Questions tagged [http]

Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.

Filter by
Sorted by
Tagged with
0
votes
4answers
89 views

HTTP access from a single IP [closed]

If I were to configure a server that would be configured to only be accessible (HTTP) from a single IP address via a port, is it safe from unauthorized access?
1
vote
1answer
68 views

Do all files downloaded from the web, come with a checksum to verify the file?

Pretty straightforward question. Take the image here: https://i.imgur.com/oEdf6Rl.png Does it come with a checksum, which I can verify against after I have fully downloaded the file? This question ...
2
votes
1answer
33 views

Timeless timing attacks and response jitter

I've been researching timeless timing attacks, ie: timing attacks using concurancy rather than round trip time. Here is an article by portswigger with links to the origional article by Van Goethem. ...
1
vote
1answer
46 views

Can an error page (like 404) served without X-Frame-Options be exploited?

I'm checking some HTTP headers in the server response. I get a 404 error page. Could in some scenario an attacker leverage a missing X-Frame-Options header in a 404 page?
0
votes
0answers
58 views

How to configure openssl client to only accept specific server certificates? [migrated]

I'm new to this community and kind of to things related to security. I have three servers Web Server (Client) Mail Server (eSMTP) Web Server All servers have their own SSL certificates and got asked ...
0
votes
2answers
112 views

How do servers protect against straight up sending a HTTP request that is actually some malware or HTML code? [closed]

I know servers have something to block you from just sending them an HTTP request that is actually some malware or a webpage that is malicious, because it would be so easy to just spam HTTP requests ...
0
votes
0answers
31 views

How to confirm and execute TE.TE http request smuggling? [closed]

When I send an HTTP request with two Transfer-Encoding headers I get a 501 response code on the very first response (usually this is supposed to be the case during the second response according to ...
1
vote
1answer
61 views

What exploit is trying to be leveraged here? (Apache access.log)

I've just deployed a barebones Apache server on Digital Ocean, only hosting static files. No PHP et al. I'm not too bothered to see random exploit attempts, but 99% of the requests are of this similar ...
0
votes
0answers
17 views

Security implications of protecting private data with a long URI exclusively [duplicate]

A website hosts private/personal information at a very long and unpredictable URI, yet access to this URI is completely unauthenticated. Are there any major security issues with this? I can think of ...
0
votes
0answers
38 views

Path of Set-Cookie HTTP Response Header

The Tangled Web notes: URL paths are not taken into account during same origin policy checks and, therefore, do not form a useful security boundary Given that, is there any reason to set the Path or ...
-1
votes
2answers
90 views

People say “false positives” in request smuggling. What does it mean? [closed]

I always see "false positives" or "false negatives" in HTTP request smuggling forum posts. What does it mean? Example: HTTP Desync Attacks: Request Smuggling Reborn
1
vote
1answer
103 views

How can a site preemptively notify browsers to enforce an SSL on their domain?

I learned about this years ago and don't remember enough of the keywords to search for it appropriately. Its where sites can tell the browser that the site must not allow the site to be downgraded to ...
0
votes
1answer
50 views

why the website cant understand my request in http smuggling?

hi I started to find bug bounty vulnerabilities and i think i found a te.cl vulnerability in a website. i send GET / HTTP/1.1 Transfer-Encoding: chunked Host: subdomain.domain.com User-Agent: Mozilla/...
2
votes
0answers
73 views

Is the HTTPS lock sign displayed if reasources are loaded from insecure sites?

We all know that if you visit a secure site which uses https, all modern browsers will show a padlock sign if it has a CA certified certificate. My questions are: Suppose there is an image loaded in ...
1
vote
1answer
42 views

Custom response for Web Application Firewall (WAF)

What should be the custom response code when WAF blocks a request due to matched rules or policy violation. We should kept the response code as 403 or 200 when WAF returns a response against a blocked ...
1
vote
0answers
52 views

Intercept HTTP requests for invalid domains in Linux

I am using Ubuntu 18.04. When making a HTTP request to invalid domains, I get a HTML page with javascript code that redirects me to uniregistry a landing page. More specifically, when trying to load ...
3
votes
1answer
116 views

What are these long hexadecimal HTTP requests? [closed]

I'm receiving long hexadecimal requests on my webserver, such as: /...
0
votes
0answers
58 views

Why is noreferrer recommended to prevent reverse tab nabbing attacks?

