Skip to main content

Questions tagged [http]

Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.

113 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
6 votes
1 answer
3k views

Is HTTP header Permissions-Policy worth using if no features are used?

From the spec at https://www.w3.org/TR/permissions-policy-1/ it seems there is no way to whitelist features with a default blacklist, and each feature must be individually disabled in every single ...
captainmish's user avatar
4 votes
0 answers
184 views

Why are HMAC signatures frequently used for webhook authorization but not other HTTP API requests?

HMAC signatures are very commonly used for webhook authorization from service to consumer. Examples: Stripe Slack Twilio Twitter GitHub and hundreds and hundreds more. This seems a near universal ...
Paul Draper's user avatar
  • 1,010
4 votes
0 answers
782 views

Is an out-of-band request via DNS by abusing the X-Forwarded-For header exploitable

By changing the X-Forwarded-For header in a request, I am able to have it sent an OOB interaction with Burp Collaborator requesting a DNS lookup of type A. Is there any risk to this vulnerability or ...
Lieven Keersmaekers's user avatar
4 votes
0 answers
160 views

WiFi Fingerprinting RFC2617 Linux Device Cannot Unauthenticate Unless AP Password Changes

There is a Cisco WiFi Access Point in the office that is intended for guests. It is an open network in that you can associate without providing a password with the SSID. It supports RFC2617 and so the ...
PhilBot's user avatar
  • 141
4 votes
0 answers
148 views

Cross Origin Resource Sharing question

I have some mockup html/javascript on my desktop, I made an ajax GET call to: http://www.bungie.net/platform/Destiny/TigerPSN/Account/4611686018429149347/Character/2305843009215132906/Activities/ ...
Robert Fralin's user avatar
3 votes
1 answer
603 views

How to exploit HTTP Request Smuggling?

I set up the following lab using HAProxy and Gunicorn. Both "Smuggler.py" tool and "HTTP Request Smuggler" BurpSuite extension detected CL.TE vulnerability. I checked it manually ...
mehran_2020's user avatar
3 votes
0 answers
562 views

OAuth for command line application

I'm planning to add an "official" command line tool for developers to interact with our API. The tool is basically just a glorified curl client, interacting with the API via HTTPS ...
Moritz Friedrich's user avatar
3 votes
0 answers
4k views

how to fix Out-of-band resource load (HTTP) issue identified by BURP scan

I have Salesforce application which is using my web application hosted in one of our customer's server (IIS 8.0). BURP Scan has identified one issue in my web application. Issue is something like ...
rakesh's user avatar
  • 31
2 votes
0 answers
96 views

How to retrieve TLS unique value from Apache?

TLS unique value is present in TLS 1.2 version. In Golang, I can get the value of the TLS unique value from the http response through the field TLS. I'd like know how I can get it from Apache. Is ...
MoBe's user avatar
  • 21
2 votes
0 answers
650 views

What are NGINX reverseproxy users doing to prevent HTTP Request smuggling?

Since NGINX does not support sending HTTP/2 requests upstream, what are the present NGINX reverseproxy users doing to mitigate HTTP Request Smuggling vulnerability? I understand that the best way to ...
Sai Vishnu's user avatar
2 votes
0 answers
143 views

http smuglling how can i do a poc in a big websites?

i try to find http smuggling in big bug bouny program if i send this to the server POST /path HTTP/1.1 Host: subdomain.domain.com User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 ...
eyal's user avatar
  • 73
2 votes
0 answers
143 views

Is the HTTPS lock sign displayed if reasources are loaded from insecure sites?

We all know that if you visit a secure site which uses https, all modern browsers will show a padlock sign if it has a CA certified certificate. My questions are: Suppose there is an image loaded in ...
SRaj's user avatar
  • 155
2 votes
1 answer
2k views

Snort Inline Mode(IPS) Routing Packet Forwarding

I'd like to build an IPS which would be a seperate endpoint than the router and/or protected servers. To achieve this I've installed to my Ubuntu server Snort with DAQ(AFPACKET). The instructions I've ...
TheSoulkiller's user avatar
2 votes
0 answers
945 views

HTML Injection to blind SSRF testing retrieves only DNS Query

I recently came across an application that was vulnerable to HTML injection on the invite function. When I insert <img src="image.jpg"> the image got rendered on the mail I received. I ...
None_None's user avatar
2 votes
0 answers
1k views

Unable to start reverse shell over HTTP

I am able to get a reverse shell working locally over TCP, but failing to trigger it remotely over HTTP. Locally over TCP: Attacker terminal runs netcat to listen for a connection over port 8000: nc -...
NattyP's user avatar
  • 21
2 votes
0 answers
250 views

Bruteforce https post using single tcp connection

So I've tried bruteforcing my server using thc-hydra's https-post-form, but it floods the server very quickly and the requests start timing out. However, If I go through the browser where the HTTP ...
Sam's user avatar
  • 21
2 votes
1 answer
2k views

Bettercap 2.x SSLStrip Is Not Converting Links

I have the latest version of bettercap. I have the latest version of Kali Linux using the latest version of VirtualBox on the latest version of Windows 10. My target machine is the latest version of ...
user21303's user avatar
  • 163
2 votes
0 answers
842 views

Random Alphabetical String Added to URL

I originally asked this question over at Stack Overflow, but someone there suggested asking here because it might be possible that something malicious may be causing the following issue: Users have ...
user138172's user avatar
2 votes
0 answers
8k views

Prevention of host header injection in ASP.NET?

