Skip to main content

Questions tagged [http]

Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.

Filter by
Sorted by
Tagged with
1 vote
2 answers
66 views

CSRF Prevention Using Signed Cookies And Custom Headers

Recently I was reading about CSRF prevention techniques like Synchronizer Token, Cookie-to-header, and Double Submit Cookie. Cookie-to-header is good for websites using a lot of JavaScript, e.g. SPAs, ...
1 vote
1 answer
80 views

Execution profile for web server

I would like to know if there is a way to run an app to exhaustion in terms of all possible outcomes that it can provide. What do I mean by that: Let's assume that someone has an (Apache) HTTP Server. ...
0 votes
1 answer
88 views

Can token decryption endpoint response codes variability lead to security vulnerabilities?

To clarify the question, here's our case: We generate encrypted tokens by applying AES-CBC (256 bit) and Base64 to payload: encrypted_token = Base64.encode(AES_CBC_256.encrypt(key, iv, payload)). ...
0 votes
1 answer
483 views

How can I found a source of HTTP request in Wireshark? [closed]

There are weird requests to/from AWS: and another one to/from 177.143.198.104.bc.googleusercontent.com: ( http://whois.domaintools.com/177.143.198.104 ) I use Ubuntu 18.04 Desktop, web browsers are ...
1 vote
1 answer
703 views

Intensive 586 (ms-shuttle) port scan/exploit/hacking attempts

Recently i wanted to play a bit with TCP/UDP networking (and touch some custom HTTP server impl) on C# and found out that i'm getting requests from totally unknown dudes, such as this one: FROM: [::...
1 vote
1 answer
40 views

What are the risk of using http when capturing open events on an email

I want to configure a custom domain for open and click tracking in Amazon Simple Email Service (SES). However, I've encountered a limitation where Amazon SES only allows HTTPS domains for tracking ...
0 votes
1 answer
382 views

CSP Violation ms-appx-web://

We have a java application which allows users to upload attachments and save it on the server. The application has a content security policy defined like this: base-uri 'self'; child-src 'self'; form-...
1 vote
2 answers
1k views

How to understand a single packet embedded with multiple requests?

When I read Multi VERB Single Request: This Attack is also a variation of the Excessive Verb Attack strategy. The attacking BOT creates multiple HTTP requests, not by issuing them one after another ...
1 vote
1 answer
63 views

Command Injection in URLs. Are response codes foolproof indicator of true/false positive?

Take this HTTP request as an example. GET /directory/blahblah/ping%20interact.sh Say this request receives any 3xx, 4xx, 5xx HTTP response code. Is it likely or even possible that a backend web server ...
1 vote
1 answer
48 views

Does the CORS asteriks / wildcard include both encrypted and unencrypted origins?

Does the CORS asteriks / wildcard (*) include both encrypted (https) and unencrypted origins (http)? And is the null origin (i.e., when a local file is doing a xmlhttprequest, or within an iframe ...
37 votes
4 answers
34k views

Is it possible to pass TCP handshake with spoofed IP address?

Little time ago, me and my friends argued if TCP handshake can be passed with a spoofed IP address. Assume I have a web server that allows only certain IP addresses. Can anyone connect that web ...
428 votes
5 answers
564k views

Why is 'Bearer' required before the token in 'Authorization' header in a HTTP request?

What exactly is the difference between following two headers: Authorization : Bearer cn389ncoiwuencr vs Authorization : cn389ncoiwuencr All the sources which I have gone through, sets ...
2 votes
1 answer
2k views

Bettercap 2.x SSLStrip Is Not Converting Links

I have the latest version of bettercap. I have the latest version of Kali Linux using the latest version of VirtualBox on the latest version of Windows 10. My target machine is the latest version of ...
3 votes
1 answer
603 views

How to exploit HTTP Request Smuggling?

I set up the following lab using HAProxy and Gunicorn. Both "Smuggler.py" tool and "HTTP Request Smuggler" BurpSuite extension detected CL.TE vulnerability. I checked it manually ...
8 votes
4 answers
15k views

Why do browsers disallow accessing files from local file system even if the HTML document is also on the local file system?

Many browsers do not allow you to access files on the local filesystem with JavaScript (even if the HTML document is also on the local filesystem). (source) Yes I know that the solution is to "...
0 votes
0 answers
68 views

Bettercap not detecting HTTPS websites (?)

