Questions tagged [http]

Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.

113 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5 votes
1 answer
1k views

Is HTTP header Permissions-Policy worth using if no features are used?

From the spec at https://www.w3.org/TR/permissions-policy-1/ it seems there is no way to whitelist features with a default blacklist, and each feature must be individually disabled in every single ...
captainmish's user avatar
5 votes
2 answers
516 views

How to exploit XSS and SQL injection via HTTP verb tampering?

I was reading a paper about 'HTTP verb tampering' here: https://blog.jeremiahgrossman.com/2008/06/what-you-need-to-know-about-http-verb.html The author said: HTTP verb tampering is generally used in ...
Learrn9990's user avatar
4 votes
0 answers
687 views

Is an out-of-band request via DNS by abusing the X-Forwarded-For header exploitable

By changing the X-Forwarded-For header in a request, I am able to have it sent an OOB interaction with Burp Collaborator requesting a DNS lookup of type A. Is there any risk to this vulnerability or ...
Lieven Keersmaekers's user avatar
4 votes
0 answers
144 views

WiFi Fingerprinting RFC2617 Linux Device Cannot Unauthenticate Unless AP Password Changes

There is a Cisco WiFi Access Point in the office that is intended for guests. It is an open network in that you can associate without providing a password with the SSID. It supports RFC2617 and so the ...
PhilBot's user avatar
  • 141
4 votes
0 answers
131 views

Cross Origin Resource Sharing question

I have some mockup html/javascript on my desktop, I made an ajax GET call to: http://www.bungie.net/platform/Destiny/TigerPSN/Account/4611686018429149347/Character/2305843009215132906/Activities/ ...
Robert Fralin's user avatar
3 votes
0 answers
462 views

OAuth for command line application

I'm planning to add an "official" command line tool for developers to interact with our API. The tool is basically just a glorified curl client, interacting with the API via HTTPS ...
Moritz Friedrich's user avatar
3 votes
0 answers
4k views

how to fix Out-of-band resource load (HTTP) issue identified by BURP scan

I have Salesforce application which is using my web application hosted in one of our customer's server (IIS 8.0). BURP Scan has identified one issue in my web application. Issue is something like ...
rakesh's user avatar
  • 31
2 votes
1 answer
455 views

How to exploit HTTP Request Smuggling?

I set up the following lab using HAProxy and Gunicorn. Both "Smuggler.py" tool and "HTTP Request Smuggler" BurpSuite extension detected CL.TE vulnerability. I checked it manually ...
mehran_2020's user avatar
2 votes
0 answers
478 views

What are NGINX reverseproxy users doing to prevent HTTP Request smuggling?

Since NGINX does not support sending HTTP/2 requests upstream, what are the present NGINX reverseproxy users doing to mitigate HTTP Request Smuggling vulnerability? I understand that the best way to ...
Sai Vishnu's user avatar
2 votes
0 answers
116 views

http smuglling how can i do a poc in a big websites?

i try to find http smuggling in big bug bouny program if i send this to the server POST /path HTTP/1.1 Host: subdomain.domain.com User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 ...
eyal's user avatar
  • 73
2 votes
0 answers
117 views

Is the HTTPS lock sign displayed if reasources are loaded from insecure sites?

We all know that if you visit a secure site which uses https, all modern browsers will show a padlock sign if it has a CA certified certificate. My questions are: Suppose there is an image loaded in ...
SRaj's user avatar
  • 155
2 votes
1 answer
1k views

Snort Inline Mode(IPS) Routing Packet Forwarding

I'd like to build an IPS which would be a seperate endpoint than the router and/or protected servers. To achieve this I've installed to my Ubuntu server Snort with DAQ(AFPACKET). The instructions I've ...
TheSoulkiller's user avatar
2 votes
0 answers
810 views

HTML Injection to blind SSRF testing retrieves only DNS Query

I recently came across an application that was vulnerable to HTML injection on the invite function. When I insert <img src="image.jpg"> the image got rendered on the mail I received. I ...
None_None's user avatar
2 votes
0 answers
1k views

Unable to start reverse shell over HTTP

I am able to get a reverse shell working locally over TCP, but failing to trigger it remotely over HTTP. Locally over TCP: Attacker terminal runs netcat to listen for a connection over port 8000: nc -...
NattyP's user avatar
  • 21
2 votes
0 answers
218 views

Bruteforce https post using single tcp connection

So I've tried bruteforcing my server using thc-hydra's https-post-form, but it floods the server very quickly and the requests start timing out. However, If I go through the browser where the HTTP ...
Sam's user avatar
  • 21
2 votes
1 answer
2k views

Bettercap 2.x SSLStrip Is Not Converting Links

I have the latest version of bettercap. I have the latest version of Kali Linux using the latest version of VirtualBox on the latest version of Windows 10. My target machine is the latest version of ...
user21303's user avatar
  • 163
2 votes
0 answers
787 views

