Questions tagged [http]

Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.

102 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
0answers
262 views

Is an out-of-band request via DNS by abusing the X-Forwarded-For header exploitable

By changing the X-Forwarded-For header in a request, I am able to have it sent an OOB interaction with Burp Collaborator requesting a DNS lookup of type A. Is there any risk to this vulnerability or ...
4
votes
0answers
127 views

WiFi Fingerprinting RFC2617 Linux Device Cannot Unauthenticate Unless AP Password Changes

There is a Cisco WiFi Access Point in the office that is intended for guests. It is an open network in that you can associate without providing a password with the SSID. It supports RFC2617 and so the ...
4
votes
0answers
120 views

Cross Origin Resource Sharing question

I have some mockup html/javascript on my desktop, I made an ajax GET call to: http://www.bungie.net/platform/Destiny/TigerPSN/Account/4611686018429149347/Character/2305843009215132906/Activities/ ...
3
votes
0answers
332 views

How Can Exploit Xss and Sqli via HTTP Verb Tampering?

I was reading a paper about 'HTTP Verb Tampering' here: https://blog.jeremiahgrossman.com/2008/06/what-you-need-to-know-about-http-verb.html The author said: 2) HTTP Verb tampering is generally ...
3
votes
0answers
2k views

how to fix Out-of-band resource load (HTTP) issue identified by BURP scan

I have Salesforce application which is using my web application hosted in one of our customer's server (IIS 8.0). BURP Scan has identified one issue in my web application. Issue is something like ...
2
votes
0answers
89 views

http smuglling how can i do a poc in a big websites?

i try to find http smuggling in big bug bouny program if i send this to the server POST /path HTTP/1.1 Host: subdomain.domain.com User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 ...
2
votes
0answers
104 views

Is the HTTPS lock sign displayed if reasources are loaded from insecure sites?

We all know that if you visit a secure site which uses https, all modern browsers will show a padlock sign if it has a CA certified certificate. My questions are: Suppose there is an image loaded in ...
2
votes
1answer
242 views

HTTP Headers: Document Policy vs. Permissions-Policy/Feature-Policy

I'm checking the options to harden my web app by setting the appropriate HTTP headers. Besides the Content Security Policy (CSP) there are two another approaches: Document Policy and Permissions-...
2
votes
0answers
471 views

HTML Injection to blind SSRF testing retrieves only DNS Query

I recently came across an application that was vulnerable to HTML injection on the invite function. When I insert <img src="image.jpg"> the image got rendered on the mail I received. I ...
2
votes
0answers
759 views

Unable to start reverse shell over HTTP

I am able to get a reverse shell working locally over TCP, but failing to trigger it remotely over HTTP. Locally over TCP: Attacker terminal runs netcat to listen for a connection over port 8000: nc -...
2
votes
0answers
135 views

Bruteforce https post using single tcp connection

So I've tried bruteforcing my server using thc-hydra's https-post-form, but it floods the server very quickly and the requests start timing out. However, If I go through the browser where the HTTP ...
2
votes
3answers
213 views

How to limit web API microservice communication to specific list of machines?

I have an PHP API that I want to be consumed only by one static website. However the HTTP is not secure as from what I suspect any header can be spoofed (IP - I may be wrong here, domain name, and so ...
2
votes
1answer
2k views

Bettercap 2.x SSLStrip Is Not Converting Links

I posted this before. I am creating a new post because of all the changes I would need to [edit] out. I have the latest version of bettercap. I have the latest version of Kali Linux using the latest ...
2
votes
0answers
567 views

Random Alphabetical String Added to URL

I originally asked this question over at Stack Overflow, but someone there suggested asking here because it might be possible that something malicious may be causing the following issue: Users have ...
2
votes
0answers
58 views

Concerns when passing all OPTIONS requests through authorization proxy gateway

I have a React based application which uses RESTful services on backend distributed on private network. To communicate with such services using AJAX, client application sends all its request through ...
2
votes
0answers
223 views

Assymetric auth like AWS4-HMAC-SHA256

I wondered if there exists a defined mechanism similar to AWS4-HMAC-SHA256 (as a scheme in Authorization HTTP header), but using asymmetric algorithm, probably ed25519, and how secure it would be to ...
2
votes
0answers
697 views

