Questions tagged [http]
Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.
113
questions with no upvoted or accepted answers
6
votes
1
answer
2k
views
Is HTTP header Permissions-Policy worth using if no features are used?
From the spec at https://www.w3.org/TR/permissions-policy-1/ it seems there is no way to whitelist features with a default blacklist, and each feature must be individually disabled in every single ...
- 251
4
votes
0
answers
164
views
Why are HMAC signatures frequently used for webhook authorization but not other HTTP API requests?
HMAC signatures are very commonly used for webhook authorization from service to consumer.
Examples:
Stripe
Slack
Twilio
Twitter
GitHub
and hundreds and hundreds more. This seems a near universal ...
- 1,010
4
votes
0
answers
744
views
Is an out-of-band request via DNS by abusing the X-Forwarded-For header exploitable
By changing the X-Forwarded-For header in a request, I am able to have it sent an OOB interaction with Burp Collaborator requesting a DNS lookup of type A.
Is there any risk to this vulnerability or ...
4
votes
0
answers
155
views
WiFi Fingerprinting RFC2617 Linux Device Cannot Unauthenticate Unless AP Password Changes
There is a Cisco WiFi Access Point in the office that is intended for guests. It is an open network in that you can associate without providing a password with the SSID. It supports RFC2617 and so the ...
- 141
4
votes
0
answers
143
views
Cross Origin Resource Sharing question
I have some mockup html/javascript on my desktop, I made an ajax GET call to:
http://www.bungie.net/platform/Destiny/TigerPSN/Account/4611686018429149347/Character/2305843009215132906/Activities/
...
3
votes
1
answer
569
views
How to exploit HTTP Request Smuggling?
I set up the following lab using HAProxy and Gunicorn.
Both "Smuggler.py" tool and "HTTP Request Smuggler" BurpSuite extension detected CL.TE vulnerability.
I checked it manually ...
- 31
3
votes
0
answers
540
views
OAuth for command line application
I'm planning to add an "official" command line tool for developers to interact with our API. The tool is basically just a glorified curl client, interacting with the API via HTTPS ...
- 1,495
3
votes
0
answers
4k
views
how to fix Out-of-band resource load (HTTP) issue identified by BURP scan
I have Salesforce application which is using my web application hosted in one of our customer's server (IIS 8.0).
BURP Scan has identified one issue in my web application. Issue is something like ...
- 31
2
votes
0
answers
77
views
How to retrieve TLS unique value from Apache?
TLS unique value is present in TLS 1.2 version.
In Golang, I can get the value of the TLS unique value from the http response through the field TLS.
I'd like know how I can get it from Apache.
Is ...
- 21
2
votes
0
answers
618
views
What are NGINX reverseproxy users doing to prevent HTTP Request smuggling?
Since NGINX does not support sending HTTP/2 requests upstream, what are the present NGINX reverseproxy users doing to mitigate HTTP Request Smuggling vulnerability?
I understand that the best way to ...
- 21
2
votes
0
answers
135
views
http smuglling how can i do a poc in a big websites?
i try to find http smuggling in big bug bouny program
if i send this to the server
POST /path HTTP/1.1
Host: subdomain.domain.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 ...
- 73
2
votes
0
answers
137
views
Is the HTTPS lock sign displayed if reasources are loaded from insecure sites?
We all know that if you visit a secure site which uses https, all modern browsers will show a padlock sign if it has a CA certified certificate. My questions are:
Suppose there is an image loaded in ...
- 155
2
votes
1
answer
2k
views
Snort Inline Mode(IPS) Routing Packet Forwarding
I'd like to build an IPS which would be a seperate endpoint than the router and/or protected servers. To achieve this I've installed to my Ubuntu server Snort with DAQ(AFPACKET). The instructions I've ...
- 121
2
votes
0
answers
907
views
HTML Injection to blind SSRF testing retrieves only DNS Query
I recently came across an application that was vulnerable to HTML injection on the invite function. When I insert <img src="image.jpg"> the image got rendered on the mail I received.
I ...
- 45
2
votes
0
answers
1k
views
Unable to start reverse shell over HTTP
I am able to get a reverse shell working locally over TCP, but failing to trigger it remotely over HTTP.
Locally over TCP:
Attacker terminal runs netcat to listen for a connection over port 8000: nc -...
- 21
2
votes
0
answers
243
views
Bruteforce https post using single tcp connection
So I've tried bruteforcing my server using thc-hydra's https-post-form, but it floods the server very quickly and the requests start timing out.
