Questions tagged [http]

Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.

Filter by
Sorted by
Tagged with
5
votes
3answers
3k views

How can I defend against malicious GET requests?

My server is getting hit with a variety if requests like the following: Started GET "/key/values" ActionController::RoutingError (No route matches [GET] "/key/values") Started GET "/loaded" ...
5
votes
1answer
10k views

Working of SSH connection through Proxy

I have to configure my web browser's proxy to 172.18.10.1:3128 every time I want to connect to internet from my college. Since I'm configuring a web browser's proxy, I believe that the proxy is a "...
4
votes
1answer
1k views

Why do Browsers warn about self-signed certificates but not about plain HTTP (which is not even encrypted)? [duplicate]

Let's keep it short: On HTTP everyone can listen easily. MITM attacks are no problem. On HTTPS (self-signed) everything is at least encrypted, it's much harder to MITM-attack and only private key ...
3
votes
1answer
831 views

Force https without 301

For my website's .htaccess I currently have: RewriteCond %{HTTPS} !=on RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301] So that when someone visits the page over http they get a 301 ...
3
votes
2answers
3k views

Signed request vs HTTP digest auth for API authentication?

By signed request I mean something like this (simplified example): Client creates a sig in his request: $sig = hash('sha256', $api_key.$data); which generates 7409ur0k0asidjko2j for example. He then ...
2
votes
3answers
2k views

Does HTTPS encryption work when there is invalid or there is no certificate?

When I have a website run on https and there is no certificate, there is wrong certificate or out of date like here does encryption still work or not?
0
votes
1answer
2k views

advantages of http basic authentication over token-based (e.g. oauth2)?

I am interested in the question if there are any possible advantages to securing a given REST API for web clients and mobile apps with http basic authentication (over https of course) over a token-...
9
votes
2answers
2k views

Is this GET request an exploit attempt?

I've noticed a few requests like this to a Rails application I am maintaining: GET http://mydomain.com/?f=4&t=252751+++++++++++++++++++++++++++++++++++++++++Result:+%E8%F1%EF%EE%EB%FC%E7%F3%E5%EC+...
9
votes
3answers
2k views

Are future TLS versions going to prevent traffic inspection?

Nowadays it is possible to inspect (unencrypt) TLS (HTTPS) traffic inside an organization. The mechanism consists in using a root CA that is configured in the web client and a network device that ...
9
votes
1answer
3k views

Is it possible to have stateless server nonces in HTTP Digest

When implementing a HTTP Digest server, there's the issue of nonces. Server nonces (as opposed to client nonces) must be issued by the server may be re-used by clients as long as the server allows ...
8
votes
3answers
2k views

HSTS on sites available over HTTP and HTTPS

I'm wondering if it makes sense to enable HSTS on a site that is served over HTTPS as well as over HTTP. What I mean is to add HSTS-Header if the site is accessed over HTTPS. But there is no ...
8
votes
2answers
499 views

Can other customers on shared hosting see requests from/to my site?

I installed a wiki on my shared webhosting (using Apache) account. This wiki is set to private (no read/edit/create rights for unauthorized users) and I'm the only one with an account. The wiki ...
6
votes
1answer
5k views

How does the symmetric key get exchanged in SSL/TLS handshake?

I've been reading a lot about SSL/TLS handshake between a client and a server and many articles on it are very contradictory. Some say that the symmetric key that will be used to communicate between ...
6
votes
1answer
494 views

Does HTTPS protocol leak HTTP body length?

It seems that in a MITM attack, hackers may know the whole HTTPS packet size sent through the network (i.e. size of HTTP headers + HTTP body + overhead). Besides that, does the HTTPS protocol also ...
6
votes
2answers
2k views

How to defeat CRIME, BREACH, TIME etc… server side (without sacrificing compression)

I am writing full-stack server side software and I have been researching CRIME attacks and it's relation to SPDY header compression as I am implementing the server side codecs for it at the moment. ...
5
votes
2answers
4k views

Best practice for caching sensitive data

My server returns private data in the body of an HTTPS response. It's not passwords or credit cards, but it is user-generated text and images, which should not be accessed by others. The data for a ...
5
votes
4answers
3k views

Why is this response splitting attack not working?

