We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [http]

Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.

Filter by
Sorted by
Tagged with
0
votes
0answers
34 views

How to deploy your web server's Web Application Firewall while limiting false positives

For objective discussion: We deploy several Web Application Firewalls where I work. I know that one particular on-prem product uses Apache [reverse] Proxy & ModSecurity to match HTTP POST traffic ...
283
votes
3answers
375k views

Why is 'Bearer' required before the token in 'Authorization' header in a HTTP request?

What exactly is the difference between following two headers: Authorization : Bearer cn389ncoiwuencr vs Authorization : cn389ncoiwuencr All the sources which I have gone through, sets ...
31
votes
4answers
5k views

Is it something to worry about when my browser warns me that my connection to 192.168.1.1 (router admin page) is not secure?

I got this "Not secure" warning when I'm trying to log in to my router (it's within my physical access). Apparently my router's management (admin) system doesn't have HTTPS. Chrome also says Your ...
0
votes
0answers
120 views

server logs invalid HTTP_HOST header, Bad request, 400 [duplicate]

I created a Digital Ocean droplet recently, to learn how to make Django app. Eventually they say I should use Gunicorn to serve and Nginx to face the world, however, in very early stage of learning ...
1
vote
2answers
2k views

Can browser bypass hosts configuration file?

for example, assume I have edited the hosts file with the following line: 127.0.0.1 malicious-site.com if I happen to have installed a browser developed by people who owns this malicious website. ...
0
votes
1answer
73 views

What are the risks in returning digitally signed payloads over an insecure HTTP connection?

Let's say I own a service and a client needs me (for the sake of this question) to provide an endpoint over HTTP (not HTTPS) that doesn't use cryptographically secure authentication. Further, there's ...
1
vote
0answers
75 views

Encrypting HTTP Post Data [closed]

How can I encrypt HTTP POST data using symmetric encryption? I know that you can use HTTPS and make your HTTP run over TLS, but is there a way to do that without using HTTPS and how?
-3
votes
2answers
129 views

website security of a domain

There is a website and I want to see if it is secure or not: When I enter the site with the domain address as https://2nate.com/ the browser says that it is secure. But when I enter the domain ...
1
vote
2answers
134 views

Replicate HTTP GET request [closed]

I'm trying to verify an attack called Dahua Vulnerability. In the PCAP I've got: GET /current_config/passwd HTTP/1.1 Host: xxx.xxx.xxx.xxx How can I replicate this attack to show if an attacker got ...
3
votes
2answers
117 views

Is it necessarily Content spoofing if the content type of the response does not match the content type of the request?

The security team of my company is stating that content spoofing occurs when they send a different "content-type" for an HTTP request that only accepts JSON content type, and the server response is an ...
-2
votes
1answer
335 views

HTTP POST Request Encryption [duplicate]

I have a client and a server that exchange information with each other and i want to encrypt the contents of the POST request? What kinds of encryption are supported by the HTTP Post request? Thanks
0
votes
0answers
89 views

Renewing self signed SSL cert without updating client

I have a server and a single client. I have full control of both, the client is not a distributed application used by the public. For various reasons, I'm having the client use HTTPS to communicate ...
2
votes
3answers
4k views

Is it more secure to close port 80 and leave port 443 open

I believe that this question is not duplicate of the following question. This is because the answer provided to that question only focus on user experience, while my question focus purely on security. ...
1
vote
1answer
131 views

Is it possible to intercept HTTPS payload with a trusted CA but send it the wrong server?

I have a CA generate a cert and private key for my server. My server, however, does not have a domain name and its IP is dynamic and never static therefore validation of the host name must be ignored ...
0
votes
2answers
178 views

How to check Google SSL certificate?

I encountered this error on Google Chrome on my Windows 10. I solved it by installing the certificate and now it is working fine. I wonder, how do I know the certificate I have is legit? That is, ...
12
votes
4answers
19k views

What information can my ISP see when I visit a website? [duplicate]

For example, when I enter this URL: https://www.google.com/search?q=example or http://www.google.com/search?q=example I can see the word example that I was searching on Google. Can the ISP see this ...
0
votes
1answer
431 views

SameSite cookie attribute and Synchronizer Token Pattern

Recently most browser have added support to the SameSite cookie attribute to prevent CSRF attacks: https://www.owasp.org/index.php/SameSite Question if it is supported should we implement ...
0
votes
0answers
56 views

Secure https communication between two applications on same system

I have two applications running on the same computer. These applications need to communicate with each other. One application acts like a server and the other like a client. Client <-> Server ...
0
votes
2answers
74 views

Why is the SSL message red?

