Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP ...

learn more… | top users | synonyms

3
votes
2answers
77 views

Does the Content Security Policy header provide a false sense of security if a page is served over unencrypted HTTP?

I have been thinking about how a developer restricted (for whatever reason) to serving an unencrypted site might protect themselves from threats such as overzealous ISPs injecting ads or notifications ...
0
votes
0answers
29 views

Verify which file a request to the server originated from

In order to make my question clear I will give a practical scenario. Lets say I have a server where I allow people to upload a script and allot them part of my drive, the script can make requests to ...
2
votes
2answers
117 views

Can two users share the same Request.UserHostAddress?

I am working on an ASP.NET MVC-5 web application, which is available to public users (no login is required). And I need to prevent the same user from submitting more than 5 "contact us" requests ...
-1
votes
3answers
2k views

Why no support for TCP Sockets in JavaScript [closed]

I know there are now WebSockets, but what is the issue with providing a socket API to allow interacting with existing protocols? I mean, after all, I can use a hidden flash object to do the same ...
2
votes
1answer
208 views

Capturing (1x Only) HTTP POST Request [tcpdump]

Every now and then; I like to fire up tcpdump and just watch the network traffic as the packets flow on by. For example: user@host:~$ sudo tcpdump -Aevvv Will parse & print all local ...
6
votes
1answer
63 views

Relationship between http time response and geo-location

I have a lot of pcap files about traffic generated by malware, this include vast kind of packets like TCP UDP and more important HTTP. Whereas is possible I have the geo-locations related to the IP ...
1
vote
2answers
3k views

Implications of the security model of HTTP cookies on HTTPS connections

I have a feature that would require the user being able to provide the URL for a custom script, store the URL in a cookie, and incorporate the script into subsequent responses. This, of course, ...
2
votes
1answer
151 views

Can cascaded routers protect inner network's machine from attacker from outer network?

Given: Outer Network router A wan ip 209.123.12.11 address 10.10.0.1 machine A address 10.10.0.10 gateway 10.10.0.1 Inner Network router B wan ip 10.10.0.100 address 192.168.10.1 ...
2
votes
1answer
133 views

How does LastPass know that Microsoft.com uses the password for Live.com?

When I visit Microsoft.com, the LastPass dropdown lists my username/password for login.live.com. It does something similar for Playstation.com and several other sites. How does it know? Are these ...
4
votes
1answer
273 views

HTTP Response Splitting in practice

Have you ever seen HTTP Response Splitting in laboratory environment? There are many examples for HTTP Response Splitting vulnerability. I used old PHP and managed to get 2 responses from server ...
2
votes
1answer
420 views

302 redirect and the body on the page (you are redirected to …)

I have page which take URL on query and string and it. Then, you get redirected using 302 to another page, and the response of the page contains HTML code and the redirect header. Like this: <html&...
2
votes
1answer
232 views

How should I tunnel arbitrary protocol traffic over HTTPS?

I'm posting this question from a moving train! (Ok, maybe that's not so impressive.) This train has an annoying WiFi - it's low-throughput, high-latency, tends to lose packets, and blocks most kinds ...
5
votes
2answers
2k views

HTTPS POST request header versus request body

Is there any security difference between placing sensitive data, such as an API key in a POST request header versus the POST request body assuming the API server is HTTPS-only? While you frequently ...
2
votes
1answer
49 views

Is it secure to have an iPad app run a webDAV server on localhost without authentication?

I have two iPad apps running on the same device. One is hosting a webDAV server on http://localhost:8080 without any authentication (the server is active whilst the app is foregrounded, and for a few ...
1
vote
1answer
109 views

What is the proper setup procedure for SSL Tunnel certificates?