How can we mitigate host header injection in ASP.NET? I have already configured application binding in IIS and set static hostname but still, the vulnerability exists.
codeur's user avatar
  • 601
2 votes
0 answers
94 views

Concerns when passing all OPTIONS requests through authorization proxy gateway

I have a React based application which uses RESTful services on backend distributed on private network. To communicate with such services using AJAX, client application sends all its request through ...
Kunok's user avatar
  • 121
2 votes
0 answers
298 views

Assymetric auth like AWS4-HMAC-SHA256

I wondered if there exists a defined mechanism similar to AWS4-HMAC-SHA256 (as a scheme in Authorization HTTP header), but using asymmetric algorithm, probably ed25519, and how secure it would be to ...
Petar Donchev's user avatar
2 votes
0 answers
842 views

HMAC authenticated API calls with multipart/form-data file uploads

We have an existing API where 3rd parties can push data. The API calls are authenticated with HMAC using the same scheme as described in Ruby's ApiAuth library which I use to verify signed requests. ...
DiegoSalazar's user avatar
1 vote
1 answer
47 views

Does the CORS asteriks / wildcard include both encrypted and unencrypted origins?

Does the CORS asteriks / wildcard (*) include both encrypted (https) and unencrypted origins (http)? And is the null origin (i.e., when a local file is doing a xmlhttprequest, or within an iframe ...
Booger21's user avatar
1 vote
1 answer
79 views

Execution profile for web server

I would like to know if there is a way to run an app to exhaustion in terms of all possible outcomes that it can provide. What do I mean by that: Let's assume that someone has an (Apache) HTTP Server. ...
und3rd06012's user avatar
1 vote
1 answer
133 views

Is it reasonable to have a product that requires LLMNR or mDNS?

I am trying to figure out the best way to manage security certificates for embedded devices who's webpage is accessed via IP address, and then the scenario for when that IP address changes. Currently, ...
StrangerDanger's user avatar
1 vote
0 answers
2k views

Best port to setup Outline VPN for obfuscation

Many outline access keys use a random port but some do 443, I’ve found out since port 443 is for http its harder to find out that port is using a vpn. So the question is, why don’t other Outline ...
Emily1001's user avatar
1 vote
2 answers
798 views

How easy is it for hackers to intercept http traffic between VPN exitnode and the destination web service without being inside the VPN or web server?

Let’s say I’m using http connection over a properly set up VPN with secure protocol and implementation. Then, most likely, the connection will be secure all the way until it exits the VPN server. But ...
Insnyt's user avatar
  • 11
1 vote
0 answers
212 views

Why is it a security concern to modify http.sys registry entries to allow web service to accept a longer query string?

I have an Http web service running on IIS. The Http service will be exposed to the public internet, but only authenticated client requests will be processed by the web service. The service allows ...
hpatel's user avatar
  • 11
1 vote
0 answers
157 views

When passing through SSL from web server A to web server B (via nginx), does web server A need SSL configured as well, or just web server B?

I'm using nginx here as an example, but this is really more of a conceptual question about SSL termination and TCP that could apply to any web server. Basically, if web server A receives TCP traffic ...
Paul Z's user avatar
  • 111
1 vote
0 answers
359 views

CSRF and XSS Protection with a Static Site and REST API

I'm building an application which will support both browser and application access to REST resources. Applications will POST a username/password JSON body to a login endpoint which will return a ...
Naftuli Kay's user avatar
  • 6,793
1 vote
0 answers
116 views

Security implications of an HTTP POST endpoint that accepts arbitrary HTML and returns it back

For generating PDFs in our web application we have a simple service that accepts a chunk of HTML from the client, wraps it in a standard template, does a couple of simple transforms (like replacing ...
SystemParadox's user avatar
1 vote
0 answers
127 views

How following URL's will get open-redirection?

Reading about open-redirection from web application hackers handbook came across a test case in which the server-side is validating user supplied data that the application uses to set target for ...
Mohit's user avatar
  • 11
1 vote
0 answers
601 views

Should I strip the "Origin" header from client requests?