HMAC authenticated API calls with multipart/form-data file uploads

We have an existing API where 3rd parties can push data. The API calls are authenticated with HMAC using the same scheme as described in Ruby's ApiAuth library which I use to verify signed requests. ...
2
votes
2answers
1k views

NONCE not supported in Asp.Net for CSP implementation

Is NONCE supported in Asp.Net when implementing Content-Security-Policy header to protect from XSS ?? I read that NONCE was not supported in Asp.Net, however I read another simple article, that shows ...
1
vote
1answer
72 views

How to exploit HTTP Request Smuggling?

I set up the following lab using HAProxy and Gunicorn. Both "Smuggler.py" tool and "HTTP Request Smuggler" BurpSuite extension detected CL.TE vulnerability. I checked it manually ...
1
vote
0answers
63 views

What are NGINX reverseproxy users doing to prevent HTTP Request smuggling?

Since NGINX does not support sending HTTP/2 requests upstream, what are the present NGINX reverseproxy users doing to mitigate HTTP Request Smuggling vulnerability? I understand that the best way to ...
1
vote
0answers
69 views

Security implications of an HTTP POST endpoint that accepts arbitrary HTML and returns it back

For generating PDFs in our web application we have a simple service that accepts a chunk of HTML from the client, wraps it in a standard template, does a couple of simple transforms (like replacing ...
1
vote
0answers
82 views

How following URL's will get open-redirection?

Reading about open-redirection from web application hackers handbook came across a test case in which the server-side is validating user supplied data that the application uses to set target for ...
1
vote
0answers
97 views

OAuth for command line application

I'm planning to add an "official" command line tool for developers to interact with our API. The tool is basically just a glorified curl client, interacting with the API via HTTPS ...
1
vote
0answers
87 views

Intercept HTTP requests for invalid domains in Linux

I am using Ubuntu 18.04. When making a HTTP request to invalid domains, I get a HTML page with javascript code that redirects me to uniregistry a landing page. More specifically, when trying to load ...
1
vote
1answer
437 views

Snort Inline Mode(IPS) Routing Packet Forwarding

I'd like to build an IPS which would be a seperate endpoint than the router and/or protected servers. To achieve this I've installed to my Ubuntu server Snort with DAQ(AFPACKET). The instructions I've ...
1
vote
0answers
91 views

Can server-side caching misconfiguration lead to stolen logins?

If a webapp sends Cache-Control: private it shouldn't be cached for example with nginx proxy_cache. What could happen if it was cached anyhow? Could another visitor see the personalized login of ...
1
vote
0answers
123 views

Why are browsers making PUT requests for static assets on my site?

Our site hosts static assets at /assets/…. In debugging a font-related issue, I looked through our logs for unusual activity. I found a bunch of requests like these method path ...
1
vote
0answers
173 views

Am i being MITMed?

Lately i was experiencing weird behavour from some big websites. More specifically, when i normally tried to connect to facebook, i would be greeted with this login page: I have placed these with ...
1
vote
0answers
990 views

Http Content-Length too long - Time Out

I was recently going through the HTTP Desync attack presented here: https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn This raised one question concerning the way the HTTP ...
1
vote
0answers
141 views

Cross site security for public REST API

This seems a common use case, but I have not been able to find a satisfactory answer. We have a public REST API, which we want 3rd parties to be able to write their own Progressive Web Applications ...
1
vote
0answers
88 views

Security risks on returning encrypted JSON web token without prior authentication

I am architecting a passwordless REST API where public/private keys are the primary form of authentication. In order to create a new session you must prove that you hold the private key to the public ...
1
vote
0answers
102 views

How is Indonesia blocking images in e2ee applications?

