Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP ...

learn more… | top users | synonyms

3
votes
1answer
48 views

What are the security benefits to block all http referer header requests for web browser?

I would like to know also if you lose site functionality. Is this a security benefit that is beneficial than compromising functionality (if compromising at all)? What I mean by this is one a ...
3
votes
1answer
211 views

Are HTML Components (HTC) files a potential attack vector?

I'm working on a site that has a higher-than-normal concern for user security. I've recently been working on some CSS issues with older versions of IE (we support 7 and higher) and found that an easy ...
2
votes
1answer
128 views

IP over HTTP GET only

Consider the following scenario: There is a client behind a really strict firewall. There is nearly nothing available to 'connect to the internet'. Just DNS resolution and HTTP/HTTPS (some whitelisted ...
1
vote
1answer
43 views

How should I tunnel arbitrary protocol traffic over HTTPS?

I'm posting this question from a moving train! (Ok, maybe that's not so impressive.) This train has an annoying WiFi - it's low-throughput, high-latency, tends to lose packets, and blocks most kinds ...
1
vote
1answer
23 views

Generating shared secret key using existing receivers public key and senders private key

I have the public key of the receiver, and the private key of the sender. I want to generate a new key by using the receivers public key and senders private key (also known as the signing key) to ...
1
vote
1answer
99 views

How to filter secure (HTTPS) websites by URL with regular expression?

I need to block access to certain pages on a website using regular expression and/or wildcard. The site uses https and therefore cannot be blocked using regular parental control filters (this is ...
0
votes
1answer
35 views

Can 3rd party JavaScript libraries access the http headers of the hosting html page

So, I have website, it uses a cookie stored in the http header of the downloaded html document to maintain the session while the end user is logged on and accessing there 'secure' data. This webpage ...
-2
votes
1answer
147 views

is encrypted body http secure

I'm working on an embedded project that needs to communicate with a server. Both the server and the device have an AES key pre-installed. I have a network device that provides http services but not ...
2
votes
0answers
41 views

WiFi Fingerprinting RFC2617 Linux Device Cannot Unauthenticate Unless AP Password Changes

There is a Cisco WiFi Access Point in the office that is intended for guests. It is an open network in that you can associate without providing a password with the SSID. It supports RFC2617 and so the ...
2
votes
0answers
49 views

Cross Origin Resource Sharing question

I have some mockup html/javascript on my desktop, I made an ajax GET call to: http://www.bungie.net/platform/Destiny/TigerPSN/Account/4611686018429149347/Character/2305843009215132906/Activities/ ...
2
votes
0answers
4k views

Linux Hydra issue - random correct password success

I have an issue with Hydra when I use it. I have tried the same command lines given in guides directly supported by the Damn Vulnerable Web Application (DVWA) v1.8. Ok so.. here is my attempt ...
1
vote
0answers
51 views

HTTP Response Splitting in practice

Have you ever seen HTTP Response Splitting in laboratory environment? There are many examples for HTTP Response Splitting vulnerability. I used old PHP and managed to get 2 responses from server ...
1
vote
0answers
59 views

Metasploit reverse_http(s) PAYLOAD for linux target

During exploitation via metasploit's browzer_autopwn, I need to set a payload using http or https channel on a linux target. But there is no reverse_http(s) available in linux payload category. What ...
1
vote
0answers
49 views

What are the security implications of enabling a SNI-hole on a web server?

A web server (let's say Apache 2.4) implements SNI. It is configured with a 4096 bit SHA384-signed Wildcard Certificate (*.land.org) with a Subject Alternative Name (land.org). The Certificate ...
1
vote
0answers
67 views

Does HTTPS protocol leak HTTP body length?

It seems that in a MITM attack, hackers may know the whole HTTPS packet size sent through the network (i.e. size of HTTP headers + HTTP body + overhead). Besides that, does the HTTPS protocol also ...
1
vote
0answers
90 views

Has HTTP bogus request type “COOK” been used in any known website attacks?

An apache web server access weblog shows a request type "COOK" where POST or GET are normally found. Is such a request part of any known web-based site attacks?
1
vote
0answers
93 views

HMAC authenticated API calls with multipart/form-data file uploads

We have an existing API where 3rd parties can push data. The API calls are authenticated with HMAC using the same scheme as described in Ruby's ApiAuth library which I use to verify signed requests. ...
1
vote
0answers
106 views

OCSP stapling implementation in JAVA/ Android

I am trying to implement OCSP stapling in JAVA. How can this be implemented ? How can we set OCSPStatusRequest extension for TLS. and how we can verify the response ? Hi, How can we implement OCSP ...
1
vote
0answers
68 views

Can user identifying information in Dropbox be derived from subscription data?

I've noticed that my Dropbox installation really loves sending unencrypted information over the net including a "user_id" and it's user-agent. What i want to know is if it's possible at all to ...
1
vote
0answers
143 views

Will http only cookie work while using chrome bandwidth saving feature in Android?

I am developing a site which uses http only cookies for authentication. By design[w3 standard] these cookies are XMLHttpObjects and will only be submitted to the domain they originated from to prevent ...
1
vote
0answers
204 views

Is my approach to anonymous certificate based HTTP(s) authentication and secure private messaging sound?

I'm trying to work out a somewhat anonymous secure messaging system, and was hoping someone could validate my overall approach. Keep in mind, this all takes place over HTTPS. Authentication While ...
0
votes
0answers
80 views

What to use to encode JSON Web Token?

I'm using JWT to create access tokens for a Sinatra API. My question is, what should I use to sign the token? Right now I'm trying to use the user's password hash, but bcrypt-ruby changes the ...