Questions tagged [http]

Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.

Filter by
Sorted by
Tagged with
0 votes
1 answer
30 views

Modifying request responses leading to unauthorized access?

I have been developing some applications lately where the content on the web app is rendered based on the request's response. For example, a user with a "free" plan has limited access, ...
user avatar
  • 105
0 votes
1 answer
31 views

How to mitigate risk of exploiting open POST endpoints?

I'd like to ask for advice reg. protecting the state-altering HTTP API endpoints of the API that I'm owning (POST etc.). I'm owning a web application that exposes some HTTP endpoints to the world. ...
user avatar
1 vote
1 answer
35 views

Validate HTTPS traffic at later time [duplicate]

I want to capture HTTPS traffic, save it, and validate it at a later time. I want to ensure that at a later time I'm able to validate the HTTPS traffic using the certificate which was presented at the ...
user avatar
  • 11
0 votes
1 answer
51 views

Why is Nessus report HTTP running a web server on port 80 when I'm sure that it isn't?

From a Nessus scan I have the following output regarding HTTP and the use of port 80: Info N/A 43111 HTTP Methods Allowed (per directory) Info N/A 24260 HyperText ...
user avatar
  • 23
0 votes
1 answer
55 views

What security concerns can arise from using HTTP Basic-Authentication? [duplicate]

During an engagement, i have been asked by a client to explain (with the use of one or more examples) why they must update their website authentication mechanism, as they are currently using HTTP ...
user avatar
2 votes
2 answers
47 views

Mitigating the performance impact of strong hashes with Basic HTTP authentication

I am trying to decide which work factor to use for our hashed passwords, and I am facing the following dilemma. Let me elaborate for a moment. Basic HTTP authentication works as follows: The user ...
user avatar
  • 2,914
0 votes
1 answer
51 views

Encryption options when one-way secure channel is available

I would like to ask what encryption options are available for the following real scenario: There is an unsecure, full-duplex communication channel between a server and client There is also a secure ...
user avatar
4 votes
2 answers
225 views

If the connection is encrypted, is it still unsafe to login at a public network?

It's common knowledge that one shouldn't login to personal or bank accounts on public wifi such as in a starbucks or a hotel. However, assuming that the connection is HTTPS and the passwords itself ...
user avatar
0 votes
1 answer
54 views

The router (that my PC is connected to) is continuously attempting to connect through TCP80. What would be the reasons?

I have no access to the router nor do I have any administrative access to this local network. But every 5 minutes the router attempts to connect to my PC through port 80/tcp, and it attempts exactly 4 ...
user avatar
2 votes
1 answer
92 views

HTTP and HSTS Web Server

If I have HSTS enforced on a web server with HTTPS 443, but HTTP port 80 is still open, does this make HTTP still accessible, or only for the first time before it's added to the browser HSTS list? I ...
user avatar
  • 23
0 votes
0 answers
55 views

How to perform php post request attack with javascript sanitization?

The following code demonstrates the source code of this challenge and basically, I need to send a post request with arbitrary code to execute on the server. However, after multiple attempts Im unable ...
user avatar
0 votes
2 answers
72 views

Changing HTTP to HTTPS in a URL has any effect in the security of a connection?

A lot of websites tell that HTTP is insecure, but if I manually change the address bar URL from http:// to https:// in a website I visit does it provide security regarding the connection? Because all ...
user avatar
0 votes
0 answers
11 views

Is it necessary to enable TLS for internal traffic? [duplicate]

I have two applications hosted in our internal network (hosted in AWS) and in order to access both these applications, I need to connect using VPN. Since it is accessible only internally, is it ...
user avatar
  • 21
22 votes
6 answers
5k views

Backend database username and password revealed in JSP Page

Recently I came across a website and when clicking on one of hyperlinks it displayed a HTTP 500 error page as shown in the image, which indicated that it is using Java Server Pages and on line 23 the ...
user avatar
1 vote
2 answers
249 views

How can I make an SSL certificate for an IoT device trusted on all browsers?

I have a web server running on an IoT device, more specifically, on an ESP32. This web server serves a website that is used for managing the device and can contain some sensitive information, hence I ...
user avatar
22 votes
4 answers
5k views

Are web servers that support HTTP any more vulnerable to client-run exploits than those that use HTTPS?

Does HTTPS have any unique mechanisms that protect web servers from exploits run by a malicious client (eg. SQL injection, specific browser exploits etc.)? My current understanding is that HTTPS is ...
user avatar
0 votes
1 answer
67 views

Does using the "-k" flag with curl disable only the certificate verification?

