Questions tagged [http]

Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.

Filter by
Sorted by
Tagged with
0
votes
1answer
37 views

Security Considerations To Account for When Redirecting From Microservice to Another

I am evaluating the above service design where I want to have mechanism to pass a user through multiple microservices. In this simple example, the user goes through a sign-up process and once done, ...
52
votes
6answers
17k views
+100

Does a CSRF cookie need to be HttpOnly?

We've recently were handed a security report containing the: Cookie(s) without HttpOnly flag set vulnerability, which we apparently had in one of our internal applications. The applied fix was as ...
0
votes
1answer
30 views

Signing webhooks: symmetric vs asymmetric

I want to sign webhooks so that client services can verify that a request came from my service. Looking around, it seems that most SaaS use symmetric keys shared by the client and the SaaS. Obviously,...
1
vote
4answers
680 views

Security concerns surrounding HTTP GET in Web Development

I'm currently a developer making my first foray into web development, mostly using C# ASP.NET services such as MVC and Web API. Getting into the HTTP side of things, I'm currently deciding whether or ...
1
vote
1answer
3k views

Intercept traffic other than port 80 and 443 on burp suite

I am trying to intercept traffic on port 8000. For example my application is running on abc.com:8000. I am unable to intercept this traffic on burp suite. How can I intercept this traffic in Burp?
0
votes
1answer
64 views

Use of HTTP functions in GCP Cloud Functions Is Not Secure. Why they are still available?

As Google mentions itself in the documentation, the HTTP functions in Cloud Functions have no authentication and are not secure. HTTP functions are unprotected and will respond to any HTTP request,...
0
votes
1answer
37 views

Bypassing header validation

I have made a script that can be used for exploiting CORS misconfiguration. The script works fine but if I want to send an extra header to the request by xhttp.setRequestHeader("test_header", "...
27
votes
4answers
22k views

Is it possible to pass TCP handshake with spoofed IP address?

Little time ago, me and my friends argued if TCP handshake can be passed with a spoofed IP address. Assume I have a web server that allows only certain IP addresses. Can anyone connect that web ...
0
votes
0answers
50 views

Method to bypass \n in WAF (\n vulnerability)

I have this application that has an input box where the data is going to be sent in a JSON format. The JSON payload might look like this {“message”: “hello\nmy name is andi”} But the problem is the ...
0
votes
1answer
66 views

Deserialization Opportunity?

I have minimal experience exploiting deserialization vulnerabilities and I am working on and I have identified the following URL endpoint. This is it URL Decoded: /Account/Register?Count=0&Keys=...
-1
votes
0answers
60 views

why does ssl need record protocol?

According to this answer, I think that this fact that at the beginning of communication, record protocol just uses a null cipher will make some issues. For detecting any issue, I need to know in which ...
7
votes
1answer
315 views

What would happen if some random webpage made an Ajax request for http://127.0.0.1/private.txt?

I run a localhost-only webserver (PHP's built-in one) for all my admin panels and whatnot on my machine. I'm worried that, if any random webpage has a JavaScript snippet which makes an Ajax call to ...
1
vote
1answer
85 views

Can somebody explain why the IP address 192.168.1.1 is apparently “special” and not following the CORS rules?

I asked this question: What would happen if some random webpage made an Ajax request for http://127.0.0.1/private.txt? The answers/comments confuse me. Am I right in interpreting them like this? "...
6
votes
1answer
110 views

GET request in the body of GET request

I'm testing some API endpoints aaand with some arbitrary crazy tests, like: GET /products/items HTTP/1.1 Host: api.companysite.com Content-Type: application/xml User-Agent: Mozilla/5.0 (Windows NT 5....
4
votes
2answers
106 views

Should I forbid GET for non-side effect POST by default?

If a webpage is safe (no serve-side effect) but use POST parameters (to avoid any URL's length issue), then should it be forbidden to call it using GET? Or should each page have some kind of "marker" ...
0
votes
1answer
47 views

Exploiting CORS and storing the response to server

I am trying to exploit misconfiguration CORS. I have created and hosted a file in HTML and Javascript where if someone clicks the link there HTTP response containing cookies will reflect them on the ...
3
votes
2answers
64 views

How can HTTP Parameter Pollution be exploited?

