Questions tagged [http]

Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.

Filter by
Sorted by
Tagged with
18
votes
8answers
1k views

Ways to secure yourself from Firesheep kiddies and other sniffing

Just a few days ago I had my first encounter with Firesheep. Luckily I was the one using it. Well, it scared me into looking for ways to secure myself. So I have two questions: In exactly what ...
21
votes
4answers
3k views

Credit card forms on HTTP pages a MITM risk?

The other day, there was a web developer mailing list thread about a fundraiser page. One person noted that the page with the credit card form was HTTP, not HTTPS. In response, one person said that ...
6
votes
3answers
4k views

What stops a hacker from installing its own CA certificate?

Taking a look at this (now rather old) article about the generated rogue DigiNotar certificates, it states the following: ...Such is the case with that small company in the Netherlands, DigiNotar....
15
votes
5answers
26k views

Can I block based on MAC address?

If I block an IP, the attacker can work around the block by taking a new IP or use a proxy. Is it possible to make a ban based on MAC address? I want to block at the webserver level so that unwanted ...
8
votes
1answer
799 views

Inconsistencies found in OpenID Provider's HTTP Headers. Which one is the most secure that I should imitate in my STS, and Relying Party?

I'm comparing the HTTP headers of the various providers (LiveID, Google, Yahoo, etc) and notice a broad inconsistency in implementation on the sign in page, sign out page, and subsequent pages. ...
10
votes
7answers
10k views

Is it compulsory to have https on e-commerce site?

I saw that some e-commerce scripts can also run without ssl, but everyone recommends to activate it to protect sensitive data. I just saw a site that has an e-shop link, if i click it my browser says ...
6
votes
2answers
6k views

Exploiting HTTP content in HTTPS page [closed]

I recall hearing there is a range of attacks one can mount against a page which mixes HTTP and HTTPS loaded content (say, https://Secure-Site.com loading an image from http://Not-A-Secure-Site.com) ...
3
votes
1answer
8k views

Is HTTP to localhost safe? [duplicate]

Google is reportedly planning to make Chrome report all web site connecting using http:// as unsafe. But is this really true if the host in question is localhost and the server is only listening for ...
3
votes
0answers
355 views

Ensuring an HTTP request is coming from my program

Is there a way to ensure that an HTTP request to my REST server is coming from my application? I'm guessing no because whatever I do on the client side, as people have access to that code, they can ...
2
votes
3answers
7k views

Is it possible to list folder from my web server if i have an empty index.html in the root folder?

I have a small mongoose web server installed on my machine. I have a empty index.html in the root directory. I want to be able to share link with people i know, by creating a folder that look like ...
1
vote
3answers
1k views

Can man-in-the-middle attacks affect anyone not connected to the attackers network?

I'm trying to understand what these attacks are restricted to. I'm aware that man-in-the-middle attacks can be done if the attacker is on the same network (using something like Wire Shark), but is it ...
151
votes
4answers
23k views

Which security measures make sense for a static web site?

I have a static web site. Users cannot log in or perform any other actions. Which of the common HTTP security measures make sense for my site? Do I need any of these? HTTPS Strict transport security ...
236
votes
5answers
146k views

What is the difference between https://google.com and https://encrypted.google.com?

Is it there any difference between the encrypted Google search (at https://encrypted.google.com) and the ordinary HTTPS Google search (at https://google.com)? In terms of security what were the ...
110
votes
6answers
23k views

Why should I offer HTTP in addition to HTTPS?

I am setting up a new webserver. In addition to TLS/HTTPS, I'm considering implementing Strict-Transport-Security and other HTTPS-enforcement mechanisms. These all seem to be based on the assumption ...
27
votes
5answers
23k views

Can someone using Wireshark obtain the full URL if my program uses HTTPS?

While perusing the contents of pcap files I've noticed some URLs appear to be visible despite being HTTPS. These mainly occur inside payloads that contain cert URLs too, but I also see HTTPS URLs ...
45
votes
1answer
94k views

Why does HTTP Basic authentication encode the username and password with base64?