Indonesia's minister in communication and informatics supposedly blocked the sending of images and videos through social media from 22nd May until 25th May, in order to prevent hoaxes from spreading ...
1
vote
0answers
164 views

HTTP body E2E encryption protocol

I have 2 servers that communicate each other in HTTP and they are both behind an API gateway. Between the servers and their API gateways the communication is in HTTPS with mutual authentication using ...
1
vote
0answers
72 views

Origin VS Authority and Domain certificates and Unique IPs

Disclaimer, I am new to InformationSecurity, so sorry if I not following rules as good as expected. I asked this post on stackOverflow, and I was suggested to transfer it here So far I get: Origin = ...
1
vote
0answers
363 views

How to bypass NTLM HTTP authentication?

Is there any way to bypass HTTP authentication rather than brute-forcing ?
1
vote
0answers
130 views

Bloom filter to prevent replay attacks in signed HTTP requests

I'm thinking about an authentication sheme of a REST API in a setting where the only thing the server stores about a client, is their public key (the asymmetric encryption scheme should not matter). ...
1
vote
0answers
468 views

Hide data from wireshark on localhost

Assuming you're working with an old network protocol, or insecure/unencrypted protocol (HTTP for example), is there a way to make it difficult for network sniffers from capturing the packets? An MITM ...
1
vote
0answers
129 views

Security of AWS Lambda Communicating to Non-HTTPS API

Wondering what attacks might look like in the following scenario. I have a web service that pings an AWS lambda (behind API gateway), which makes a couple of transactions (sends email, adds to ...
1
vote
0answers
88 views

Why doesn't a CORS preflight request cause another?

According to MDN documentation, every non-simple request is doomed to fall into an infinite recursion: I want to send a non-simple CORS request (with the verb PUT e.g.) My browser tries to send a ...
1
vote
0answers
512 views

THC Hydra false positives on Foscam login

I bought a Foscam C1 Lite this week and I want to try to brute force the login page with THC hydra. But currently I am getting false positives with the following command: hydra -s 88 -l user -P ...
1
vote
0answers
284 views

Invalid certificate error appears on my web server for 10 minutes and then disappears

I have a raspberry pi that hosts a web server and has a DDNS registered through no-ip. I just had an issue connecting to my webserver because a certificate appeared to be installed on this server that ...
1
vote
0answers
1k views

HTTP security headers for native and webview based mobile applications

OWASP Security Headers Project recommends the following security headers for web applications. Out of the following which headers are relevant to mobile applications? HTTP Strict Transport Security (...
1
vote
0answers
143 views

No fields captured in BurpSuite

I am using burpsuite to bruteforce my routers login form, but I have encountered an issue... When I enter something into the password field, BurpSuite shows the request, but not what was entered. For ...
1
vote
0answers
183 views

Is the appearance of "Action Not Found" and a list of tried URIs a security concern in Play?

The Routing in Play documentation has been read and multiple code samples have been run including this one. When one navigates to an unknown URI it returns a list of tried URIs: Expected outcome The ...
1
vote
0answers
213 views

Bizarre HTTP requests to VPS, former malware command and control server?

I just bought a new VPS with Linode. I installed Apache and noticed some very strange behavior that I have been seeing consistently throughout the logs. So basically, I keep receiving stranger HTTP ...
1
vote
0answers
288 views

MAC spoofing under a OPN Access point HTTP does not work

I want to do a demo on the wifi security. So, I have one Wifi router and two client. I configured my router without security (OPN) and with a MAC filter. One of the two client is connected to the ...
1
vote
0answers
79 views

Transmitted sensitive user data

At the moment, I have set up mitmproxy and can record all HTTP/HTTPS communications between the client and server. For research purposes I am looking to find a way to detect potential leakage of ...
1
vote
0answers
289 views

iSniff-GPS: Certificate Verification

iSniff-GPS I came across an interesting sounding project on GitHub, called iSniff-GPS. I decided to check it out, but i experienced some issues when trying to use the web interface. Instructions ...
1
vote
0answers
93 views

Is there a "smart cache" device which provides cache if authorized?

Is there an implementation of a HTTP (or decoded HTTPS) optimization device which would allow for "smart caching" - i.e. the ability to release some cached content (initially transferred by someone ...
1
vote
0answers
104 views

Can user identifying information in Dropbox be derived from subscription data?

I've noticed that my Dropbox installation really loves sending unencrypted information over the net including a "user_id" and it's user-agent. What i want to know is if it's possible at all to ...