Questions tagged [http]
Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.
1,458
questions
1
vote
0
answers
24
views
How to retrieve TLS unique value from Apache?
TLS unique value is present in TLS 1.2 version.
In Golang, I can get the value of the TLS unique value from the http response through the field TLS.
I'd like know how I can get it from Apache.
Is ...
- 11
5
votes
1
answer
1k
views
Is HTTP header Permissions-Policy worth using if no features are used?
From the spec at https://www.w3.org/TR/permissions-policy-1/ it seems there is no way to whitelist features with a default blacklist, and each feature must be individually disabled in every single ...
CommunityBot
- 1
0
votes
1
answer
53
views
Is it secure to use session ID as authentication token received from an HTTP header?
I am writing a mobile application for an already existing web app.
In the backend, I implemented the usual cookie-based session ID authentication. with a CSRF token generated on login and sent with ...
- 46.4k
28
votes
6
answers
21k
views
Is HTTPS required for local network server to server communication
I am building web applications for my customer's company. At the server side, there will be 2 kinds of server to server network communication.
Separated REST API servers making requests among each ...
CommunityBot
- 1
0
votes
3
answers
171
views
Is HTTP/0.9 considered "End-of-Life" (EOL) due to security vulnerabilities or risks?
I'm exploring the history and evolution of the HTTP protocol and I know that HTTP/0.9 is generally not used anymore. It's clear how features evolved in newer HTTP versions and how primitive HTTP/0.9 ...
CommunityBot
- 1
1
vote
1
answer
2k
views
Website doesn't provide cookie (csrf token) when connecting over proxy. Why/how?
The Python code below should grab a CSRF token cookie from Instagram.com, but I get an error message when running the program through any sort of HTTPS or SOCKS5 proxy, informing me that the CSRF ...
CommunityBot
- 1
2
votes
2
answers
356
views
If a computer gets infected with malware, can the host firewall block the malware from communicating back to its controller on the internet?
I'm trying to figure out how secure a host firewall is, hence the question in the title.
I read that many firewalls allow outbound connections to port 80 to allow browsing, would that be enough for ...
CommunityBot
- 1
1
vote
2
answers
234
views
Bloom filter to prevent replay attacks in signed HTTP requests
I'm thinking about an authentication sheme of a REST API in a setting where the only thing the server stores about a client, is their public key (the asymmetric encryption scheme should not matter). ...
- 22.7k
0
votes
0
answers
22
views
Is POST-based XSSI possible?
With standard XSSI, an attacker can include a remote script which contains user-bound secrets across origins, and then read them out.
I have an endpoint which returns sensitive Javascript code, but ...
- 29.5k
24
votes
3
answers
5k
views
Why is the absence of a Content-Type header with a HTTP 204 response considered a security vulnerability and what should we do about it?
We have recently developed a web application with a RESTful API backend. This web app need to have a certain security certification (something called PCI-DSS), and thus it is being scanned ...
- 149
0
votes
1
answer
914
views
suricata http rule to identify POST requests
I can’t figure it out / understand. Need to write a rule that catches an HTTP POST request from one ip address more than three times in 10 seconds and logs it.
alert http $EXTERNAL_NET any -> $...
CommunityBot
- 1
12
votes
4
answers
72k
views
How is HTTP PUT and DELETE methods insecure, if they really are? [duplicate]
If I really need to use these methods, how do i make sure they are secure?
Edit: Is there a link or source where I can see how to make sure that 'PUT' and 'DELETE' methods are not able to delete or ...
- 1,760
0
votes
1
answer
38
views
Burpsuite proxy does not get HTTP error 429 but vanilla python requests do?
When I make a normal python request to some site without any proxies I am getting a 429 response, too many requests. However when I open up burpsuite proxy and add
proxies = {
"http": &...
- 1
1
vote
1
answer
56
views
Is it reasonable to have a product that requires LLMNR or mDNS?
I am trying to figure out the best way to manage security certificates for embedded devices who's webpage is accessed via IP address, and then the scenario for when that IP address changes.
Currently, ...
CommunityBot
- 1
1
vote
2
answers
143
views
How to mitigate risk of exploiting open POST endpoints?
I'd like to ask for advice reg. protecting the state-altering HTTP API endpoints of the API that I'm owning (POST etc.).
I'm owning a web application that exposes some HTTP endpoints to the world. ...
CommunityBot
- 1
1
vote
1
answer
3k
views
How to Spoof JA3 Signature?
I am using python requests library to make HTTP calls. However website bot detection is using JA3 fingerprint verification and blocking me.
Is there any way I can spoof the JA3 signature.
- 135
0
votes
1
answer
39
views
Is a random unknown HTTP request header 'Host' that is reflected in the HTTP response 'Location" header (3xx) a open redirect or DNS rebinding?
If I send an unknown domain name in the HTTP request header 'Host' to a webserver and the webserver responds with a HTTP status code 301/302 (redirect) along with a HTTP response header 'Location' ...