I'm writing an API which is running on my own web server written in Go. I have a local environment set up to run it all under HTTS using a self signed cert and it all works great. It all works and I ...
user avatar
1 vote
1 answer
46 views

owasp crs 3.0 rule functuonalityconsult

I have built a waf and using CRS 3.0, this waf can inspect the request body to limit the file size that upload to the server, I am wondering ,if I just disable this feature manually, it will cause any ...
user avatar
0 votes
1 answer
51 views

Detect http traffic injection

Is there any way to detect injection into unencrypted http traffic, like files, js etc. a. just by traffic analysis b. from the client-side?
user avatar
0 votes
0 answers
27 views

Is HTTP header Permissions-Policy worth using if no features are used?

From the spec at https://www.w3.org/TR/permissions-policy-1/ it seems there is no way to whitelist features with a default blacklist, and each feature must be individually disabled in every single ...
user avatar
0 votes
1 answer
94 views

How do you sniff information exchanged with a site which does not use TLS/SSL?

Whenever you visit a website without HTTPS (because for whatever reason there are still quite a few of them even in 2022) typically the browser will announce that you should not enter any sensitive ...
user avatar
0 votes
1 answer
56 views

Can POST request be changed in a HTTPS website?

I am trying to develop a website where I grab data using javascript and send it to PHP using ajax post. However, while researching, I found that the POST request can be modified using third-parties ...
user avatar
0 votes
2 answers
95 views

Does the HTTP status code 302 guarantee no other content was served as part of the same HTTP response?

Does receiving the HTTP 302 status code from a domain A guarantee in any shape or form that there was no JavaScript ran or any additional content (external or not) loaded from that domain A? The ...
user avatar
0 votes
0 answers
102 views

CSRF and XSS Protection with a Static Site and REST API

I'm building an application which will support both browser and application access to REST resources. Applications will POST a username/password JSON body to a login endpoint which will return a ...
user avatar
  • 6,685
16 votes
5 answers
4k views

Obfuscating HTTP Error Codes

I'm working on a REST API endpoint where we only accept requests from certain domain names. Whitelisting. A dev I'm working with recommended that we return HTTP 400 instead of HTTP 403 if the incoming ...
user avatar
4 votes
1 answer
1k views

Can I trust the http Host header in this context

I have a microcontroller, connected to my WLAN, that hosts a tiny web server. I can reach the http server via 2 ways : either via a domain (admin.example.com) which acts as a reverse proxy to the ip ...
user avatar
  • 143
0 votes
2 answers
110 views

HTTP with encrypted message vs HTTPS

A bit of background: I am a web developer and sometimes i integrate some form of external API in my web applications. It's the second time already that i find something strange: some APIs instead of ...
user avatar
  • 3
0 votes
0 answers
101 views

Is my HTTPS connection still encrypted if the SSL certificate has expired? [duplicate]

When I tried to visit a particular website using Mozilla Firefox, I got a SEC_ERROR_EXPIRED_CERTIFICATE error because the website's SSL certificate has expired. If I decide to click on the "...
user avatar
  • 583
1 vote
1 answer
114 views

How to exploit HTTP Request Smuggling?

I set up the following lab using HAProxy and Gunicorn. Both "Smuggler.py" tool and "HTTP Request Smuggler" BurpSuite extension detected CL.TE vulnerability. I checked it manually ...
user avatar
0 votes
1 answer
49 views

What is the difference between Cross Origin Opener Policy and SOP?

"The HTTP Cross-Origin-Opener-Policy (COOP) response header allows you to ensure a top-level document does not share a browsing context group with cross-origin documents." In a situation ...
user avatar
  • 3
2 votes
0 answers
133 views

What are NGINX reverseproxy users doing to prevent HTTP Request smuggling?

Since NGINX does not support sending HTTP/2 requests upstream, what are the present NGINX reverseproxy users doing to mitigate HTTP Request Smuggling vulnerability? I understand that the best way to ...
user avatar
0 votes
1 answer
93 views

Do websites send full URL over HTTP instead of HTTPS if there's an HTTPS connection?

I was learning to use wireshark when I noticed that opening a reddit url (reddit.com/r/privacy) sent a GET request for r/privacy over HTTP. Is this visible to the ISP or network sniffers? I was under ...
user avatar
  • 1
3 votes
2 answers
128 views

Is it ok to skip validation of TLS validation if the request's host is targeting localhost?

