Questions tagged [http]

Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.

Filter by
Sorted by
Tagged with
0
votes
0answers
32 views

Why SetCookie's SameSite directive applies the destination rather than the origin?

I understand that the SameSite directive tries to protect against cross-origin leakages and CSRFs (see OWASP), but I don't get why (on my browser at least) it applies to the cookie's destination ...
12
votes
2answers
2k views

Secure HTTP Headers - where should be implemented, WAF or code level?

I have a REST API exposed to the Internet and another application with form-based authentication. These apps are behind a Web Application Firewall. Question is, where I should implement the below ...
-2
votes
0answers
94 views

Why honour-killing your website is the best practice if HTTPS doesn't work? [closed]

I'm trying to understand the phenomenon that's been prevalent for the last few years coming out of the security community. I have a popular blog about cats and dogs; I'm being told I must enable ...
0
votes
0answers
55 views

Response seems to get redirected if SQL injection query succeeds, if not then it doesn't get redirected

Under the authorization of my friend, I am testing his website against potential vulnerabilities. I was trying to find if I was able to inject a SQL query into a POST request parameter hi' or 1=1 --: ...
0
votes
2answers
69 views

Is there anything I can do past SSL pinning to secure my connection? [closed]

My goal is to prevent man-in-the-middle (MITM) attacks through proxies. I've implemented SSL pinning, which has helped significantly, but I'm wondering if there's anything more I can do that's worth ...
0
votes
1answer
66 views

Why there are some weird requests to my web hosting [duplicate]

I was doing my plesk hosting logs checking for web and database development. Somehow, I had seen some weird ip trying to communicate to hosting. Wonder what is the purpose of these anonymous requests. ...
3
votes
1answer
132 views

A workaround for external website's HTTP registration page

There is a website which I want to register for but it is a internship/job-seeking website and thus on registration some VERY sensitive data is required. When registering Firefox alerted me that the ...
0
votes
0answers
18 views

Sniffing Traffic Android App [duplicate]

So, imagine that a vulnerable app provides a login interface. This login sends the user's credentials to the App's server to authenticate the user. However this is done via HTTP, therefore not secure. ...
26
votes
2answers
15k views

How are full URLs exposed when they are encrypted by HTTPS?

As far as I know, HTTPS URLs are encrypted (correct me if I'm wrong). There was a data leak recently and in one article about the leak I saw this picture: If HTTPS URLs are encrypted then how did the ...
0
votes
0answers
37 views

How to make sure the domain level SSL certificate is present in trust store while establishing the connection to a website? [migrated]

According to my understanding, when we are trying to connect to a website/url, even if one of the certificates in the SSL certificate chain of the website is present in the trust store then connection ...
0
votes
1answer
144 views

DNS Tunnel or Not (g01.msn.com)

Thought I found DNS tunneling and but after a closer look it seems a bit more complex. Anyone seen this traffic before? User starts their computer, launches firefox.exe, then they hit c.msn.com ...
2
votes
1answer
53 views

Is there a difference between editing HTTP messages manually or with burp for example? (WebGoat HTTP intercept exercise “problem”)

I am diving now into WebGoat, there's this little exercise in the "general" tab calle d "http proxies" which asks you to use zap/burp to intercept and modify a request, this is what is being us asked. ...
0
votes
2answers
157 views

Is it a security issue that Nginx returns server name in errors?

I have recently sat up an Nginx in a way that makes it not return a Server header and hide the version information from the error pages. The error page looks like that now (and anyone can provoke it ...
1
vote
0answers
114 views

Am i being MITMed?

Lately i was experiencing weird behavour from some big websites. More specifically, when i normally tried to connect to facebook, i would be greeted with this login page: I have placed these with ...
1
vote
1answer
70 views

Is a browser session encrypted using https with just the IP? [duplicate]

Accessing a webservice/website via IP with https eg. https://x.x.x.x/ the browser shows that the connection is not secure. Is the connection actually secure/encrypted or not (more secure than ...
2
votes
1answer
82 views

http referer security

quoting from Referer header: privacy and security concerns For example, consider a "reset password" page with a social media link in a footer. If the link was followed, depending on how ...
1
vote
3answers
128 views

Does HSTS provide security advantages on private networks?