In HTTP Parameter Pollution, I know theory how it work; you inject multiple HTTP parameters with the same name to trigger bugs in the server, but I can't understand how one can exploit this. When I ...
-1
votes
1answer
44 views

How to protect my webserver from unauthorized client applications? [duplicate]

I would like to host simple HTTP webservices and develop a web client for it (basic javascript app in the browser). any person (even without registering) shold be able to access the webservices but ...
1
vote
1answer
39 views

Securing implicit tokens (Example: Moltin)

I'm fairly new to security but I'm trying to understand how companies have their APIs set. One such case is Moltin's Implicit Token. Basically they provide you with a read-only (for the most part) ...
1
vote
2answers
73 views

Is it possible too exploit CORS with double Origin value?

I found a website that has a well implemented CORS configuration, but for some reason I am able to insert two Origin headers in a POST request, and both of these values are reflected in the reponse. ...
0
votes
0answers
16 views

Mysterious ERR_CONNECTION_RESET on specific website, what's the problem? [migrated]

I have three Windows 10 machines in my home network, one desktop (LAN) and two laptops (WLAN). I am trying to access a certain website (belastingdienst.nl, the Dutch tax agency website). Results (...
1
vote
1answer
221 views

HTTP request smuggling, basic TE.CL vulnerability

Im trying to learn about http request smuggling and Im trying out the labs for burp suite. Im stuck on the TE.CL vulnerability, Ive clicked on the solution (see below:https://portswigger.net/web-...
16
votes
3answers
4k views

Why should someone block all methods other than GET and POST in a RESTful application?

TL;DR: Is there a valid reason to demand a software vendor to stop using HTTP PUT and DELETE methods in a web application and use only GET and POST? The application uses frameworks to whitelist ...
0
votes
1answer
118 views

How can I found a source of HTTP request in Wireshark?

There are weird requests to/from the AWS: and another one to/from 177.143.198.104.bc.googleusercontent.com: ( http://whois.domaintools.com/177.143.198.104 ) I use Ubuntu 18.04 Desktop, web browsers ...
0
votes
0answers
40 views

How does the Great Firewall of China handle TLS encryption? [duplicate]

My understanding is that when a client and server are connected through TLS, only they have the key needed to encrypt and decrypt messages. My question is, given that the Great Firewall of China does ...
0
votes
1answer
157 views

Passing user ID as parameter without any authentication, what are the security risks?

I've read that passing GUID as URL parameter isn't considered insecure because usually, an app has an authentication mechanism (checking against some session token). However, how secure would an ...
0
votes
0answers
34 views

Can DNS-over-HTTPS be broken by reverse DNS lookups? [duplicate]

If anyone can see the receiver IP address in a HTTPS request, what will stop ISPs from analysing the packet, reverse DNS lookup the IP and block the access to the domain the client is trying to reach. ...
6
votes
1answer
479 views

Has HTTP bogus request type “COOK” been used in any known website attacks?

An apache web server access weblog shows a request type "COOK" where POST or GET are normally found. Is such a request part of any known web-based site attacks?
0
votes
1answer
62 views

RSA Key, String vs Hex vs Base64 vs byte-array represantational form

....key is normally a string of bits used by a cryptographic algorithm to transform plain text into cipher text or vice versa.... https://www.di-mgt.com.au/cryptokeys.html Suppose I have a Backend ...
42
votes
7answers
9k views

Why is the HTTP protocol more susceptible to being intercepted than the BitTorrent protocol?

I'm downloading an .iso file that is offered through the main website, which recommends users to use BitTorrent. In addition, they offer the download via HTTP using different mirror sites that belong ...
1
vote
3answers
101 views

How to limit web API microservice communication to specific list of machines?

I have an PHP API that I want to be consumed only by one static website. However the HTTP is not secure as from what I suspect any header can be spoofed (IP - I may be wrong here, domain name, and so ...
3
votes
1answer
58 views

What are the security implications of allowing API consumer to decide primary key stored in database?

Story We are developing an API that which allow consumer to create or modify (i.e. upsert) objects stored in database via an endpoint with HTTP PUT. The primary key of the object stored in this way ...
1
vote
0answers
61 views

Http Content-Length too long - Time Out

I was recently going through the HTTP Desync attack presented here: https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn This raised one question concerning the way the HTTP ...
3
votes
2answers
87 views

Are there potential risks to sending HEAD requests to user-supplied URLs?