RFC 2617 requires that in HTTP Basic authentication, the username and password must be encoded with base64. To receive authorization, the client sends the userid and password, separated by a ...
28
votes
4answers
4k views

Manually adding 's' to 'http'

I did a Wireshark capture of my login into a drupal-based website. The website does not use https. And so, quite obviously, I was able to capture my username and password in plain text by simply ...
26
votes
4answers
6k views

Understanding HTTP GET attack requests

I have captured some web attacks. I am trying to understand what purpose does each attack request achieve. GET /site/public/timing?<!+XSS="><img+src=xx:x+onerror=alert(14721850.00337)//"> ...
24
votes
2answers
41k views

Specific risks of embedding an HTTPS iframe in an HTTP page

I need help listing the specific risks of embedding an HTTPS iframe that enables credit card checkout inside of an HTTP page. Are there security issues with embedding an HTTPS iframe on an HTTP page? ...
16
votes
2answers
24k views

Securing remotely accessible IP cameras that do not support HTTPS

I have some IP cameras set up on my home network, which is WPA2 protected. These cameras are setup to be accessible from the Internet thru my router's DDNS address, and port number. So for example, ...
28
votes
6answers
27k views

Is it a good practice to show 403 unauthorized access error to user?

Whenever we see a 403 forbidden access error page we think we have got to a place where some secret or private data is present. Now at this point bad guys know that this might be of interest and start ...
20
votes
1answer
5k views

Strict Transport Security — max_age value

I've been wondering what max-age should the HTTP Strict Transport Security header have. Both paypal and lastpass sites leave it very low: 500 (seconds = bit over 8 minutes) market.android.com has it ...
18
votes
3answers
4k views

What is the point of the same-domain rule for xmlhttprequest when script tags/JSONP can cross domains?

I get that I don't want a page loaded from stackoverflow.com to be able to request gmail.com on my behalf and read my email--but this seems to be simply a cookie issue. Since JSONP bypasses same-...
11
votes
2answers
11k views

How to thwart sslstrip attack?

I need help understanding the dynamics of an sslstrip attack. I'm using it to test the security of a site that I own. I can successfully sniff the victim (in this case, myself) credentials over the ...
11
votes
1answer
2k views

Should I include a random padding in every HTTPS request and response?

According to the following paper, it is possible to decrypt HTTPS traffic by inspecting AJAX calls and using the size parameter as a cryptographic oracle. Should I be sending a variable length ...
8
votes
1answer
2k views

What are the security implications of enabling a SNI-hole on a web server?

A web server (let's say Apache 2.4) implements SNI. It is configured with a 4096 bit SHA384-signed Wildcard Certificate (*.land.org) with a Subject Alternative Name (land.org). The Certificate ...
9
votes
3answers
16k views

GET and POST request vulnerable to CSRF attack?

Are both GET and POST request vulnerable to CSRF? Should we use PUT instead?
14
votes
3answers
1k views

Why for some SSL websites browsers show extra info, while for others dont

While visiting some https websites (like online banks, etc) url string appear to have little extra green box on the left hand side, with some organisation details. While other https websites just ...
12
votes
2answers
5k views

Is an HTTP 301 redirect to HTTPS, insecure?

For a website, I force a 301 redirect from http://login.example.com to https://login.example.com using a .htaccess file. As I read in this question this still imposes a security threat. I'm wondering ...
8
votes
3answers
4k views

How is HTTPS/SSL able to hide destination website that one is connecting to?

I understand how it is able to create a secure connection via the handshake, but how is it able to initiate a secure connection without first sending an unencrypted request, thus revealing the ...
28
votes
5answers
18k views

Can a secure cookie be set from an insecure HTTP connection? If so, why is it allowed?

With reference to some security paper I read, I found out that a cookie with the secure flag set can only be sent by the client over connections that are using HTTPS, not HTTP, but the cookie itself ...
10
votes
2answers
1k views

When are HTTP session cookies at risk over Wi-Fi?

If I'm using websites that do not use HTTPS, but I'm on a WEP-protected Wi-Fi network, are my cookies safe from being sniffed by third-parties? Are cookies only at risk during login, or am I at risk ...
8
votes
8answers
6k views

Risks of using HTTP when I trust the local network

What are the risks of using HTTP instead of HTTPS assuming that there isn't any rogue hacker sitting on my personal WiFi network waiting to sniff my traffic? Can a hacker sit in his boat in the ...
7
votes
4answers
7k views

Does http support encryption without https (like STARTTLS)?

