Questions tagged [http]

Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.

Filter by
Sorted by
Tagged with
1
vote
1answer
92 views

Serving local HTTP over VPN [closed]

I’m running a server on my LAN. It’s setup as a Webserver that’s only listening to local connections and a WireGuard VPN server. When I’m not at home, I establish a connection to the vpn. The ...
2
votes
1answer
111 views

Correctly configuring load balancing for TLS session resumption

Consider the following network topology: There are exactly two HTTPS servers, S1 and S2. There are exactly two HTTPS clients, C1 and C2. Notice this, as there are often many more clients for two ...
1
vote
2answers
106 views

Non SSL website with external SSL secured service

I'm working with site that is served via HTTP. Authentication service is external and served via HTTPS. I'm not sure that this isn't security concern that is website is not using SSL.
2
votes
1answer
105 views

Is <meta> http-equiv secure?

I'd like to redirect a visitor to the login page if he's not authenticated and she/he wants to access a protected page. I can handle this via the backend code, but it's easier to make it using HTML. ...
0
votes
0answers
53 views

How does Google restrict API access by mobile App ID?

Google Cloud Platform API service has an option to restrict API access to specified iOS bundle identifiers. How is Google able to accomplish that since any mobile clients can easily spoof the bundle ...
1
vote
0answers
59 views

Security risks on returning encrypted JSON web token without prior authentication

I am architecting a passwordless REST API where public/private keys are the primary form of authentication. In order to create a new session you must prove that you hold the private key to the public ...
1
vote
1answer
39 views

Securing implicit tokens (Example: Moltin)

I'm fairly new to security but I'm trying to understand how companies have their APIs set. One such case is Moltin's Implicit Token. Basically they provide you with a read-only (for the most part) ...
1
vote
3answers
211 views

Is there a way around HTTPS being redirected to HTTP?

I have come across something of a curious situation that a website (Palestinian News Network) has a valid TLS certificate (see here) but that the website always forces loading of the site via http://. ...
0
votes
2answers
102 views

Can I intercept and impersonate a server over an HTTP wireless connection?

Let's assume I have a strong enough antenna at exactly the same frequency as the victim. If it sends a request over unprotected http to the router, could I then listen to that request and respond to ...
-9
votes
2answers
171 views

Why does everyone assume 'https' is secure? [duplicate]

Why are they certificate authorities? What do they do that ensures the information is 'secure'? I know that they verify if a 'certificate' is from a 'trusted' source but who decides which sources are '...
1
vote
3answers
101 views

How to limit web API microservice communication to specific list of machines?

I have an PHP API that I want to be consumed only by one static website. However the HTTP is not secure as from what I suspect any header can be spoofed (IP - I may be wrong here, domain name, and so ...
1
vote
0answers
61 views

How is Indonesia blocking images in e2ee applications?

Indonesia's minister in communication and informatics supposedly blocked the sending of images and videos through social media from 22nd May until 25th May, in order to prevent hoaxes from spreading ...
2
votes
1answer
90 views

Security implications of client TLS termination

I have a bunch of HTTP services/devices TLS unaware. I want to allow them to access WAN, but of course I do not want them to do it in plain HTTP. Updating them is unworkable due to legacy issues and ...
1
vote
1answer
100 views

How can the Same Origin Policy protect the user in times of CORS headers?

How can the Same origin policy protect something if you can bypass it via Cross Origin Resource Sharing headers? And why are those assigned by the server which is tried to access and not by the user? ...
3
votes
1answer
236 views

Is it easy to hijack browser session if you have access to someone else computer

If someone has access to my computer , can they easily get my session id by going to the browsers developer tools and taking a photo of the session id with a phone, if the session id is passed in a ...
1
vote
2answers
130 views

What is advantage of passing request / response data via cookies instead of regular query parameters?