However, If I go through the browser where the HTTP ...
- 21
2
votes
1
answer
2k
views
Bettercap 2.x SSLStrip Is Not Converting Links
I have the latest version of bettercap. I have the latest version of Kali Linux using the latest version of VirtualBox on the latest version of Windows 10. My target machine is the latest version of ...
- 163
2
votes
0
answers
823
views
Random Alphabetical String Added to URL
I originally asked this question over at Stack Overflow, but someone there suggested asking here because it might be possible that something malicious may be causing the following issue:
Users have ...
- 63
2
votes
0
answers
8k
views
Prevention of host header injection in ASP.NET?
How can we mitigate host header injection in ASP.NET? I have already configured application binding in IIS and set static hostname but still, the vulnerability exists.
- 601
2
votes
0
answers
89
views
Concerns when passing all OPTIONS requests through authorization proxy gateway
I have a React based application which uses RESTful services on backend distributed on private network. To communicate with such services using AJAX, client application sends all its request through ...
- 121
2
votes
0
answers
290
views
Assymetric auth like AWS4-HMAC-SHA256
I wondered if there exists a defined mechanism similar to AWS4-HMAC-SHA256 (as a scheme in Authorization HTTP header), but using asymmetric algorithm, probably ed25519, and how secure it would be to ...
- 130
2
votes
0
answers
832
views
HMAC authenticated API calls with multipart/form-data file uploads
We have an existing API where 3rd parties can push data. The API calls are authenticated with HMAC using the same scheme as described in Ruby's ApiAuth library which I use to verify signed requests. ...
- 121
1
vote
1
answer
114
views
Is it reasonable to have a product that requires LLMNR or mDNS?
I am trying to figure out the best way to manage security certificates for embedded devices who's webpage is accessed via IP address, and then the scenario for when that IP address changes.
Currently, ...
1
vote
0
answers
2k
views
Best port to setup Outline VPN for obfuscation
Many outline access keys use a random port but some do 443, I’ve found out since port 443 is for http its harder to find out that port is using a vpn.
So the question is, why don’t other Outline ...
- 21
1
vote
2
answers
733
views
How easy is it for hackers to intercept http traffic between VPN exitnode and the destination web service without being inside the VPN or web server?
Let’s say I’m using http connection over a properly set up VPN with secure protocol and implementation. Then, most likely, the connection will be secure all the way until it exits the VPN server.
But ...
- 11
1
vote
0
answers
190
views
Why is it a security concern to modify http.sys registry entries to allow web service to accept a longer query string?
I have an Http web service running on IIS. The Http service will be exposed to the public internet, but only authenticated client requests will be processed by the web service. The service allows ...
- 11
1
vote
0
answers
149
views
When passing through SSL from web server A to web server B (via nginx), does web server A need SSL configured as well, or just web server B?
I'm using nginx here as an example, but this is really more of a conceptual question about SSL termination and TCP that could apply to any web server.
Basically, if web server A receives TCP traffic ...
- 111
1
vote
0
answers
333
views
CSRF and XSS Protection with a Static Site and REST API
I'm building an application which will support both browser and application access to REST resources.
Applications will POST a username/password JSON body to a login endpoint which will return a ...
- 6,763
1
vote
0
answers
109
views
Security implications of an HTTP POST endpoint that accepts arbitrary HTML and returns it back
For generating PDFs in our web application we have a simple service that accepts a chunk of HTML from the client, wraps it in a standard template, does a couple of simple transforms (like replacing ...
- 111
1
vote
0
answers
119
views
How following URL's will get open-redirection?
Reading about open-redirection from web application hackers handbook came across a test case in which the server-side is validating user supplied data that the application uses to set target for ...
- 11
1
vote
0
answers
537
views
Should I strip the "Origin" header from client requests?
I'm trying to setup an nginx reverse proxy to a web product I can't modify (it's an appliance).
Client --> https://myapp.com --> nginx --> https://10.1.5.9
I managed to do so, but it ...
- 11
1
vote
0
answers
147
views
Intercept HTTP requests for invalid domains in Linux
I am using Ubuntu 18.04. When making a HTTP request to invalid domains, I get a HTML page with javascript code that redirects me to uniregistry a landing page.
More specifically, when trying to load ...