I have an application that unshortens URLs by using the python requests library to send HEAD requests with allow_redirects=True. I don't do anything with the response except check the response URL. ...
2
votes
1answer
52 views

UUID as auth token [duplicate]

I am working on a small IOT device that basically is a status display, which includes data about my phone. That means that I have a simple web server running, which can be used to update the devices ...
0
votes
1answer
57 views

Advantages of http CONNECT method over TLS

I wonder what the advantages of http CONNECT request over TLS are. I understand that the CONNECT request data from client to proxy is encrypted. But I want to know more specific advantages. Which ...
3
votes
1answer
1k views

Tunnel ssh over http with custom headers

I'm trying to set up corkscrew to make an SSH tunnel over HTTP, but I need to add custom headers after the "CONNECT" statement and before the ssh tunnel. Does corkscrew support it? If yes, how can I ...
0
votes
1answer
82 views

Crack a single http cookie and gain access to a random user's account! [duplicate]

I was looking for lots of information about cookies recently. What attracted me the most was the fact that cookies come in all forms and can be hijacked through arp poisining and spoofing on the local ...
1
vote
1answer
68 views

Is there a security benefit to testing HTTP header presence with Javascript?

I have found in one of the client side libraries that it is performing an AJAX call to an API and checking if response contains all of the following headers with corresponding values (as a security ...
24
votes
5answers
7k views

Is it unsafe to use /etc/hosts file as a website blocker in the following manner?

I'm a linux noob, and while looking for a simple OS-level website blocking technique, I came upon the solution of using the linux hosts file like so: 127.0.0.1 websiteiwanttoblock.com 127.0.0.1 ...
0
votes
3answers
76 views

Self-signed vs. authority issued certificate for internal web services

From an information security perspective, which is best for private (on-premise) micro-services (web services) accessed via HTTPS? Are there an advantages in using certificates signed by a Third ...
2
votes
0answers
61 views

Bruteforce https post using single tcp connection

So I've tried bruteforcing my server using thc-hydra's https-post-form, but it floods the server very quickly and the requests start timing out. However, If I go through the browser where the HTTP ...
0
votes
1answer
82 views

Should I scan both HTTP and HTTPS seperately?

I'm doing a scan on some domains (who I will not name here) using OWASP ZAP. When I typed in the URL of a domain as http://thedomain, it returns http://thedomain/robots.txt and just a bit more. After ...
1
vote
2answers
76 views

How safe is it to allow JS CDNs in a HTTP content security policy?

I am tasked with adding a content security policy to a whole bunch of Magento stores to protect against credit card scraping code, which can sneak in via the store admin or GoogleTagManager* when a ...
0
votes
1answer
189 views

How to secure communication between docker container and an elasticsearch server?

I have a spring boot application running inside a docker container. This application communicates with another server which hosts Elasticsearch on it. How do I secure the communication between these ...
2
votes
2answers
81 views

How to mimic a HTTP POST request?

I want to mimic a HTTP POST request that I intercepted and have raw on a file, what would be the best way to send it and be certain that I sent exactly the same request? example file: (private data ...
1
vote
2answers
100 views

Using certificate on same server but different port for https

I have taken a working HTTPS certificate from a server that I want to use on the same server, just on a different port. The certificate has a Subject Alternative Name defined in it. Using keytool, I ...
0
votes
2answers
2k views

Meterpreter reverse_https ExitOnSession

When I'm setting the options for the reverse_https handler in metasploit, why would I set ExitOnSession to false and SessionCommunicationTimeout to 0? I don't fully understand the purpose. When I used ...
1
vote
1answer
82 views

Authentication via HTTP on VPN

There is an authentication server (OAuth2) that is only accessible from private network. A customer wants me to implement an app where users use VPN to authenticate themselves on such a server via ...
3
votes
1answer
157 views

Why isn't cloud (AWS, Azure, GCP) metadata served over HTTPS?

Why can any application or user on your server type an insecure URL like these to get server information about that instance? http://instance-data.us-east-1.compute.internal/latest/meta-data/ http://...