Questions tagged [http]

Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.

Filter by
Sorted by
Tagged with
1
vote
1answer
83 views

How to exploit HTTP Request Smuggling?

I set up the following lab using HAProxy and Gunicorn. Both "Smuggler.py" tool and "HTTP Request Smuggler" BurpSuite extension detected CL.TE vulnerability. I checked it manually ...
0
votes
1answer
68 views

How do you sniff information exchanged with a site which does not use TLS/SSL?

Whenever you visit a website without HTTPS (because for whatever reason there are still quite a few of them even in 2022) typically the browser will announce that you should not enter any sensitive ...
0
votes
0answers
11 views

Is HTTP header Permissions-Policy worth using if no features are used?

From the spec at https://www.w3.org/TR/permissions-policy-1/ it seems there is no way to whitelist features with a default blacklist, and each feature must be individually disabled in every single ...
0
votes
2answers
64 views

Does the HTTP status code 302 guarantee no other content was served as part of the same HTTP response?

Does receiving the HTTP 302 status code from a domain A guarantee in any shape or form that there was no JavaScript ran or any additional content (external or not) loaded from that domain A? The ...
16
votes
5answers
3k views

Obfuscating HTTP Error Codes

I'm working on a REST API endpoint where we only accept requests from certain domain names. Whitelisting. A dev I'm working with recommended that we return HTTP 400 instead of HTTP 403 if the incoming ...
0
votes
1answer
45 views

Can POST request be changed in a HTTPS website?

I am trying to develop a website where I grab data using javascript and send it to PHP using ajax post. However, while researching, I found that the POST request can be modified using third-parties ...
0
votes
0answers
8 views

Homepage shows as not secure until I reload it [migrated]

When I start my browser (e.g. Chrome) and enter something in the address bar (not a URL but a word for example) then it redirects me to the Google search for this word. In these cases there is not the ...
0
votes
0answers
29 views

CSRF and XSS Protection with a Static Site and REST API

I'm building an application which will support both browser and application access to REST resources. Applications will POST a username/password JSON body to a login endpoint which will return a ...
4
votes
1answer
1k views

Can I trust the http Host header in this context

I have a microcontroller, connected to my WLAN, that hosts a tiny web server. I can reach the http server via 2 ways : either via a domain (admin.example.com) which acts as a reverse proxy to the ip ...
0
votes
2answers
77 views

HTTP with encrypted message vs HTTPS

A bit of background: I am a web developer and sometimes i integrate some form of external API in my web applications. It's the second time already that i find something strange: some APIs instead of ...
2
votes
1answer
247 views

HTTP Headers: Document Policy vs. Permissions-Policy/Feature-Policy

I'm checking the options to harden my web app by setting the appropriate HTTP headers. Besides the Content Security Policy (CSP) there are two another approaches: Document Policy and Permissions-...
0
votes
1answer
3k views

What are the ports used by Online Email Accounts such as Yahoo Mail, Gmail, etc.?

Let us say that I send an email using Yahoo Mail or GMail. Can this email be intercepted using a packet sniffer? On which port does the email travel? HTTP, SMTP, POP3?
0
votes
1answer
128 views

Security Considerations To Account for When Redirecting From Microservice to Another

I am evaluating the above service design where I want to have mechanism to pass a user through multiple microservices. In this simple example, the user goes through a sign-up process and once done, ...
0
votes
0answers
38 views

Is my HTTPS connection still encrypted if the SSL certificate has expired? [duplicate]

When I tried to visit a particular website using Mozilla Firefox, I got a SEC_ERROR_EXPIRED_CERTIFICATE error because the website's SSL certificate has expired. If I decide to click on the "...
0
votes
1answer
129 views

What exploit is trying to be leveraged here? (Apache access.log)

I've just deployed a barebones Apache server on Digital Ocean, only hosting static files. No PHP et al. I'm not too bothered to see random exploit attempts, but 99% of the requests are of this similar ...
2
votes
1answer
2k views

Bettercap 2.x SSLStrip Is Not Converting Links

I posted this before. I am creating a new post because of all the changes I would need to [edit] out. I have the latest version of bettercap. I have the latest version of Kali Linux using the latest ...
1
vote
1answer
453 views

Snort Inline Mode(IPS) Routing Packet Forwarding

I'd like to build an IPS which would be a seperate endpoint than the router and/or protected servers. To achieve this I've installed to my Ubuntu server Snort with DAQ(AFPACKET). The instructions I've ...
-2
votes
1answer
12k views

What are the most common HTTP ports? [closed]

What are the most common ports for HTTP services? 80,443,8080 are common for all of us, but what else are used?
9
votes
5answers
4k views

Is information disclosure in a form of a server header a real vulnerability?