The built-in sslstripping feature (http.proxy.sslstrip) in bettercap is not working against HTTPS websites in this issue I will be using cygwin.com and winzip.com as an example, as we can see they are ...
1 vote
1 answer
565 views

HTTP Headers: Document Policy vs. Permissions-Policy/Feature-Policy

I'm checking the options to harden my web app by setting the appropriate HTTP headers. Besides the Content Security Policy (CSP) there are two another approaches: Document Policy and Permissions-...
0 votes
0 answers
62 views

Overcoming Middleware: Exploiting XSS to Retrieve Data

I am attempting to perform an XSS attack on my server and have successfully bypassed the CSP. In my server code, I store all users in the following manner: .get("/users", adminReq, (req, ...
1 vote
2 answers
298 views

Bloom filter to prevent replay attacks in signed HTTP requests

I'm thinking about an authentication sheme of a REST API in a setting where the only thing the server stores about a client, is their public key (the asymmetric encryption scheme should not matter). ...
0 votes
0 answers
33 views

Is it possible to see HTTPS traffic without intercepting? (With a copy of the traffic) [duplicate]

I have a WAF solution that can work both inline and out-of-band. And we want to try the OOB option first. And possibly want to see HTTPS traffic as well. But the vendor says if we want to see the ...
1 vote
1 answer
258 views

Security Considerations To Account for When Redirecting From Microservice to Another

I am evaluating the above service design where I want to have mechanism to pass a user through multiple microservices. In this simple example, the user goes through a sign-up process and once done, ...
0 votes
1 answer
238 views

Burpsuite proxy does not get HTTP error 429 but vanilla python requests do?

When I make a normal python request to some site without any proxies I am getting a 429 response, too many requests. However when I open up burpsuite proxy and add proxies = { "http": &...
1 vote
1 answer
4k views

How to Spoof JA3 Signature?

I am using python requests library to make HTTP calls. However website bot detection is using JA3 fingerprint verification and blocking me. Is there any way I can spoof the JA3 signature.
0 votes
2 answers
66 views

Is There a way to exploiting / Make exploit scenario for Header based reflected XSS?

I've found a reflected XSS, but the problem is that the attack vector is the header (any header). Is there a way to develop an exploit scenario based on this?
2 votes
1 answer
2k views

Snort Inline Mode(IPS) Routing Packet Forwarding

I'd like to build an IPS which would be a seperate endpoint than the router and/or protected servers. To achieve this I've installed to my Ubuntu server Snort with DAQ(AFPACKET). The instructions I've ...
6 votes
1 answer
3k views

Is HTTP header Permissions-Policy worth using if no features are used?

From the spec at https://www.w3.org/TR/permissions-policy-1/ it seems there is no way to whitelist features with a default blacklist, and each feature must be individually disabled in every single ...
3 votes
3 answers
5k views

How does Facebook really identify requests?

Today I have discovered something very strange. It seems like Facebook is playing some kind of unfair game for identifying one's online identity. So, here is what I have done: I have a regular ...
1 vote
1 answer
2k views

Website doesn't provide cookie (csrf token) when connecting over proxy. Why/how?

The Python code below should grab a CSRF token cookie from Instagram.com, but I get an error message when running the program through any sort of HTTPS or SOCKS5 proxy, informing me that the CSRF ...
3 votes
2 answers
509 views

If a computer gets infected with malware, can the host firewall block the malware from communicating back to its controller on the internet?

I'm trying to figure out how secure a host firewall is, hence the question in the title. I read that many firewalls allow outbound connections to port 80 to allow browsing, would that be enough for ...
5 votes
2 answers
627 views

How to exploit XSS and SQL injection via HTTP verb tampering?

I was reading a paper about 'HTTP verb tampering' here: https://blog.jeremiahgrossman.com/2008/06/what-you-need-to-know-about-http-verb.html The author said: HTTP verb tampering is generally used in ...
3 votes
3 answers
7k views

Is there a way around HTTPS being redirected to HTTP?

I have come across something of a curious situation that a website (Palestinian News Network) has a valid TLS certificate (see here) but that the website always forces loading of the site via http://. ...
1 vote
2 answers
65 views

Preventing Data Tampering in HTTPS Requests: Safeguarding User-Initiated Donations

Could a Man-in-the-Middle (MITM) attack compromise the integrity of user-initiated transactions over HTTPS? Specifically, if a user selects an amount to donate on a website, is it possible for a ...
10 votes
2 answers
407 views

How to force "expensive calculation" when clients connect to my server?