I am a systems integrator using a system designed for bringing HVAC data up to a common interface; this system/software platform is called Niagara AX. The combination of the customer's network setup ...
1
vote
6answers
366 views

Can people know the server I'm connecting to despite being on SSH/HTTPS? [duplicate]

I understand that by connecting securely over SSH or HTTPS, the data that I transfer is cryptographically secure. However, can someone spying on my connection still determine the server I'm sending it ...
-3
votes
2answers
90 views

Which HTTP requests support custom data in URL? [closed]

I am aware that HTTP GET requests are sent to web-server using query-string name/value pair in URL. This means that one is able to pass custom data to web-server. For example http://some_site.com.br/...
2
votes
2answers
107 views

Can 3rd party JavaScript libraries access the http headers of the hosting html page

So, I have website, it uses a cookie stored in the http header of the downloaded html document to maintain the session while the end user is logged on and accessing there 'secure' data. This webpage ...
-2
votes
3answers
80 views

Can a website that uses https be absolutely reliable? [duplicate]

Https websites cover some security requirements and certify the author, but how can we be sure that an author of such an https website is not malicious?
3
votes
1answer
111 views

Logout tied to cookie expiry

I am looking for an event to automatically logout a user from the application. Typically I would do it when an inactive session expires. I was wondering if it is secure to do so using cookies. So here ...
0
votes
5answers
3k views

How to send HTTPrequest anonymously [closed]

I want to send a HTTPrequest to a specific web address, but with different IP address. For example, if a webserver detect IP address, then add it to a database. If another request come from a IP, ...
2
votes
1answer
104 views

Generating shared secret key using existing receivers public key and senders private key

I have the public key of the receiver, and the private key of the sender. I want to generate a new key by using the receivers public key and senders private key (also known as the signing key) to ...
7
votes
1answer
2k views

HTTP Caching Headers: private vs no-cache

We're currently reviewing our set of "no-cache" security headers: Cache-Control "no-cache, no-store, must-revalidate Pragma "no-cache" Expires 0 Besides the "standard" set above, I found this ...
2
votes
3answers
387 views

How does Facebook really identify requests?

Today I have discovered something very strange. It seems like Facebook is playing some kind of unfair game for identifying one's online identity. So, here is what I have done: I have a regular ...
3
votes
0answers
60 views

WiFi Fingerprinting RFC2617 Linux Device Cannot Unauthenticate Unless AP Password Changes

There is a Cisco WiFi Access Point in the office that is intended for guests. It is an open network in that you can associate without providing a password with the SSID. It supports RFC2617 and so the ...
12
votes
2answers
2k views

Is sending a string (representing a HTTP message) over SSL the same as sending a HTTPS message?

I want to communicate from an embedded device that only has SSL for encryption with an intranet-server that can receive HTTPS. Will SSL encrypted HTTP string be interpreted as HTTPS? or is there more ...
5
votes
3answers
1k views

How can I defend against malicious GET requests?

My server is getting hit with a variety if requests like the following: Started GET "/key/values" ActionController::RoutingError (No route matches [GET] "/key/values") Started GET "/loaded" ...
11
votes
1answer
852 views

Why can't you steal the synchroniser token to do CSRF? [duplicate]

I'm reading up on CSRF and I came across synchroniser tokens. I don't understand why you can't do a CSRF to get the token to do a real CSRF. Example: bank.com has a form like this at https://bank.com/...
2
votes
1answer
264 views

Encrypting layers of OSI

I was reading that WPA2-PSK encrypts layer 2 of the OSI network model. What is the danger of having this layer in plaintext (I know it can be decrypted very easily from within the network)? Is there a ...
17
votes
6answers
918 views

Securing web applications with only a reverse proxy

In order to secure its public HTTP API (so called REST), my client is asking me to implement a simple HTTP reverse proxy that will verify (OAuth 2.0) access tokens and forward HTTP requests to ...
1
vote
1answer
109 views

How to Develop Waf as Service [closed]

Recently, I've started a my educational project WAF as service. To develop this project as per my view, following things are required: Web Application Firewall is in-line with the web servers; it ...
1
vote
0answers
710 views

'http_login' metasploit module isn't able to Brute Force the target. Any suggestions? [closed]

I'm trying to Brute force the http Basic authentication on the domain pentesteracademylab.appspot.com The complete path is pentesteracademylab.appspot.com/lab/webapp/basicauth I'm using the ...
8
votes
3answers
6k views

Windows: unknown program/service etc. sends HTTP request to download a file; how can I find the origin of that request?