I have seen in many places that people say that headers of the following types is a vulnerability: Server:Microsoft-IIS/7.5 X-AspNet-Version:4.0.30319 X-Powered-By:ASP.NET I can see that this gives ...
0
votes
1answer
36 views

What is the difference between Cross Origin Opener Policy and SOP?

"The HTTP Cross-Origin-Opener-Policy (COOP) response header allows you to ensure a top-level document does not share a browsing context group with cross-origin documents." In a situation ...
0
votes
1answer
2k views

Website doesn't provide cookie (csrf token) when connecting over proxy. Why/how?

The Python code below should grab a CSRF token cookie from Instagram.com, but I get an error message when running the program through any sort of HTTPS or SOCKS5 proxy, informing me that the CSRF ...
0
votes
2answers
536 views

Storing Session Id in application logs

Short version: Is it not recommended to store sessionId in log files/database in plaintext (considering it may put active sessions at risk)? If yes, why do I see many queries on how to log sessionId? ...
1
vote
0answers
67 views

What are NGINX reverseproxy users doing to prevent HTTP Request smuggling?

Since NGINX does not support sending HTTP/2 requests upstream, what are the present NGINX reverseproxy users doing to mitigate HTTP Request Smuggling vulnerability? I understand that the best way to ...
0
votes
1answer
200 views

Spoof IP address after a TCP handshake established

Is it possible to spoof the IP once a TCP handshake was performed successfully? For example: Perform the handshake Use the session with the same IP which performed handshake but on different machine ...
0
votes
1answer
87 views

Do websites send full URL over HTTP instead of HTTPS if there's an HTTPS connection?

I was learning to use wireshark when I noticed that opening a reddit url (reddit.com/r/privacy) sent a GET request for r/privacy over HTTP. Is this visible to the ISP or network sniffers? I was under ...
0
votes
1answer
70 views

suricata http rule to identify POST requests

I can’t figure it out / understand. Need to write a rule that catches an HTTP POST request from one ip address more than three times in 10 seconds and logs it. alert http $EXTERNAL_NET any -> $...
3
votes
2answers
101 views

Is it ok to skip validation of TLS validation if the request's host is targeting localhost?

I'm writing a canary for monitoring which will be deployed to the same host as the monitored application. The underlying application validates certificates for incoming requests and validates that the ...
1
vote
1answer
91 views

Modifying UserAgent by a proxy?

For learning and testing purposes I'd like to change the UserAgent in the HTTP header. In the desktop Firefox it is simple: there is an add-on for this task. But on android... it is impossible. I ...
0
votes
1answer
295 views

Signing HTTP requests with JWS

Looking over the spec for JSON Web Signature (JWS), I realise that it doesn't seem to specify anything that is HTTP-specific in terms of the payload. Specifically, signing HTTP headers and bodies (say,...
2
votes
2answers
1k views

NONCE not supported in Asp.Net for CSP implementation

Is NONCE supported in Asp.Net when implementing Content-Security-Policy header to protect from XSS ?? I read that NONCE was not supported in Asp.Net, however I read another simple article, that shows ...
0
votes
0answers
51 views

Security implications of using HTTP for service to service communication within the same host [duplicate]

What are the security implications of using HTTP only for IPC for services within the same host? In my case, I am using docker-compose to host two ASP.NET Core services within the same host in Azure. ...
0
votes
1answer
8k views

Hydra cannot connect to http-post-form

I don't get the correct results and I'm not sure what I'm doing wrong: $ ./hydra -l admin -x 3:9:a http://localhost http-post-form "/admin/login:j_username=^USER^&j_password=^PASS^:failed&...
2
votes
1answer
57 views

Cookies VS localStorage (JavaScript Security)

I know that HTTP requests made by the site get the browser's localStorage for a site, and document.cookie is encrypted for HTTPs websites, but I'm still wondering the risk of storing sensitive ...
0
votes
1answer
153 views

CheckMarx SSRF Vulnerability

I have a REST which takes a parameter dataSource as input and myService has follow logic. @RequestMapping(value ="/save", method = RequestMethod.POST) public List<String> find(@...
28
votes
4answers
9k views

Do websites know which previous website I visited?