I just read about reverse tab nabbing. Why is noreferrer recommended in addition to noopener? Isn't it enough to have noopener? I assume if neither are sent, there could be Javascript code on the bad ...
1
vote
2answers
142 views

What does using a VPN offers over HTTPS + DoH in terms of protection?

What are the security risks that someone using HTTPS (everywhere) + DoH is vulnerable to, comparing to someone using a "trusted" VPN?
0
votes
1answer
50 views

Should I redirect http request to https from my system's application or from DNS or other? [closed]

I want to create a web server that does redirects HTTP to HTTPS. What is the simplest method to do this but also secure? Should the DNS handle this? (For example, Route53) I used to do this with my ...
21
votes
9answers
6k views

How does one take advantage of unencrypted traffic?

Let's assume an ecommerce site works over HTTP, rather than HTTPS. What are the practical dangers here? How could an attacker exploit this? Whenever I read about dangers of unencrypted traffic, it is ...
0
votes
1answer
111 views

Is it safe to visit any website in TOR when the Security Bar is set at Maximum? (Safest)

Someone has sent me a link on Tor which when visited instantly read that the website itself was not available and that apparently the link is broken somehow. When using Tor i use the option "...
0
votes
1answer
115 views

Secure HTTP login in an embedded (IoT) system

HTTPS in an embedded (IoT) system is (as far as I know) not necessarily a good solution. Basic Authentication is not secure. Acceptable in an internal network. Idea: Login.html (when called up) sends ...
4
votes
0answers
99 views

Is an out-of-band request via DNS by abusing the X-Forwarded-For header exploitable

By changing the X-Forwarded-For header in a request, I am able to have it sent an OOB interaction with Burp Collaborator requesting a DNS lookup of type A. Is there any risk to this vulnerability or ...
2
votes
1answer
103 views

Did Wireshark capture an update of Adobe Acrobat Reader over an unencrypted connection?

My home router is an AVM FritzBox and it's able to log all incoming and outgoing traffic in a file format readable by Wireshark. Some days ago I started capturing all traffic for about an hour to get ...
10
votes
1answer
758 views

Is basic HTTP proxy authentication secure?

I have been looking for cloud based proxies, and I notice that it's very common to authenticate to a proxy using basic auth over an unencrypted connection. I don't understand why this is considered ...
0
votes
1answer
62 views

How to know if the response is from the CDN and not the origin?

I am doing some bug hunting. I inserted a malicious payload into a request. But I am not sure if the response is from CloudFlare or the origin. Are there special headers which help me to distinguish ...
0
votes
1answer
78 views

RestApi Libsodium SealedBox end-to-end request encryption scheme

I am making an API that uses the following steps for encryption. All of this is implemented using libsodium. First of all the client has to make an initial request to the server for getting his public ...
1
vote
1answer
81 views

How to make Squid Proxy undetectable by ip-check.net? [closed]

I have setup squid proxy on a CentOs server where I set forwarded_for to delete and denied request headers on the /etc/squid/squid.conf file. However, whilst connected to the proxy, if I visit http://...
0
votes
0answers
23 views

How does AWS verify signed requests?

How does AWS request signing and verification work? Let's say I have created a signed request using this guide. How does AWS service verify this signature? I see 2 options with their respective flaws (...
1
vote
0answers
85 views

Snort Inline Mode(IPS) Routing Packet Forwarding

I'd like to build an IPS which would be a seperate endpoint than the router and/or protected servers. To achieve this I've installed to my Ubuntu server Snort with DAQ(AFPACKET). The instructions I've ...
1
vote
1answer
117 views

Isn't HTTPS enough to prevent MITM in mobile apps? Why is SSL Pinning needed?

I am making a webview that is going to be part of a native iOS and Android app, I implemented the webview using HTTPS as a protocol, and developed my NodeJS app there. But the security team from where ...
1
vote
0answers
32 views

Arbitrary query parameter reflected in server response header. Is it exploitable?

SCENARIO: If I send requests like these: http://site.com/page?safe_param=1?my_arbitrary_param=2 The server responds with a normal HTTP response but within common headers it includes also the ...
-3
votes
1answer
87 views

What type of attacks does HTTPS protect against? [closed]

What are some example attacks that could be vulnerable if HTTP is used, and that can be overcome in HTTPS? The only one I can think of is man in the middle attacks, where the intercepted traffic is in ...
1
vote
1answer
50 views

What you can do with super cookies on subdomain to harm domain?