I'm working through OWASP's "WebGoat" (version 5.4) vulnerable web application, but I'm getting stuck on one of the earliest lessons which is to do with HTTP response splitting. I've looked in all ...
5
votes
3answers
2k views

Link from a Http page to a Https page - is it a security issue?

I have a site which is mostly not an anything which needs to be protected. However there is a small part of the site which is only for logged in users. So my regular site is Http & the site of ...
5
votes
3answers
2k views

Session fixation attack

Given the following conditions, Session ID does not change upon login Session ID travels in form of HTTP cookie There is no cross site scripting/redirection vulnerability on the login page is it ...
4
votes
1answer
892 views

Highly anonymous proxies vs anonymous proxies

From this link about highly anonymous proxies: There’s another type of anonymous proxy called Highly Anonymous Proxy. The main difference with this one is the fact that aside from hiding your IP, ...
2
votes
2answers
1k views

Is HTTPS as secure or more secure than SSH if both have an IP address whitelist?

I'm wondering whether an HTTPS API endpoint would be as secure as or more secure than SSH. API Endpoint The API endpoint would require HTTPS The API authentication would use a POST'd API key. The ...
2
votes
1answer
11k views

Hydra from Kali Linux + Tamper http post form syntax of the failure login attempt [duplicate]

I had asked this question in the general forum I think it is more adequate to place it here. https://stackoverflow.com/questions/27606232/hydra-from-kali-linux-tamper-http-post-form-syntax-of-the-...
2
votes
2answers
3k views

Secure SSL Session from losing itself into unsecure http

I've seen some implementations of HTTPS SSL and, as a visitor, forced to rely to a lot of those. What would a secure implementation look like and where can one expect problems? I expect the installer ...
2
votes
3answers
860 views

Can a form submission be encrypted even though address bar shows HTTP?

I was going to apply for a Student ID card through ISIC, but noticed that the form where they ask for payment (such as credit card number) details is not available through HTTPS. The URL to their ...
2
votes
3answers
686 views

Risks associated with HTTP content injection?

I'm curious about the risks associated with HTTP content injection, where an ISP injects content to pages accessed over non HTTPS connections. Some examples: http://arstechnica.com/tech-policy/2014/...
1
vote
1answer
141 views

Have a HTTP or HTTPS website?

There were some questions regarding this topic, but none of them discussed if there is some expection, and if http is just enough for some kind of websites. I've seen lot of school/high school ...
1
vote
3answers
134 views

Does HSTS provide security advantages on private networks?

For systems that only connect to the internet via a single dedicated private network (no WiFi hotspots), and assuming no systems or components on that network are compromised, does HSTS (HTTP Strict ...
12
votes
2answers
3k views

HSTS behaviour within incognito mode?

By definition, incognito mode shouldn't leave a trail of visited websites. However, HSTS (HTTP Strict Transport Security) requires the browser to keep a database of hosts that have requested HSTS, ...
7
votes
1answer
19k views

How to supply HTTP Basic Authentication details in OWASP ZAP proxy?

I am using Basic HTTP Authentication to log into my Web Application. The credentials are Base64 encoded and sent to the Server. OWASP ZAP Proxy is intercepting the request and I can see the ...
6
votes
3answers
2k views

Hide clear SNI when using https

A server with IP address a.b.c.d is hosting multiple SSL websites. When connecting to each website, a proper browser sends a request which include the destination host in an uncrypted clear text ...
5
votes
1answer
596 views

Accessing HSTS Server with an Unsupported Browser

Let's assume that I have correctly configured my server to enforce the HSTS policy, and it works correctly for IE 11 browsers. What happens when a someone using an unsupported browser (e.g., IE 9) ...
4
votes
1answer
3k views

How come I can see a full HTTPS requests via Fiddler?

I am testing a C# web API hosted on a remote server, and I am monitoring HTTPS traffic using Fiddler. What confuses me is that via Fiddler I can see all of the POST payload, headers and host URL ...
4
votes
1answer
598 views

RSnake's Slow Loris tool

I was looking at RSnakes implementation of his Slow Loris done on perl which can be seen here. I set up a little server to listen to his packets, and at first found this GET / HTTP/1.1\r\nHost: David-...
4
votes
1answer
1k views

HTTP Digest Authentication: Does the server store plaintext passwords?