The site Phonel.ir uses a SSL certificate. Why is the Error message in red? Is there a problem with the SSL certification? I sometimes use a proxy. Can that be the reason?
0
votes
1answer
53 views

HSTS mixed with HTTP resources

We have a container site which implements HSTS and a video sharing site which is using HTTP only and doesn't have TLS implemented, nor will it. How does one avoid mixed content in container site and ...
5
votes
3answers
57k views

How to add X-Frame-Options header to a simple HTML file?

I am having trouble adding X-Frame-Options header to a simple HTML file. Is there any way to do it using JavaScript?
2
votes
2answers
2k views

Why do browsers disallow accessing files from local file system even if the HTML document is also on the local file system?

Many browsers do not allow you to access files on the local filesystem with JavaScript (even if the HTML document is also on the local filesystem). (source) Yes I know that the solution is to "...
1
vote
1answer
100 views

What kind of redirect of websites is this? [closed]

Some websites can redirect you, but they're not using http 301 or 302. After that the url will be changed and you can't go back to the previous page using your web browser's back button. For example, ...
19
votes
3answers
954 views

Meaningless http request

We've been logging GET requests on our domain to the following: XX/YY/ZZ/CI/MGPGHGPGPFGHCDPFGGHGFHBGCHEGPFHHGG This has no meaning on our site. A search on the web revealed no information, but a few ...
9
votes
2answers
3k views

Websites that interactively test browser security (XSS, CSRF, Javascript, etc)

I'm looking for a comprehensive list of browser test sites so that I can visually prove that the browser is patched and configured for safe web browsing. My intent is to know what risks may exist ...
10
votes
3answers
1k views

HTTP Content-Security-Policy Nonce and Caching

Is anyone here able to clarify how caching affects adding a nonce=value to all inline javascript? If the nonce must be unique and unpredictable, then one would need to disable all server-side (i.e. ...
3
votes
1answer
43 views

Is self signed certificate secure for personal use if verified before access? [duplicate]

I made a simple streaming server with self signed certificate. Is it secured enough if I manually check my certificate? My server also has password.
3
votes
5answers
16k views

What is a typical response from webserver for POST request?

My web server is returning a 200 OK after submitting a POST request, but it does not seem to be a good idea according to a security team. It should return a 302 "Object Moved", so that it avoids ...
1
vote
0answers
22 views

Is HSTS necessary or can I just write .htaccess code to always redirect http to https? [duplicate]

Is HTTP Strict Transport Security (HSTS) necessary or can I just write regular .htaccess code to always redirect http to https?
1
vote
0answers
35 views

Origin VS Authority and Domain certificates and Unique IPs

Disclaimer, I am new to InformationSecurity, so sorry if I not following rules as good as expected. I asked this post on stackOverflow, and I was suggested to transfer it here So far I get: Origin = ...
1
vote
1answer
149 views

Internal HTTP(s) vulnerabilities

We use Rapidfire + network detective where I work, for doing non-intrusive internal scans on all of our clients' networks. Every week; half of the tickets I get for this are port 80/443 ...
-1
votes
1answer
39 views

If I send request with PUT, and server return valid page with 403 status. This is correct work? [closed]

I send PUT. Server returned 301 status to valid http-address(!), but next response 403 status to hhtp-address. If I copy/paste this address all works correct. Please, say me: this is correct response ...
1
vote
1answer
298 views

Is there an any risk with HTTP header value reflection?

This website has a header in the request (If-None-Match) and whatever you set the value to for it, the response will contain a header (ETag) with the value of the If-None-Match header. I understand ...
0
votes
1answer
115 views

Which HTTP Compression should I use (and how?)