When you search in Google for user cookies top results are VPN services that say that it's used by ISP to track the users. Wikipedia Supercookie say nothing about HTTP headers and what exactly are ...
0
votes
0answers
106 views

HTTP Headers: Document Policy vs. Permissions-Policy/Feature-Policy

I'm checking the options to harden my web app by setting the appropriate HTTP headers. Besides the Content Security Policy (CSP) there are two another approaches: Document Policy and Permissions-...
0
votes
1answer
121 views

Intensive 586 (ms-shuttle) port scan/exploit/hacking attempts

Recently i wanted to play a bit with TCP/UDP networking (and touch some custom HTTP server impl) on C# and found out that i'm getting requests from totally unknown dudes, such as this one: FROM: [::...
1
vote
1answer
76 views

Why is php-fpm trying to connect somewhere on port 443?

I have nginx and php-fm set up to front a word press site. I used certbot to setup TLS. When I load any page, I see selinux violations and it looks like php-fpm is trying to reach out to some port ...
1
vote
1answer
86 views

XSS injection in the name of a file to be sent

I found a reflected XSS in a POST request that sends a file to the web server. The HTTP POST Request The HTTP 200 OK Response When I want to try to insert document.cookie in the payload, the web ...
-2
votes
1answer
132 views

Can someone tell me whats the encryption in this? [closed]

khgpd://zpn.xddspbx.nrf/j/9djwth14tmct9tf/uzdwvrrnonv.tue?gz=0 This is an encrypted text and is most prob a url....pls decode it or tell me which cipher is it, this is not for any security breaches ...
0
votes
0answers
20 views

Internet provider with http site rendering on https website [duplicate]

If I am browsing a site that is https and it renders images from another site (like google images, bing images) and some of the sites are HTTP, does the internet provider see exactly which pictures ...
2
votes
1answer
76 views

Should I check Host header or ServerName for CSRF defense when serving behind proxies?

In a CSRF defense based on checking forbidden headers, should I check Origin/Referer header against the ServerName configuration directive, or is it sufficient to simply check against the HTTP Host ...
2
votes
1answer
239 views

Man in the middle using HTTPs downgrade to HTTP

In general browsers attempt to establish a HTTPs-Connection if possible. How would you force a browser to fallback to HTTP when somebody enters asdf.xyz in the search bar of his/her browser without ...
0
votes
2answers
74 views

HSTS without auto-upgrading HTTP to HTTPS [duplicate]

I have a website hosted at https://example.com/mysite. If you navigate to http://example.com/mysite, you get a 404. Everything that comes in over HTTP gets 404'd. I was dinged on a security audit ...
6
votes
5answers
5k views

Why doesn't a simple HTTP request to display a remote web page violate the same-origin policy?

On a W3Schools page, I found that HTTP requests work like this: A client (a browser) sends an HTTP request to the web A web server receives the request, and runs an application to process it The ...
13
votes
3answers
5k views

What risks am I taking by using an http site to play a video game that just records mouse events?

There's this game at http://slither.io which I like to play. Only inputs that I give to it are space bar, and cursor location. It's not https. Are there any risks?
0
votes
1answer
67 views

Update URL over HTTP

I saw VLC (Windows) gets updates from an unencrypted URL: HTTP, not HTTPS! Do you think there's a risk for a man-in-the-middle attack?
32
votes
1answer
6k views

“google.com” is not HSTS protected?

Issue: Oftentimes people enter google.com directly in the browser's address bar without including either the http:// or https:// prefixes. Using Chrome DevTools on a fresh incognito session, I ran the ...
3
votes
1answer
89 views

Does a website's session key have to be unguessable if it's signed?

I'm creating (what I believe to be) a cryptographically hard to guess session key to keep my users logged in by generating 32 random bytes (using crypto.randomBytes). I'm storing this in a cookie (as ...
1
vote
0answers
32 views

Security Concerns with HTTP/3 / QUIC-based protocols [duplicate]

I've been seeing a large number of companies, including Cloudflare who just sent out a notice to their customers about enabling HTTP/3 via QUIC recently, touting HTTP/3 based on QUIC as 'much better' ...

1
2 3 4 5
26