I'm trying to setup an nginx reverse proxy to a web product I can't modify (it's an appliance). Client --> https://myapp.com --> nginx --> https://10.1.5.9 I managed to do so, but it ...
AoA's user avatar
  • 11
1 vote
0 answers
154 views

Intercept HTTP requests for invalid domains in Linux

I am using Ubuntu 18.04. When making a HTTP request to invalid domains, I get a HTML page with javascript code that redirects me to uniregistry a landing page. More specifically, when trying to load ...
nwarp's user avatar
  • 207
1 vote
1 answer
565 views

HTTP Headers: Document Policy vs. Permissions-Policy/Feature-Policy

I'm checking the options to harden my web app by setting the appropriate HTTP headers. Besides the Content Security Policy (CSP) there are two another approaches: Document Policy and Permissions-...
Mike's user avatar
  • 113
1 vote
1 answer
703 views

Intensive 586 (ms-shuttle) port scan/exploit/hacking attempts

Recently i wanted to play a bit with TCP/UDP networking (and touch some custom HTTP server impl) on C# and found out that i'm getting requests from totally unknown dudes, such as this one: FROM: [::...
Busy Shader's user avatar
1 vote
1 answer
4k views

How to Spoof JA3 Signature?

I am using python requests library to make HTTP calls. However website bot detection is using JA3 fingerprint verification and blocking me. Is there any way I can spoof the JA3 signature.
Ditti's user avatar
  • 11
1 vote
0 answers
136 views

Can server-side caching misconfiguration lead to stolen logins?

If a webapp sends Cache-Control: private it shouldn't be cached for example with nginx proxy_cache. What could happen if it was cached anyhow? Could another visitor see the personalized login of ...
adrelanos's user avatar
  • 764
1 vote
0 answers
159 views

Why are browsers making PUT requests for static assets on my site?

Our site hosts static assets at /assets/…. In debugging a font-related issue, I looked through our logs for unusual activity. I found a bunch of requests like these method path ...
James A. Rosen's user avatar
1 vote
0 answers
142 views

Is there a way to limit cookies to certain hosts in HTTP?

Using Nginx, I hope to restrict the permissible hosts for cookies. My initial intention was to employ a Content Security Policy for this purpose, but I don't see an obvious way to do this via a CSP. ...
Alex V's user avatar
  • 200
1 vote
0 answers
269 views

Am i being MITMed?

Lately i was experiencing weird behavour from some big websites. More specifically, when i normally tried to connect to facebook, i would be greeted with this login page: I have placed these with ...
user1584421's user avatar
1 vote
1 answer
257 views

Security Considerations To Account for When Redirecting From Microservice to Another

I am evaluating the above service design where I want to have mechanism to pass a user through multiple microservices. In this simple example, the user goes through a sign-up process and once done, ...
Mojo's user avatar
  • 121
1 vote
0 answers
2k views

Http Content-Length too long - Time Out

I was recently going through the HTTP Desync attack presented here: https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn This raised one question concerning the way the HTTP ...
KB303's user avatar
  • 433
1 vote
0 answers
185 views

Cross site security for public REST API

This seems a common use case, but I have not been able to find a satisfactory answer. We have a public REST API, which we want 3rd parties to be able to write their own Progressive Web Applications ...
Keean Schupke's user avatar
1 vote
0 answers
128 views

Security risks on returning encrypted JSON web token without prior authentication

I am architecting a passwordless REST API where public/private keys are the primary form of authentication. In order to create a new session you must prove that you hold the private key to the public ...
Carl's user avatar
  • 111
1 vote
0 answers
140 views

How is Indonesia blocking images in e2ee applications?

Indonesia's minister in communication and informatics supposedly blocked the sending of images and videos through social media from 22nd May until 25th May, in order to prevent hoaxes from spreading ...
Zafir's user avatar
  • 11
1 vote
0 answers
228 views

HTTP body E2E encryption protocol

I have 2 servers that communicate each other in HTTP and they are both behind an API gateway. Between the servers and their API gateways the communication is in HTTPS with mutual authentication using ...
Fabio's user avatar
  • 121
1 vote
0 answers
123 views

Origin VS Authority and Domain certificates and Unique IPs

Disclaimer, I am new to InformationSecurity, so sorry if I not following rules as good as expected. I asked this post on stackOverflow, and I was suggested to transfer it here So far I get: Origin = ...
pGrnd2's user avatar
  • 11
1 vote
0 answers
567 views

How to bypass NTLM HTTP authentication?

Is there any way to bypass HTTP authentication rather than brute-forcing ?
Benassin's user avatar
1 vote
2 answers
298 views

Bloom filter to prevent replay attacks in signed HTTP requests

I'm thinking about an authentication sheme of a REST API in a setting where the only thing the server stores about a client, is their public key (the asymmetric encryption scheme should not matter). ...
Rafael Korbas's user avatar