I'm writing a canary for monitoring which will be deployed to the same host as the monitored application. The underlying application validates certificates for incoming requests and validates that the ...
user avatar
  • 131
0 votes
0 answers
56 views

Security implications of using HTTP for service to service communication within the same host [duplicate]

What are the security implications of using HTTP only for IPC for services within the same host? In my case, I am using docker-compose to host two ASP.NET Core services within the same host in Azure. ...
user avatar
2 votes
1 answer
79 views

Cookies VS localStorage (JavaScript Security)

I know that HTTP requests made by the site get the browser's localStorage for a site, and document.cookie is encrypted for HTTPs websites, but I'm still wondering the risk of storing sensitive ...
user avatar
0 votes
1 answer
469 views

CheckMarx SSRF Vulnerability

I have a REST which takes a parameter dataSource as input and myService has follow logic. @RequestMapping(value ="/save", method = RequestMethod.POST) public List<String> find(@...
user avatar
28 votes
4 answers
9k views

Do websites know which previous website I visited?

Suppose I am using a web browser to look at example.com. Now, from the same web browser tab, I enter example.org in the address bar and go to that completely different website operated by another ...
user avatar
  • 583
0 votes
0 answers
114 views

Authenticating (getting token) by making Http request

As the topic is a bit vague I have decided to ask you guys here what do you think and what is the best practice in given scenario.   Disclaimer: I am programmer, and although I know a bit about ...
user avatar
  • 101
0 votes
0 answers
20 views

Hot to validate X.509 Certificate [duplicate]

A client wants to show a stream of his Motobix Webcam on his website. Its easy to show a jpg stream. But the problem is: The stream source is not protected with a valid ssl certificate. On the camera ...
user avatar
  • 101
2 votes
1 answer
834 views

Is it secure to share a public (RSA) key over http?

The following scenario: We have a HTTP (not HTTPS, so unencrypted) server which contains an open (RSA) public key. The general sharing of the public key should not be a problem since it is the public ...
user avatar
0 votes
0 answers
55 views

Unknown vulnerability name Referer header and Access-Control-Allow-Origin

When reviewing an application, I saw the "Access-Control-Allow-Origin" header as a response. When I modified the "Origin" header in the request, I got a 404, which was fine. So no ...
user avatar
0 votes
2 answers
85 views

What can be deduced with a GET /.ht 403 forbidden and a GET /hx 404 not found?

In testing a website on a bug bounty platform. What can reasonably be deduced from the following situation? GET /.ht -> returns a 403 Forbidden GET /.hx -> returns a 404 Not Found The only ...
user avatar
1 vote
1 answer
152 views

Modifying UserAgent by a proxy?

For learning and testing purposes I'd like to change the UserAgent in the HTTP header. In the desktop Firefox it is simple: there is an add-on for this task. But on android... it is impossible. I ...
user avatar
0 votes
1 answer
154 views

suricata http rule to identify POST requests

I can’t figure it out / understand. Need to write a rule that catches an HTTP POST request from one ip address more than three times in 10 seconds and logs it. alert http $EXTERNAL_NET any -> $...
user avatar
0 votes
2 answers
272 views

Is end to end encryption over HTTP safe?

If you wrap all your data in an end-to-end encrypted payload is it safe to transmit over HTTP or at worse case self signed HTTPS instead of traditional CA signed SSL?
user avatar
  • 101
0 votes
0 answers
67 views

Is mime-sniffing still something to protect against with modern browsers (with X-Content-Type-Options)?

I have read about X-Content-Type-Options and it says often that it protects against IE mime sniffing problems. I am wondering if in 2021 it is still valid and a problem for modern browsers? In other ...
user avatar
1 vote
1 answer
162 views

Does enabling SharedArrayBuffers via service worker headers create Spectre vulnerability?

In browsers, use of SharedArrayBuffer is restricted to sites with the following HTTP headers because otherwise it exposes vulnerabilities to Spectre and Meltdown. Cross-Origin-Embedder-Policy: require-...
user avatar
1 vote
1 answer
328 views

THC Hydra sends GET request without parameter before actual request with parameter which causes authentication problems

I am using THC Hydra (v9.0) on GNU/Linux to pentest my private API. The GET route in question requires a key as GET parameter which returns an auth token if the correct key was submitted else "...
user avatar
  • 11
1 vote
1 answer
168 views

Ramifications of including "localhost" in the subject alternative field of a x509 certificate?

Are we inviting any problems if we add localhost and 127.0.0.1 to the subject alternative name field of an x509 certificate? We are still trusting the appropriate root CA, but relaxing the rules of ...
user avatar
0 votes
2 answers
170 views

Is it bad practice or major security risk to cache decoded auth tokens in my backend?

I've set up a firebase passport strategy on a NestJS server which works fine, but I did not like the long load times it would incur on all requests that went through it. So I decided to cache decoded ...
user avatar

1
2 3 4 5
28