Does http support encryption without https, akin to STARTTLS in smtp? This may sound like a stupid question, but just think about it. Banks require strong encryption, and cannot do business without ...
6
votes
7answers
5k views

Should I prevent sending of GET requests for urls that are normally operated with POST request?

There is an url that is normally operated using POST requests (i.e. POST request is sent when user submits form). But attacker can form GET request with parameters that are sent in POST request. This ...
4
votes
2answers
1k views

Are MITM attacks possible on HTTP loopbacks?

I have a web server running at example.com. The web server performs a server-side request to example.com which results in a loopback, so the request never passes over the network. Is this request ...
4
votes
3answers
2k views

Is a company website secure against sslstrip if it doesn't use ssl on homepage but ssl everywhere else?

Most ecommerce websites use SSL/TLS when you want to log. But most have homepage using http only. Is it enough to have SSL/TLS on login page and logged page to prevent sslstrip ?
6
votes
3answers
2k views

How much does a GET request over HTTPS reveal to an eavesdropper

Correct me if I am wrong, according to HTTP v1.1 a simple CONNECT request initiates a SSL tunnel between the server and a client. its only after the tunnel is created that the complete GET or POST ...
6
votes
3answers
22k views

How can I control the content of the HTTP HOST header in requests issued from my website?

Is anyone familiar with a way in which I can post a link on my website, that when accessed will cause users to issue an HTTP request to a 3rd party site with custom content in the HOST header (...
5
votes
3answers
5k views

NGINX Hacking Attempt

Every time I start my test-server and let it run for some days I get this in my log-files (in different variations): 111.241.26.165 - - [18/Feb/2014:22:16:45 +0100] "\x04\x01\x00\x19\xCBER!\x00" 400 ...
4
votes
2answers
2k views

When is an intermediate page needed before directing a user off my primary website? What is the best implementation?

The NSA has a page that intercepts redirections off the primary site. (click "TLS: "Suite B Cipher Suites for TLS," RFC 5430" for an example). I've seen this used in Exchange Outlook Web Access (...
4
votes
3answers
2k views

Does HTTPS encrypt metadata?

Does HTTPS encrypt metadata? Not Necessarily what is on the page, or ads or anything like that, but it is possible for someone else to know metadata i.e what the tab is called or just the website ...
3
votes
1answer
3k views

If I connect to VPN through proxy, who can see what?

I try to understand what happens when I use an HTTP(S) proxy in my OpenVPN client configuration. What's the advantage of an HTTPS proxy over plain HTTP? In any case the encryption takes place on the ...
2
votes
1answer
832 views

How to check whether a link is safe or not? [closed]

I've been working on a task to find threats in a social network called Skyrock. For which, I've managed to retrieve a significant amount of URLs by crawling various user profiles and parsing the data ...
2
votes
1answer
2k views

Flaw in HTTP Digest Authentication

I am working through my textbook and I came across this question: Below is the message format for a browser response to access a password-protected web page using HTTP digest authentication. GET URI ...
11
votes
1answer
1k views

Brotli compression for HTTPS

It appears that Chrome, Firefox, and soon Edge, support the new Brotli compression algorithm over HTTPS only. I can't find anything on whether this new compression algorithm is susceptible to the ...
11
votes
3answers
401 views

How to prevent popping up a login dialogue using a malicious hotlinked image and HTTP Basic Auth header?

While using Firefox to browse my forums, I noticed that a malicious user posted an image (via hotlinking, not by uploading to my server) with the extension .png which complies with the forum rules (...
7
votes
4answers
3k views

Is information disclosure in a form of a server header a real vulnerability?

I have seen in many places that people say that headers of the following types is a vulnerability: Server:Microsoft-IIS/7.5 X-AspNet-Version:4.0.30319 X-Powered-By:ASP.NET I can see that this gives ...
7
votes
1answer
282 views

Are there any situations when one can only mount a passive MITM?

This came up while discussing Web & insecure HTTP - Using RSA for encrypting passwords on the client side Is there any such situation possible when requesting an HTTP page where an attacker is ...
5
votes
3answers
2k views

Can serving HTTPS to Internet Explorer on Windows XP be made secure?

Answers to Why is HTTPS not the default protocol? state that a lot of sites still use clear HTTP instead of HTTPS because all of these are true: A substantial number of visitors to the site use ...