I know that there are multiple HTTP Compression tools out there. In order to entirely prevent a site from being susceptible to BREACH, which HTTP Compression algorithm should I use? Also, how ...
4
votes
3answers
7k views

Addressing 'body parameters accepted in query' vulnerability

I received a failure on a vulnerability assessment because a heuristic determined I was probably processing query string parameters as form values (they used the words 'body parameters'). I think ...
1
vote
3answers
418 views

How to prevent unauthorized users from accessing an image on my server just by URL?

I have a few dynamically generated images on my server (of high business value), which are supposed to be viewed only via our mobile app. The image is simply loaded from the URL as PNG. How can I ...
1
vote
1answer
3k views

Intercept traffic other than port 80 and 443 on burp suite

I am trying to intercept traffic on port 8000. For example my application is running on abc.com:8000. I am unable to intercept this traffic on burp suite. How can I intercept this traffic in Burp?
1
vote
0answers
216 views

How to bypass NTLM HTTP authentication?

Is there any way to bypass HTTP authentication rather than brute-forcing ?
0
votes
1answer
447 views

NIKTO: Requires Authentication for realm ''MD5''

I am trying to perform a scanning of a web server using Nikto using: nikto -id id:pass -h xxx.xxx.xx.xxx I am specifying HTTP Basic authentication credentials and indeed with this credentials I can ...
3
votes
1answer
241 views

How do I make safe login-emails? (GET/POST) [duplicate]

Vision I envision a login/signup-system, where the user enters his/her email, and receives an email with a link to sign in. The user clicks the link, and is automatically signed in (confirming the ...
3
votes
1answer
204 views

Why does not Referer header use “same-origin” by default?

Same origin policy is an important part of the security model so it is "on" by default for most things, but for the referer it does not seem to be so. The default for browsers seem to be no-referrer-...
0
votes
2answers
285 views

Does HTML Purifier (which converts & to &amp;) prevent HTTP parameter pollution?

If a REST endpoint (http://example.com) reads the p query parameter and pass it along to another endpoint: http_get("http://example.com/api2?p=".$_GET['p']); I will be able to exploit it by ...
81
votes
9answers
88k views

Can my company see what HTTPS sites I went to?

At work my company uses internet monitoring software (Websense). I know if I visit a https ssl-encrypted site (such as https://secure.example.com) they can't see what I'm doing on the site since all ...
2
votes
1answer
297 views

Phishing email with encoded url params

I received a phishing email with the following format: hxxp://<%legitimateSite%>/~!@%23$%25%5e&()_+~!@%23$%25%5e&()+~!@%23$%25%5e&*()+~!@%23$%25%5e&()_+~!@%23$%25%5e&()+~!@%...
27
votes
10answers
14k views

How to secure passwords over HTTP?

Say my password is abc. I want to send it to the server over HTTP. I could send it in plaintext and let the server hash it and compare it to the entries in its database, but then anyone that can see ...
0
votes
1answer
127 views

For servers that are not internet facing, do they need to be authenticated to each other and should their communication be over HTTPS? [duplicate]

My gut instinct is that best practice would be to ensure that all internal servers communicate over HTTPS and that all servers are authenticated to each other. That would indeed be dream case ...
3
votes
2answers
619 views

Is this possible with SSLsplit?

SSLsplit supports plain TCP, plain SSL, HTTP and HTTPS connections over both IPv4 and IPv6. For SSL and HTTPS connections, SSLsplit generates and signs forged X509v3 certificates on-the-fly, based on ...
0
votes
2answers
371 views

Locale detection & huge Accept-Language header, can this be considered an atack vulnerability?

I was looking for some examples of automatic locale detection as I needed to do the same in my PHP app. Most of the answers I found were similar, only differing in the parsing methods. An example '...
7
votes
3answers
359 views

Does the Content Security Policy header provide a false sense of security if a page is served over unencrypted HTTP?

I have been thinking about how a developer restricted (for whatever reason) to serving an unencrypted site might protect themselves from threats such as overzealous ISPs injecting ads or notifications ...
0
votes
0answers
67 views

TRACE method returns GET

XST is a well known vulnerability and the reason that everyone always alerts: TRACE is allowed this is bad. But what I see often at clients is that a request using TRACE returns the same as a GET. Am ...