Random Alphabetical String Added to URL

I originally asked this question over at Stack Overflow, but someone there suggested asking here because it might be possible that something malicious may be causing the following issue: Users have ...
user138172's user avatar
2 votes
0 answers
72 views

Concerns when passing all OPTIONS requests through authorization proxy gateway

I have a React based application which uses RESTful services on backend distributed on private network. To communicate with such services using AJAX, client application sends all its request through ...
Kunok's user avatar
  • 121
2 votes
0 answers
274 views

Assymetric auth like AWS4-HMAC-SHA256

I wondered if there exists a defined mechanism similar to AWS4-HMAC-SHA256 (as a scheme in Authorization HTTP header), but using asymmetric algorithm, probably ed25519, and how secure it would be to ...
Petar Donchev's user avatar
2 votes
0 answers
797 views

HMAC authenticated API calls with multipart/form-data file uploads

We have an existing API where 3rd parties can push data. The API calls are authenticated with HMAC using the same scheme as described in Ruby's ApiAuth library which I use to verify signed requests. ...
DiegoSalazar's user avatar
2 votes
2 answers
350 views

If a computer gets infected with malware, can the host firewall block the malware from communicating back to its controller on the internet?

I'm trying to figure out how secure a host firewall is, hence the question in the title. I read that many firewalls allow outbound connections to port 80 to allow browsing, would that be enough for ...
ninjarubberband's user avatar
1 vote
1 answer
53 views

Is it reasonable to have a product that requires LLMNR or mDNS?

I am trying to figure out the best way to manage security certificates for embedded devices who's webpage is accessed via IP address, and then the scenario for when that IP address changes. Currently, ...
StrangerDanger's user avatar
1 vote
2 answers
516 views

How easy is it for hackers to intercept http traffic between VPN exitnode and the destination web service without being inside the VPN or web server?

Let’s say I’m using http connection over a properly set up VPN with secure protocol and implementation. Then, most likely, the connection will be secure all the way until it exits the VPN server. But ...
Insnyt's user avatar
  • 11
1 vote
0 answers
129 views

Why is it a security concern to modify http.sys registry entries to allow web service to accept a longer query string?

I have an Http web service running on IIS. The Http service will be exposed to the public internet, but only authenticated client requests will be processed by the web service. The service allows ...
hpatel's user avatar
  • 11
1 vote
0 answers
112 views

When passing through SSL from web server A to web server B (via nginx), does web server A need SSL configured as well, or just web server B?

I'm using nginx here as an example, but this is really more of a conceptual question about SSL termination and TCP that could apply to any web server. Basically, if web server A receives TCP traffic ...
Paul Z's user avatar
  • 111
1 vote
0 answers
285 views

CSRF and XSS Protection with a Static Site and REST API

I'm building an application which will support both browser and application access to REST resources. Applications will POST a username/password JSON body to a login endpoint which will return a ...
Naftuli Kay's user avatar
  • 6,753
1 vote
0 answers
86 views

Security implications of an HTTP POST endpoint that accepts arbitrary HTML and returns it back

For generating PDFs in our web application we have a simple service that accepts a chunk of HTML from the client, wraps it in a standard template, does a couple of simple transforms (like replacing ...
SystemParadox's user avatar
1 vote
0 answers
98 views

How following URL's will get open-redirection?

Reading about open-redirection from web application hackers handbook came across a test case in which the server-side is validating user supplied data that the application uses to set target for ...
Mohit's user avatar
  • 11
1 vote
0 answers
124 views

Intercept HTTP requests for invalid domains in Linux

I am using Ubuntu 18.04. When making a HTTP request to invalid domains, I get a HTML page with javascript code that redirects me to uniregistry a landing page. More specifically, when trying to load ...
nwarp's user avatar
  • 207
1 vote
1 answer
462 views

HTTP Headers: Document Policy vs. Permissions-Policy/Feature-Policy

I'm checking the options to harden my web app by setting the appropriate HTTP headers. Besides the Content Security Policy (CSP) there are two another approaches: Document Policy and Permissions-...
Mike's user avatar
  • 113
1 vote
1 answer
605 views

Intensive 586 (ms-shuttle) port scan/exploit/hacking attempts

Recently i wanted to play a bit with TCP/UDP networking (and touch some custom HTTP server impl) on C# and found out that i'm getting requests from totally unknown dudes, such as this one: FROM: [::...
Busy Shader's user avatar
1 vote
2 answers
881 views

How to understand a single packet embedded with multiple requests?

When I read Multi VERB Single Request: This Attack is also a variation of the Excessive Verb Attack strategy. The attacking BOT creates multiple HTTP requests, not by issuing them one after another ...
qg_java_17137's user avatar
1 vote
1 answer
3k views

How to Spoof JA3 Signature?