Page 183 of Secrets & Lies on countering denial-of-service attacks: Some researchers have proposed defenses that force the client to perform an expensive calculation to make a connection. The ...
0 votes
1 answer
1k views

suricata http rule to identify POST requests

I can’t figure it out / understand. Need to write a rule that catches an HTTP POST request from one ip address more than three times in 10 seconds and logs it. alert http $EXTERNAL_NET any -> $...
0 votes
3 answers
433 views

Using HTTP header to transmit client certificate for mTLS

My client says their API traffic must take the path WAF -> Custom Firewall -> Backend API. Also, mTLS must be terminated after the traffic has gone through the network appliance. I have created ...
1 vote
1 answer
133 views

Is it reasonable to have a product that requires LLMNR or mDNS?

I am trying to figure out the best way to manage security certificates for embedded devices who's webpage is accessed via IP address, and then the scenario for when that IP address changes. Currently, ...
1 vote
2 answers
799 views

How easy is it for hackers to intercept http traffic between VPN exitnode and the destination web service without being inside the VPN or web server?

Let’s say I’m using http connection over a properly set up VPN with secure protocol and implementation. Then, most likely, the connection will be secure all the way until it exits the VPN server. But ...
70 votes
8 answers
18k views

Why use HTTPS Everywhere when we have HSTS supported browsers?

I know that the browser's default protocol to access any site is http:// when https:// is explicitly not mentioned, but even then if we browse to a website say www.facebook.com, the response header ...
8 votes
2 answers
2k views

Security Headers: Access-Control-Allow-Origin vs. Cross-Origin-Resource-Policy (CORP)

Can someone explain the difference between the Access-Control-Allow-Origin header and the Cross-Origin-Resource-Policy header? According to MDN: The Access-Control-Allow-Origin response header ...
0 votes
1 answer
156 views

CRLF in HTTP/2 header value

I am attempting to inject a carriage-return + newline in a HTTP request header value. My understanding is that this is possible with HTTP/2 and HTTP/3. However, when I send a request with Burp I get ...
0 votes
0 answers
82 views

Is it possible to track cross origin redirection?

I can successfully iframe a page on origin B from origin A (no x-frame-deny, content security policy, etc). A page on origin B (page X) redirects to a page on origin C (page Y) with a server side ...
0 votes
0 answers
104 views

Cache poisoning from rfc6455 (WebSockets) not requiring server message to be masked?

In RFC6455 section 10.3, it explains why they have made clients mask their outgoing frames (so that a malicious server cannot manipulate a client into sending something in plaintext, as the message ...
4 votes
0 answers
185 views

Why are HMAC signatures frequently used for webhook authorization but not other HTTP API requests?

HMAC signatures are very commonly used for webhook authorization from service to consumer. Examples: Stripe Slack Twilio Twitter GitHub and hundreds and hundreds more. This seems a near universal ...
1 vote
1 answer
278 views

How do you verify if a request is from a genuine user or from a malicious user?

Consider clientA which wants to verify payments and serverB which verifies payments. ClientA sends around a million requests to serverB's API in 1 day. However, only 1% of the requests from clientA ...
1 vote
3 answers
2k views

What exactly are Hidden HTTP Parameters?

I read a lot of reports where 'hackers' potentially exploited a 'Hidden HTTP Parameter'. There are also tons of tools which are developed for this exact purpose. Example : https://blog.yeswehack.com/...
0 votes
4 answers
461 views

Is HTTP/0.9 considered "End-of-Life" (EOL) due to security vulnerabilities or risks?

I'm exploring the history and evolution of the HTTP protocol and I know that HTTP/0.9 is generally not used anymore. It's clear how features evolved in newer HTTP versions and how primitive HTTP/0.9 ...
0 votes
0 answers
271 views

How to properly use cURL --data-binary to send a request payload

This question is out of pure curiosity. I know I can send multipart formposts using curl's --form/-F option. However, I was curious to see if the same can be done with the --data-binary option? For ...
4 votes
2 answers
1k views

HTTPonly token without CSRF is safe?

How can a hacker steal my session where my form does not have CSRF tokens but my session cookies are HTTPonly? how would he get my session cookie in this case? is this possible? for example, to be ...
0 votes
1 answer
166 views

A URL is followed by number, what is its vulnerability?

A URL is followed by a number. Changing the number will change the content of the web page. Now I know it's insecure direct object reference (IDOR). What should I do to fix this vulnerability?
0 votes
1 answer
314 views

How to reliably identify referrer on client browser?

Is there any way to reliably identify the referring site on modern browsers (not considering manual HTTP requests outside of a browser e.g. cURL, etc.)? Referrer header will not work because the ...

1
2 3 4 5
30