Suppose I am using a web browser to look at example.com. Now, from the same web browser tab, I enter example.org in the address bar and go to that completely different website operated by another ...
0
votes
0answers
63 views

Authenticating (getting token) by making Http request

As the topic is a bit vague I have decided to ask you guys here what do you think and what is the best practice in given scenario.   Disclaimer: I am programmer, and although I know a bit about ...
0
votes
0answers
20 views

Hot to validate X.509 Certificate [duplicate]

A client wants to show a stream of his Motobix Webcam on his website. Its easy to show a jpg stream. But the problem is: The stream source is not protected with a valid ssl certificate. On the camera ...
2
votes
1answer
782 views

Is it secure to share a public (RSA) key over http?

The following scenario: We have a HTTP (not HTTPS, so unencrypted) server which contains an open (RSA) public key. The general sharing of the public key should not be a problem since it is the public ...
24
votes
2answers
42k views

Specific risks of embedding an HTTPS iframe in an HTTP page

I need help listing the specific risks of embedding an HTTPS iframe that enables credit card checkout inside of an HTTP page. Are there security issues with embedding an HTTPS iframe on an HTTP page? ...
0
votes
0answers
49 views

Unknown vulnerability name Referer header and Access-Control-Allow-Origin

When reviewing an application, I saw the "Access-Control-Allow-Origin" header as a response. When I modified the "Origin" header in the request, I got a 404, which was fine. So no ...
0
votes
2answers
75 views

What can be deduced with a GET /.ht 403 forbidden and a GET /hx 404 not found?

In testing a website on a bug bounty platform. What can reasonably be deduced from the following situation? GET /.ht -> returns a 403 Forbidden GET /.hx -> returns a 404 Not Found The only ...
0
votes
2answers
145 views

Is it bad practice or major security risk to cache decoded auth tokens in my backend?

I've set up a firebase passport strategy on a NestJS server which works fine, but I did not like the long load times it would incur on all requests that went through it. So I decided to cache decoded ...
0
votes
2answers
189 views

Is end to end encryption over HTTP safe?

If you wrap all your data in an end-to-end encrypted payload is it safe to transmit over HTTP or at worse case self signed HTTPS instead of traditional CA signed SSL?
0
votes
1answer
247 views

How can I found a source of HTTP request in Wireshark?

There are weird requests to/from the AWS: and another one to/from 177.143.198.104.bc.googleusercontent.com: ( http://whois.domaintools.com/177.143.198.104 ) I use Ubuntu 18.04 Desktop, web browsers ...
0
votes
0answers
54 views

Is mime-sniffing still something to protect against with modern browsers (with X-Content-Type-Options)?

I have read about X-Content-Type-Options and it says often that it protects against IE mime sniffing problems. I am wondering if in 2021 it is still valid and a problem for modern browsers? In other ...
375
votes
4answers
477k views

Why is 'Bearer' required before the token in 'Authorization' header in a HTTP request?

What exactly is the difference between following two headers: Authorization : Bearer cn389ncoiwuencr vs Authorization : cn389ncoiwuencr All the sources which I have gone through, sets ...
2
votes
3answers
216 views

How to limit web API microservice communication to specific list of machines?

I have an PHP API that I want to be consumed only by one static website. However the HTTP is not secure as from what I suspect any header can be spoofed (IP - I may be wrong here, domain name, and so ...
2
votes
0answers
93 views

http smuglling how can i do a poc in a big websites?

i try to find http smuggling in big bug bouny program if i send this to the server POST /path HTTP/1.1 Host: subdomain.domain.com User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 ...
1
vote
1answer
105 views

Does enabling SharedArrayBuffers via service worker headers create Spectre vulnerability?

In browsers, use of SharedArrayBuffer is restricted to sites with the following HTTP headers because otherwise it exposes vulnerabilities to Spectre and Meltdown. Cross-Origin-Embedder-Policy: require-...
18
votes
2answers
9k views

How is the lack of the "SameSite" cookie flag a risk?

Nowadays cookies can have HTTPOnly, Secure and SameSite flags. The purposes of HTTPOnly and Secure flags are pretty clear. But what does SameSite scripting prevent exactly and how? Additionally, how ...

1
2 3 4 5
28