTPS for servers whose IP and domain name change, potentially frequently?

We have devices (think "Internet of Things") that have a HTTP server installed. Those devices can change their IP and domain name quite frequently (or have no domain name at all). They have a GUID ...
1
vote
3answers
216 views

Can man-in-the-middle attacks affect anyone not connected to the attackers network?

I'm trying to understand what these attacks are restricted to. I'm aware that man-in-the-middle attacks can be done if the attacker is on the same network (using something like Wire Shark), but is it ...
5
votes
1answer
132 views

Browsers and HTTP Public Key Pinning

The strength of HTTP Public Key Pinning (HPKP) is that the browsers are saving the keys from the HTTP header and can check in the future if the certificate from the website is valid. I have two ...
2
votes
1answer
84 views

Blocking a redirect link in an iframe on a chat site

There is a shortened link being spread which contains an @ symbol. j.mp/s@mething, and it's used for phishing purposes. When trying to block it, for some reason it doesn't like the @ character I want ...
-1
votes
1answer
60 views

When I visit a site using HTTPS is it exposed to sniffers? [duplicate]

Say for example I visit https://foo.com. Could someone that is sniffing the network determine that I am going there? At what level does the https encrypt the request? I know that data is secured ...
3
votes
1answer
3k views

How to supply HTTP Basic Authentication details in OWASP ZAP proxy?

I am using Basic HTTP Authentication to log into my Web Application. The credentials are Base64 encoded and sent to the Server. OWASP ZAP Proxy is intercepting the request and I can see the ...
1
vote
0answers
29 views

Is there a “smart cache” device which provides cache if authorized?

Is there an implementation of a HTTP (or decoded HTTPS) optimization device which would allow for "smart caching" - i.e. the ability to release some cached content (initially transferred by someone ...
21
votes
3answers
2k views

Is there any reason to block HTTPS?

Within our local education's I.T system, all websites served via HTTPS are blocked, except a select few websites which are 'authorized'. This results in some websites being unable to function ...
6
votes
3answers
791 views

HSTS on sites available over HTTP and HTTPS

I'm wondering if it makes sense to enable HSTS on a site that is served over HTTPS as well as over HTTP. What I mean is to add HSTS-Header if the site is accessed over HTTPS. But there is no ...
19
votes
4answers
2k views

Is a VPN really required with free Wi-Fi on a train?

Our local train service has added free Wi-Fi. I have been checking GMail and logging into a few apps. Then logging into websites using HTTPS. Is this secure, especially if done via app? The network ...
1
vote
4answers
1k views

What is a typical response from webserver for POST request?

My web server is returning a 200 OK after submitting a POST request, but it does not seem to be a good idea according to a security team. It should return a 302 "Object Moved", so that it avoids ...
2
votes
1answer
129 views

Flaw in HTTP Digest Authentication

I am working through my textbook and I came across this question: Below is the message format for a browser response to access a password-protected web page using HTTP digest authentication. GET URI ...
2
votes
1answer
285 views

OAuth 2.0 client side redirect instead of HTTP redirect

I'm implementing an OAuth 2.0 authorisation server using the Authorization Code flow (i.e. users will authorise client apps to connect to our server). The auth server is the same as the resource ...
-1
votes
1answer
107 views

Understanding HTTP response from Linux Server

I am working through a question that involves someone using a vulnerability in a Linux server in order to gain access to it. The first part of the question states In monitoring the network activity ...
8
votes
1answer
3k views

JWT token login and logout

Hi I am creating mobile native application that uses REST API endpoints to communicate with server side. I have had previous experience developing native clients, but I have simple token (random ...
3
votes
2answers
77 views

Does the Content Security Policy header provide a false sense of security if a page is served over unencrypted HTTP?

I have been thinking about how a developer restricted (for whatever reason) to serving an unencrypted site might protect themselves from threats such as overzealous ISPs injecting ads or notifications ...
0
votes
0answers
29 views

Verify which file a request to the server originated from

In order to make my question clear I will give a practical scenario. Lets say I have a server where I allow people to upload a script and allot them part of my drive, the script can make requests to ...