- 198k
1
vote
2
answers
531
views
How easy is it for hackers to intercept http traffic between VPN exitnode and the destination web service without being inside the VPN or web server?
Let’s say I’m using http connection over a properly set up VPN with secure protocol and implementation. Then, most likely, the connection will be secure all the way until it exits the VPN server.
But ...
CommunityBot
- 1
11
votes
3
answers
5k
views
What security risks are involved in using older HTTP protocols such as HTTP/1.x that would justify upgrading to HTTP/2 or HTTP/3?
As of 2023, still many webservers support HTTP/1.0 and HTTP/1.1 while not supporting recent HTTP/2 and/or HTTP/3 protocols. I understand that newer HTTP versions offer various performance enhancements,...
- 198k
1
vote
1
answer
159
views
Should the use of the HTTP 'ETag' header be avoided for security and privacy concerns?
I'm looking into the risks associated with the use of the HTTP 'Etag' header and found the following relevant information already.
Information Disclosure (inodes)
This article titled: "...
- 198k
0
votes
1
answer
85
views
Is HTTP/1.0 inherently more susceptible to denial-of-service (DoS) attacks?
I'm looking into HTTP version specific risks. HTTP 1.0 lacks support for persistent connections, meaning each request/response pair requires a new TCP connection to be established.
Considering the ...
- 6,661
6
votes
2
answers
9k
views
Can we use CORS policy to restrict API calls from native mobile app?
We can use CORS to restrict API calls to a specific host in a web app. How to do the same for native mobile app?
I want to restrict API calls from my app alone.
Is it possible to do so?
5
votes
2
answers
520
views
How to exploit XSS and SQL injection via HTTP verb tampering?
I was reading a paper about 'HTTP verb tampering' here:
https://blog.jeremiahgrossman.com/2008/06/what-you-need-to-know-about-http-verb.html
The author said:
HTTP verb tampering is generally used in ...
CommunityBot
- 1
10
votes
1
answer
5k
views
How do CORS proxy websites work?
While I was developing the front-end side of my web project, I got an CORS protection error. Not surprising since my front-end project was not in the same origin. After some search on how to bypass ...
- 101
0
votes
0
answers
34
views
TLS session keys [duplicate]
I Have a confusion here.
From what I know, in TLS1.2, the Client sends Client Hello and then the Server Sends a Server Hello, Certificate(with its public key) and Certificate chain, and then a Server ...
- 198k
0
votes
1
answer
396
views
How can I found a source of HTTP request in Wireshark?
There are weird requests to/from the AWS:
and another one to/from 177.143.198.104.bc.googleusercontent.com:
( http://whois.domaintools.com/177.143.198.104 )
I use Ubuntu 18.04 Desktop, web browsers ...
CommunityBot
- 1
1
vote
1
answer
612
views
Intensive 586 (ms-shuttle) port scan/exploit/hacking attempts
Recently i wanted to play a bit with TCP/UDP networking (and touch some custom HTTP server impl) on C# and found out that i'm getting requests from totally unknown dudes, such as this one:
FROM: [::...
CommunityBot
- 1
4
votes
2
answers
475
views
Is mime-sniffing still something to protect against with modern browsers (with X-Content-Type-Options)?
I have read about X-Content-Type-Options and it says often that it protects against IE mime sniffing problems.
I am wondering if in 2021 it is still valid and a problem for modern browsers? In other ...
CommunityBot
- 1
0
votes
1
answer
341
views
CSP Violation ms-appx-web://
We have a java application which allows users to upload attachments and save it on the server. The application has a content security policy defined like this:
base-uri 'self'; child-src 'self'; form-...
CommunityBot
- 1
1
vote
2
answers
888
views
How to understand a single packet embedded with multiple requests?
When I read Multi VERB Single Request:
This Attack is also a variation of the Excessive Verb Attack
strategy. The attacking BOT creates multiple HTTP requests, not by issuing them one after
another ...
CommunityBot
- 1
12
votes
3
answers
3k
views
What attacks are mitigated by requiring CORS for subresource integrity verification?
Can someone elaborate on the attacks alluded to in this paragraph from the W3C SubResource Integrity spec?
In order to mitigate an attacker’s ability to read data cross-origin by brute-forcing ...
- 101
5
votes
1
answer
7k
views
Is the HTTP method OPTIONS secure nowadays?
I've read How to exploit HTTP Methods:
OPTIONS - this is a diagnostic method, which returns a message useful mainly for debugging and the like. This message basically reports, surprisingly, which ...
- 1,176
0
votes
2
answers
161
views
What are the security risks associated with hosting a web application that does not handle sensitive data without HTTPS?
Suppose one hosts a web application that does not handle any sensitive data (e.g. passwords, session cookies, etc.), without using HTTPS. What potential security issues arise as a direct consequence ...