I am using python requests library to make HTTP calls. However website bot detection is using JA3 fingerprint verification and blocking me. Is there any way I can spoof the JA3 signature.
Ditti's user avatar
  • 11
1 vote
0 answers
114 views

Can server-side caching misconfiguration lead to stolen logins?

If a webapp sends Cache-Control: private it shouldn't be cached for example with nginx proxy_cache. What could happen if it was cached anyhow? Could another visitor see the personalized login of ...
adrelanos's user avatar
  • 744
1 vote
0 answers
135 views

Why are browsers making PUT requests for static assets on my site?

Our site hosts static assets at /assets/…. In debugging a font-related issue, I looked through our logs for unusual activity. I found a bunch of requests like these method path ...
James A. Rosen's user avatar
1 vote
0 answers
233 views

Am i being MITMed?

Lately i was experiencing weird behavour from some big websites. More specifically, when i normally tried to connect to facebook, i would be greeted with this login page: I have placed these with ...
user1584421's user avatar
1 vote
1 answer
209 views

Security Considerations To Account for When Redirecting From Microservice to Another

I am evaluating the above service design where I want to have mechanism to pass a user through multiple microservices. In this simple example, the user goes through a sign-up process and once done, ...
Mojo's user avatar
  • 121
1 vote
0 answers
2k views

Http Content-Length too long - Time Out

I was recently going through the HTTP Desync attack presented here: https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn This raised one question concerning the way the HTTP ...
KB303's user avatar
  • 433
1 vote
0 answers
162 views

Cross site security for public REST API

This seems a common use case, but I have not been able to find a satisfactory answer. We have a public REST API, which we want 3rd parties to be able to write their own Progressive Web Applications ...
Keean Schupke's user avatar
1 vote
0 answers
105 views

Security risks on returning encrypted JSON web token without prior authentication

I am architecting a passwordless REST API where public/private keys are the primary form of authentication. In order to create a new session you must prove that you hold the private key to the public ...
Carl's user avatar
  • 111
1 vote
0 answers
117 views

How is Indonesia blocking images in e2ee applications?

Indonesia's minister in communication and informatics supposedly blocked the sending of images and videos through social media from 22nd May until 25th May, in order to prevent hoaxes from spreading ...
Zafir's user avatar
  • 11
1 vote
0 answers
199 views

HTTP body E2E encryption protocol

I have 2 servers that communicate each other in HTTP and they are both behind an API gateway. Between the servers and their API gateways the communication is in HTTPS with mutual authentication using ...
Fabio's user avatar
  • 121
1 vote
0 answers
96 views

Origin VS Authority and Domain certificates and Unique IPs

Disclaimer, I am new to InformationSecurity, so sorry if I not following rules as good as expected. I asked this post on stackOverflow, and I was suggested to transfer it here So far I get: Origin = ...
pGrnd2's user avatar
  • 11
1 vote
0 answers
495 views

How to bypass NTLM HTTP authentication?

Is there any way to bypass HTTP authentication rather than brute-forcing ?
Benassin's user avatar
1 vote
2 answers
233 views

Bloom filter to prevent replay attacks in signed HTTP requests

I'm thinking about an authentication sheme of a REST API in a setting where the only thing the server stores about a client, is their public key (the asymmetric encryption scheme should not matter). ...
Rafael Korbas's user avatar
1 vote
0 answers
772 views

Hide data from wireshark on localhost

Assuming you're working with an old network protocol, or insecure/unencrypted protocol (HTTP for example), is there a way to make it difficult for network sniffers from capturing the packets? An MITM ...
TeAmEr's user avatar
  • 111
1 vote
0 answers
142 views

Security of AWS Lambda Communicating to Non-HTTPS API

Wondering what attacks might look like in the following scenario. I have a web service that pings an AWS lambda (behind API gateway), which makes a couple of transactions (sends email, adds to ...
ig0lden's user avatar
  • 79
1 vote
0 answers
107 views

Why doesn't a CORS preflight request cause another?

According to MDN documentation, every non-simple request is doomed to fall into an infinite recursion: I want to send a non-simple CORS request (with the verb PUT e.g.) My browser tries to send a ...
Attacktive's user avatar
1 vote
0 answers
7k views

Prevention of host header injection in ASP.NET?

How can we mitigate host header injection in ASP.NET? I have already configured application binding in IIS and set static hostname but still, the vulnerability exists.
codeur's user avatar
  • 591
1 vote
0 answers
605 views

THC Hydra false positives on Foscam login

I bought a Foscam C1 Lite this week and I want to try to brute force the login page with THC hydra. But currently I am getting false positives with the following command: hydra -s 88 -l user -P ...
ZerOne's user avatar
  • 111