For systems that only connect to the internet via a single dedicated private network (no WiFi hotspots), and assuming no systems or components on that network are compromised, does HSTS (HTTP Strict ...
42
votes
7answers
5k views

Will the same JavaScript fetched by HTTP and HTTPS be cached separately by the browser?

Say that a web server supports both HTTP and HTTPS. If a browser fetches the same JavaScript with a HTTP GET and a HTTPS GET, and the JavaScript is cache-able, will the browser cache two copies of the ...
0
votes
1answer
60 views

Security Considerations To Account for When Redirecting From Microservice to Another

I am evaluating the above service design where I want to have mechanism to pass a user through multiple microservices. In this simple example, the user goes through a sign-up process and once done, ...
1
vote
1answer
40 views

Signing webhooks: symmetric vs asymmetric

I want to sign webhooks so that client services can verify that a request came from my service. Looking around, it seems that most SaaS use symmetric keys shared by the client and the SaaS. Obviously,...
0
votes
1answer
40 views

Bypassing header validation

I have made a script that can be used for exploiting CORS misconfiguration. The script works fine but if I want to send an extra header to the request by xhttp.setRequestHeader("test_header", "...
0
votes
0answers
52 views

Method to bypass \n in WAF (\n vulnerability)

I have this application that has an input box where the data is going to be sent in a JSON format. The JSON payload might look like this {“message”: “hello\nmy name is andi”} But the problem is the ...
0
votes
1answer
81 views

Deserialization Opportunity?

I have minimal experience exploiting deserialization vulnerabilities and I am working on and I have identified the following URL endpoint. This is it URL Decoded: /Account/Register?Count=0&Keys=...
1
vote
1answer
99 views

Can somebody explain why the IP address 192.168.1.1 is apparently “special” and not following the CORS rules?

I asked this question: What would happen if some random webpage made an Ajax request for http://127.0.0.1/private.txt? The answers/comments confuse me. Am I right in interpreting them like this? "...
9
votes
1answer
359 views

What would happen if some random webpage made an Ajax request for http://127.0.0.1/private.txt?

I run a localhost-only webserver (PHP's built-in one) for all my admin panels and whatnot on my machine. I'm worried that, if any random webpage has a JavaScript snippet which makes an Ajax call to ...
0
votes
1answer
56 views

Exploiting CORS and storing the response to server

I am trying to exploit misconfiguration CORS. I have created and hosted a file in HTML and Javascript where if someone clicks the link there HTTP response containing cookies will reflect them on the ...
3
votes
2answers
68 views

How can HTTP Parameter Pollution be exploited?

In HTTP Parameter Pollution, I know theory how it work; you inject multiple HTTP parameters with the same name to trigger bugs in the server, but I can't understand how one can exploit this. When I ...
-1
votes
1answer
46 views

How to protect my webserver from unauthorized client applications? [duplicate]

I would like to host simple HTTP webservices and develop a web client for it (basic javascript app in the browser). any person (even without registering) shold be able to access the webservices but ...
0
votes
1answer
70 views

Use of HTTP functions in GCP Cloud Functions Is Not Secure. Why they are still available?

As Google mentions itself in the documentation, the HTTP functions in Cloud Functions have no authentication and are not secure. HTTP functions are unprotected and will respond to any HTTP request,...
0
votes
0answers
42 views

How does the Great Firewall of China handle TLS encryption? [duplicate]

My understanding is that when a client and server are connected through TLS, only they have the key needed to encrypt and decrypt messages. My question is, given that the Great Firewall of China does ...
0
votes
0answers
36 views

Can DNS-over-HTTPS be broken by reverse DNS lookups? [duplicate]

If anyone can see the receiver IP address in a HTTPS request, what will stop ISPs from analysing the packet, reverse DNS lookup the IP and block the access to the domain the client is trying to reach. ...
0
votes
1answer
90 views

RSA Key, String vs Hex vs Base64 vs byte-array represantational form

....key is normally a string of bits used by a cryptographic algorithm to transform plain text into cipher text or vice versa.... https://www.di-mgt.com.au/cryptokeys.html Suppose I have a Backend ...
42
votes
7answers
9k views

Why is the HTTP protocol more susceptible to being intercepted than the BitTorrent protocol?