- 128k
15
votes
5
answers
4k
views
HTTP Content-Security-Policy Nonce and Caching
Is anyone here able to clarify how caching affects adding a nonce=value to all inline javascript?
If the nonce must be unique and unpredictable, then one would need to disable all server-side (i.e. ...
1
vote
3
answers
1k
views
What exactly are Hidden HTTP Parameters?
I read a lot of reports where 'hackers' potentially exploited a 'Hidden HTTP Parameter'. There are also tons of tools which are developed for this exact purpose.
Example : https://blog.yeswehack.com/...
CommunityBot
- 1
2
votes
1
answer
2k
views
Bettercap 2.x SSLStrip Is Not Converting Links
I have the latest version of bettercap. I have the latest version of Kali Linux using the latest version of VirtualBox on the latest version of Windows 10. My target machine is the latest version of ...
CommunityBot
- 1
0
votes
1
answer
29
views
Why does the DOM single-origin policy take into account protocol and port? What if it was just domain?
I'm learning the basics of network security and am trying to really understand the single origin policy. I was wondering what the vulnerabilities would be if an origin was only defined by domain, as ...
- 46.4k
2
votes
1
answer
458
views
How to exploit HTTP Request Smuggling?
I set up the following lab using HAProxy and Gunicorn.
Both "Smuggler.py" tool and "HTTP Request Smuggler" BurpSuite extension detected CL.TE vulnerability.
I checked it manually ...
CommunityBot
- 1
1
vote
1
answer
465
views
HTTP Headers: Document Policy vs. Permissions-Policy/Feature-Policy
I'm checking the options to harden my web app by setting the appropriate HTTP headers.
Besides the Content Security Policy (CSP) there are two another approaches: Document Policy and Permissions-...
CommunityBot
- 1
0
votes
1
answer
162
views
How to reliably identify referrer on client browser?
Is there any way to reliably identify the referring site on modern browsers (not considering manual HTTP requests outside of a browser e.g. cURL, etc.)?
Referrer header will not work because the ...
CommunityBot
- 1
1
vote
1
answer
209
views
Security Considerations To Account for When Redirecting From Microservice to Another
I am evaluating the above service design where I want to have mechanism to pass a user through multiple microservices. In this simple example, the user goes through a sign-up process and once done, ...
CommunityBot
- 1
1
vote
1
answer
123
views
What happens first in a request having both CSRF Token and JWT token, authentication or authorization?
This question came across my mind when I sent an ajax request from html to a backend django server and forgot to add a csrf token to the request payload and recieved this error.
403 error means that ...
- 161
2
votes
1
answer
1k
views
Snort Inline Mode(IPS) Routing Packet Forwarding
I'd like to build an IPS which would be a seperate endpoint than the router and/or protected servers. To achieve this I've installed to my Ubuntu server Snort with DAQ(AFPACKET). The instructions I've ...
CommunityBot
- 1
0
votes
1
answer
147
views
The router (that my PC is connected to) is continuously attempting to connect through TCP80. What would be the reasons?
I have no access to the router nor do I have any administrative access to this local network. But every 5 minutes the router attempts to connect to my PC through port 80/tcp, and it attempts exactly 4 ...
CommunityBot
- 1
1
vote
2
answers
111
views
How to prevent attacks on a personal webserver
I'm currently working on some modules on hackthebox. In that regard, I recently set up a web service: sudo python3 -m http.server 8080
When I did a wget to my server, it showed up in the log as usual, ...
- 46.4k
0
votes
1
answer
573
views
Spoof IP address after a TCP handshake established
Is it possible to spoof the IP once a TCP handshake was performed successfully?
For example:
Perform the handshake
Use the session with the same IP which performed handshake but on
different machine ...
- 128k
0
votes
0
answers
56
views
HTTP Request Smuggling Exploit - Need Clarification on Behavior of the 'Host' Header
I've been reading about HTTP Request Smuggling attacks and I've come across a situation that I don't fully understand. I've been studying the report by James Kettle where he describes an attack ...
- 1
1
vote
1
answer
102
views
"PUT /SDK/webLanguage HTTP/1.1" on a server with only port 22 open
I've recently spun on a new droplet on Digital Ocean with Ubuntu 22 and enabled UFW and allowed only SSH, which reports being active even after a reboot:
sudo ufw status
Status: active
To ...
- 62.1k
0
votes
1
answer
273
views
How secure is HTTP auth digest in 2023
I'm trying to figure out the time needed to crack an HTTP digest auth. According to the RFC2069, the digest in calculated according to this scheme :
HA1 = MD5(username:realm:password)
HA2 = MD5(method:...
- 46.4k
0
votes
1
answer
75
views
Applying application-level signing in HTTP
I have to secure HTTP requests`s body on application layer, so I wanted to generate signatures with hash of body and the receiver will validate it.
But I can do it in different way and apply it into ...
- 3,438