Having just finished the chapter on digest authentication in HTTP - The Definitive Guide, I'm not quite sure what the server stores as the client's secret† in its database: the client's plaintext ...
3
votes
1answer
219 views

Spam link returns empty redirect to google.com - am I missing something?

In this question someone received what was clearly a spam link. Sometimes I'm curious enough to take a peek, which I usually do with curl or other command line tools (less risk of drive-by malware, ...
3
votes
2answers
634 views

HTTP + HTTPS + One Time Pad/stream cipher

I'm designing a web application where users will exchange short messages with the server very frequently (for instance, a few characters every second). I want the whole communication to be ...
3
votes
1answer
66 views

Why isn't the record of a TLS data application exchange signed by the server?

I am inspecting the TLS(1.2) protocol, and I notice that after the key exchange (handshake), data applications flows from server to client freely (because they have the session key). However, I ...
3
votes
1answer
206 views

Is there any purpose for providing checksums on a non-HTTPS location? [duplicate]

When you download a file, sometimes the website owner puts an MD5, SHA1, SHA256 or similar hash/checksum of the file right next to it; either on the page where you can download it, or as a separate ...
3
votes
2answers
1k views

Risks of serving untrusted content under HTTP Content-Type: text/plain?

Am I gonna run into XSS attacks by doing this, or will a file download be prompted? Are there security problems that would rise in a modern browser?
3
votes
7answers
2k views

Are URL shorteners “vulnerable” due to open redirects?

The OWASP state that open redirect is a vulnerability: An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This ...
2
votes
3answers
2k views

Is it secure for a site to serve the login page with HTTP, but have the actual site in HTTPS? [duplicate]

On some websites, the login page (where you enter your login details) is served by a regular HTTP connection with no encryption. However, once I login, the page immediately switches to a secure HTTPS ...
2
votes
2answers
3k views

Strange 400 requests in webserver nginx logs (possible exploit scan?)

It's one of the logged by nginx webserver requests: ‹\x11Г»=џ&gьµЈБЈx¬ёђАЙхPЙuN0жЫ¶@Oc[ќЮmћC”Ь™\x04»c/‹\x1F or \213\\x11\303\273=\237&g\374\265\177\243\301\243x\254\270\220\300\311\365P\...
2
votes
1answer
2k views

Encrypting layers of OSI

I was reading that WPA2-PSK encrypts layer 2 of the OSI network model. What is the danger of having this layer in plaintext (I know it can be decrypted very easily from within the network)? Is there a ...
2
votes
3answers
979 views

Is data exposed in a CSRF attack?

I am wondering wether a CSRF attack, will disclose the information being sent back in a GET request. I need to send a social security number out, to the client a few times, and it is NOT anyone else ...
2
votes
1answer
127 views

Is it safe to put user-conrolled strings in a HTTP Location header?

I am thinking of adding URL shortening to my site. Let's say my database has already stored url as a plain string, this data was provided by the user and is arbitrary. So a naive implementation in ...
2
votes
1answer
3k views

Is it possible to secure a web app without HTTPS? [duplicate]

Possible Duplicate: Can you secure a web app from FireSheep without using SSL? Think of a typical web application where the users log in, and then the session is kept with a session key. Is it ...
2
votes
1answer
676 views

Best practices for securing open APIs from quota theft

I know that appKey is not a means of authenticating applications. But I am wondering what are the best practices for avoiding quota theft for open APIs, that are not associated with any user account. ...
2
votes
1answer
322 views

How does firewall differentiate between browsing and downloading?

The firewall installed at my college's router allows me to surf the internet but never allows me to download any package that has a size more than 100mb. I wonder how exactly does it differentiate ...
1
vote
3answers
9k views

ModSecurity errors related to REQUEST_METHOD HTTP/1.1 and GET

I asked my host to switch on the log file, and it have increasing a lot since then. Its have been increasing with 700 mb for the last week. It’s filled with error messages related to Mod Security. ...
1
vote
1answer
473 views

Would the CORS specification consider a missing Content-Type header to imply a “simple header”?

RFC 7231, Section 3.1.1.5 states: A sender that generates a message containing a payload body SHOULD generate a Content-Type header field in that message unless the intended media type of the ...