I'm downloading an .iso file that is offered through the main website, which recommends users to use BitTorrent. In addition, they offer the download via HTTP using different mirror sites that belong ...
3
votes
1answer
60 views

What are the security implications of allowing API consumer to decide primary key stored in database?

Story We are developing an API that which allow consumer to create or modify (i.e. upsert) objects stored in database via an endpoint with HTTP PUT. The primary key of the object stored in this way ...
3
votes
2answers
87 views

Are there potential risks to sending HEAD requests to user-supplied URLs?

I have an application that unshortens URLs by using the python requests library to send HEAD requests with allow_redirects=True. I don't do anything with the response except check the response URL. ...
1
vote
0answers
83 views

Http Content-Length too long - Time Out

I was recently going through the HTTP Desync attack presented here: https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn This raised one question concerning the way the HTTP ...
3
votes
1answer
69 views

UUID as auth token [duplicate]

I am working on a small IOT device that basically is a status display, which includes data about my phone. That means that I have a simple web server running, which can be used to update the devices ...
0
votes
1answer
98 views

Advantages of http CONNECT method over TLS

I wonder what the advantages of http CONNECT request over TLS are. I understand that the CONNECT request data from client to proxy is encrypted. But I want to know more specific advantages. Which ...
1
vote
2answers
73 views

Is it possible too exploit CORS with double Origin value?

I found a website that has a well implemented CORS configuration, but for some reason I am able to insert two Origin headers in a POST request, and both of these values are reflected in the reponse. ...
0
votes
1answer
84 views

Crack a single http cookie and gain access to a random user's account! [duplicate]

I was looking for lots of information about cookies recently. What attracted me the most was the fact that cookies come in all forms and can be hijacked through arp poisining and spoofing on the local ...
0
votes
3answers
78 views

Self-signed vs. authority issued certificate for internal web services

From an information security perspective, which is best for private (on-premise) micro-services (web services) accessed via HTTPS? Are there an advantages in using certificates signed by a Third ...
1
vote
1answer
71 views

Is there a security benefit to testing HTTP header presence with Javascript?

I have found in one of the client side libraries that it is performing an AJAX call to an API and checking if response contains all of the following headers with corresponding values (as a security ...
2
votes
0answers
65 views

Bruteforce https post using single tcp connection

So I've tried bruteforcing my server using thc-hydra's https-post-form, but it floods the server very quickly and the requests start timing out. However, If I go through the browser where the HTTP ...
0
votes
1answer
84 views

Should I scan both HTTP and HTTPS seperately?

I'm doing a scan on some domains (who I will not name here) using OWASP ZAP. When I typed in the URL of a domain as http://thedomain, it returns http://thedomain/robots.txt and just a bit more. After ...
1
vote
2answers
81 views

How safe is it to allow JS CDNs in a HTTP content security policy?

I am tasked with adding a content security policy to a whole bunch of Magento stores to protect against credit card scraping code, which can sneak in via the store admin or GoogleTagManager* when a ...
1
vote
1answer
366 views

HTTP request smuggling, basic TE.CL vulnerability

Im trying to learn about http request smuggling and Im trying out the labs for burp suite. Im stuck on the TE.CL vulnerability, Ive clicked on the solution (see below:https://portswigger.net/web-...
2
votes
2answers
86 views

How to mimic a HTTP POST request?

I want to mimic a HTTP POST request that I intercepted and have raw on a file, what would be the best way to send it and be certain that I sent exactly the same request? example file: (private data ...
1
vote
2answers
104 views

Using certificate on same server but different port for https

I have taken a working HTTPS certificate from a server that I want to use on the same server, just on a different port. The certificate has a Subject Alternative Name defined in it. Using keytool, I ...
1
vote
1answer
85 views

Authentication via HTTP on VPN

There is an authentication server (OAuth2) that is only accessible from private network. A customer wants me to implement an app where users use VPN to authenticate themselves on such a server via ...
3
votes
1answer
168 views

Why isn't cloud (AWS, Azure, GCP) metadata served over HTTPS?

Why can any application or user on your server type an insecure URL like these to get server information about that instance? http://instance-data.us-east-1.compute.internal/latest/meta-data/ http://...