- 207
1
vote
1
answer
540
views
HTTP Headers: Document Policy vs. Permissions-Policy/Feature-Policy
I'm checking the options to harden my web app by setting the appropriate HTTP headers.
Besides the Content Security Policy (CSP) there are two another approaches: Document Policy and Permissions-...
- 113
1
vote
1
answer
679
views
Intensive 586 (ms-shuttle) port scan/exploit/hacking attempts
Recently i wanted to play a bit with TCP/UDP networking (and touch some custom HTTP server impl) on C# and found out that i'm getting requests from totally unknown dudes, such as this one:
FROM: [::...
- 11
1
vote
2
answers
979
views
How to understand a single packet embedded with multiple requests?
When I read Multi VERB Single Request:
This Attack is also a variation of the Excessive Verb Attack
strategy. The attacking BOT creates multiple HTTP requests, not by issuing them one after
another ...
- 111
1
vote
1
answer
3k
views
How to Spoof JA3 Signature?
I am using python requests library to make HTTP calls. However website bot detection is using JA3 fingerprint verification and blocking me.
Is there any way I can spoof the JA3 signature.
- 11
1
vote
0
answers
131
views
Can server-side caching misconfiguration lead to stolen logins?
If a webapp sends Cache-Control: private it shouldn't be cached for example with nginx proxy_cache. What could happen if it was cached anyhow? Could another visitor see the personalized login of ...
- 764
1
vote
0
answers
154
views
Why are browsers making PUT requests for static assets on my site?
Our site hosts static assets at /assets/…. In debugging a font-related issue, I looked through our logs for unusual activity. I found a bunch of requests like these
method path ...
- 111
1
vote
0
answers
133
views
Is there a way to limit cookies to certain hosts in HTTP?
Using Nginx, I hope to restrict the permissible hosts for cookies. My initial intention was to employ a Content Security Policy for this purpose, but I don't see an obvious way to do this via a CSP. ...
- 200
1
vote
0
answers
259
views
Am i being MITMed?
Lately i was experiencing weird behavour from some big websites.
More specifically, when i normally tried to connect to facebook, i would be greeted with this login page:
I have placed these with ...
- 367
1
vote
1
answer
244
views
Security Considerations To Account for When Redirecting From Microservice to Another
I am evaluating the above service design where I want to have mechanism to pass a user through multiple microservices. In this simple example, the user goes through a sign-up process and once done, ...
- 121
1
vote
0
answers
2k
views
Http Content-Length too long - Time Out
I was recently going through the HTTP Desync attack presented here:
https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn
This raised one question concerning the way the HTTP ...
- 433
1
vote
0
answers
179
views
Cross site security for public REST API
This seems a common use case, but I have not been able to find a satisfactory answer. We have a public REST API, which we want 3rd parties to be able to write their own Progressive Web Applications ...
1
vote
0
answers
121
views
Security risks on returning encrypted JSON web token without prior authentication
I am architecting a passwordless REST API where public/private keys are the primary form of authentication. In order to create a new session you must prove that you hold the private key to the public ...
- 111
1
vote
0
answers
134
views
How is Indonesia blocking images in e2ee applications?
Indonesia's minister in communication and informatics supposedly blocked the sending of images and videos through social media from 22nd May until 25th May, in order to prevent hoaxes from spreading ...
- 11
1
vote
0
answers
222
views
HTTP body E2E encryption protocol
I have 2 servers that communicate each other in HTTP and they are both behind an API gateway.
Between the servers and their API gateways the communication is in HTTPS with mutual authentication using ...
- 121
1
vote
0
answers
115
views
Origin VS Authority and Domain certificates and Unique IPs
Disclaimer, I am new to InformationSecurity, so sorry if I not following rules as good as expected. I asked this post on stackOverflow, and I was suggested to transfer it here
So far I get:
Origin = ...
- 11
1
vote
0
answers
551
views
How to bypass NTLM HTTP authentication?
Is there any way to bypass HTTP authentication rather than brute-forcing ?
- 11
1
vote
2
answers
275
views
Bloom filter to prevent replay attacks in signed HTTP requests
I'm thinking about an authentication sheme of a REST API in a setting where the only thing the server stores about a client, is their public key (the asymmetric encryption scheme should not matter). ...
- 111
1
vote
0
answers
858
views
Hide data from wireshark on localhost
Assuming you're working with an old network protocol, or insecure/unencrypted protocol (HTTP for example), is there a way to make it difficult for network sniffers from capturing the packets?
An MITM ...
- 111