The firewall of my company has detected and blocked a repetitive (every 15 min) HTTP request from a PC, which tries to start a download of a file called ..._chrome_installer.exe(or so) from the host: ...
-3
votes
1answer
105 views

Session hijacking [closed]

I know one way of doing session hijacking 1.copying the session value from the chrome browser and pasting the cookie value to firefox browser Is there any other way of doing session hijacking ? If ...
7
votes
1answer
2k views

What are those http://123.249.24.233/POST_ip_port.php POST requests I get on my server? [closed]

I receive a lot of requests on my Node.js server, which I don't understand. On the picture, there are phpMyAdmin-oriented requests, that I understand as automated testing against phpMyAdmin. But I ...
1
vote
1answer
78 views

How to make sure my HTTP server on Win 7 is secure? [closed]

I'm hosting a HTTP server from home. I'm concerned about security issues since the machine has some personal files in it. I have forwarded data from external IP port 80 to my IP at port 80. The ...
7
votes
2answers
158 views

What are the security benefits to block all http referer header requests for web browser?

I would like to know also if you lose site functionality. Is this a security benefit that is beneficial than compromising functionality (if compromising at all)? What I mean by this is one a ...
3
votes
1answer
305 views

Secure Flag and HSTS in HTTPS Only site

If I had a site only available in HTTPS should I still enable HSTS and Secure Flag?
-1
votes
1answer
222 views

SSL and Fake Domain

I am reading information related to SSL handshake on the Internet. It seems like in the last step the domain name is compared to the domain in the certificate. How exactly is this protecting against ...
2
votes
0answers
130 views

Metasploit reverse_http(s) PAYLOAD for linux target

During exploitation via metasploit's browzer_autopwn, I need to set a payload using http or https channel on a linux target. But there is no reverse_http(s) available in linux payload category. What ...
1
vote
1answer
334 views

HTTP status 302 and subsequent redirect [closed]

I have sent a HTTP GET request to google.com and I get a 302 status. Now the location : url in http header is an http:// address, instead of https. When the browser visits this address I get back a ...
-3
votes
1answer
984 views

insecure HTTP Methods Enabled — how to control? [closed]

Here I am new to insecure HTTP Methods Enabled. The server allows HTTP methods that are considered dangerous. The following methods were enabled: PUT,DELETE Software used: Apache-tomcat-6.0....
4
votes
1answer
172 views

What are the security implications of enabling a SNI-hole on a web server?

A web server (let's say Apache 2.4) implements SNI. It is configured with a 4096 bit SHA384-signed Wildcard Certificate (*.land.org) with a Subject Alternative Name (land.org). The Certificate ...
7
votes
2answers
509 views

Any reasons for using “Basic HTTP” authentication?

I'm building a simple API that will be used in an android app (that only about 3-4 users will ever have). The app connects to the server and sends GET/PUT requests. I've read through my googling that ...
3
votes
1answer
147 views

Force https without 301

For my website's .htaccess I currently have: RewriteCond %{HTTPS} !=on RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301] So that when someone visits the page over http they get a 301 ...
6
votes
1answer
217 views

Does HTTPS protocol leak HTTP body length?

It seems that in a MITM attack, hackers may know the whole HTTPS packet size sent through the network (i.e. size of HTTP headers + HTTP body + overhead). Besides that, does the HTTPS protocol also ...
2
votes
3answers
189 views

Risks associated with HTTP content injection?

I'm curious about the risks associated with HTTP content injection, where an ISP injects content to pages accessed over non HTTPS connections. Some examples: http://arstechnica.com/tech-policy/...
0
votes
4answers
193 views

Custom CSRF protection mechanism without persisting tokens

I have had this functionality (csrf protection) for quite some time now. The thing I never liked about it is that it saved csrf tokens in the session file. While it may not be a real problem I see it ...
3
votes
1answer
416 views

How to detect changing IP address and user agent on a HTTP session?

I have some HTTP logs where I see the hacker changing his IP every request, and occasionally changing his useragent. Is there a way to detect this automatically? Perhaps a snort rule? or any other ...
1
vote
1answer
169 views

creating a TLS encrypted API

I have an HTTP API endpoint on my server that is encrypted (TLS). It is not a public API; users must sign-in and validate their account/identity to access the API. When I connect with my test client (...