I have a specification where its required to pass all the data in the requests to the server using cookies (instead of body or query parameters) and accept all data from the server using cookies (...
22
votes
3answers
6k views

Security vulnerabilities of POST over SSL

I work for a small company, developing an ASP.NET web-application. Recently, we've had the requirement of exposing an API endpoint come up, such that an automated script running in the cloud can ...
1
vote
0answers
66 views

What are the risks involved in blindly trusting all certificates for https requests over unknown proxy servers? [closed]

My use case is a Java application where no sensitive data being transmitted whatsoever, and the response being accurate (i.e. unmodified) is unimportant.
1
vote
2answers
462 views

Is it possbile to conduct http header injection attack with a web site or web app uses https?

If a web site or web application is running with https, is it possible to conduct http header attacks like http header injections and so on?
0
votes
0answers
151 views

JS keylogger listening to what is being typed in an iframe?

Having discovered the X-Frame-Options sameorigin that stops a website from being shown in a iframe, I am trying to understand how far not having this header can go. What I am not sure about is if it'...
0
votes
1answer
133 views

Router administration page is served over HTTP

My wireless router admin page does not include https option. It is always served over http. This is obviously a concern in case someone is sniffing the network and can read my password in plain text. ...
0
votes
0answers
374 views

Secure Http Connection With Authentication Header

I am trying to create an authentication header algorithm that can be used for authentication on HTTP server. Not sure it is good but it seems OK to me. I also used similar approaches for previous WS ...
3
votes
1answer
65 views

Why isn't the record of a TLS data application exchange signed by the server?

I am inspecting the TLS(1.2) protocol, and I notice that after the key exchange (handshake), data applications flows from server to client freely (because they have the session key). However, I ...
0
votes
1answer
49 views

Whats should be TRACE response of an API (if it is not allowed on server)?

I am testing a website and noticed that when I change the GET method of the API request to TRACE, it returns an error 405-Method not allowed in Burp repeater. That's fine. The problem is, lots of ...
0
votes
1answer
189 views

How to secure communication between docker container and an elasticsearch server?

I have a spring boot application running inside a docker container. This application communicates with another server which hosts Elasticsearch on it. How do I secure the communication between these ...
3
votes
0answers
131 views

How Can Exploit Xss and Sqli via HTTP Verb Tampering?

I was reading a paper about 'HTTP Verb Tampering' here: https://blog.jeremiahgrossman.com/2008/06/what-you-need-to-know-about-http-verb.html The author said: 2) HTTP Verb tampering is generally ...
0
votes
0answers
27 views

Requests to /android-app://com.twitter.android/twitter/user - what is the intention?

I wonder what requests to https://ourdomain.com/android-app://com.twitter.android/twitter/user are doing - is that a kind of attempt exploit a vulnerability? I encounter them in our web server logs ...
0
votes
1answer
108 views

Is it safe to login using HTTP on a WPA2 protected home network?

I have a small network infrastructure in my home on which I'm hosting some services such as a website, file server and such. Many of those services have an administration web interface which isn't ...
1
vote
1answer
72 views

What accounts for file accessed immediately after including link in Gmail?

Less than 60 seconds after sending an email w/ Gmail that contained a pasted https link to a .zip file, that file was accessed by two non-Google servers. Neither server belongs to the email recipient. ...
-2
votes
2answers
243 views

XSS with HTTP flag true

Since HTTP only flag is used to mitigate Cross Site scripting, we cannot perform XSS on the web application? If we can, What are some best real time examples to pentest XSS when HTTPOnly Flag is true?...
1
vote
2answers
94 views

How strict should I be in rejecting unexpected query parameters?

TL;DR Is it a "best practice" to return an HTTP 400 Bad Request response if extra parameters are sent with a request? I'm putting together a web app and doings some testing with OWASP ZAP. I'm pretty ...
0
votes
1answer
242 views

HTTPS MITM Proxy breaks HTTPS

I tried to reverse engineer an Android APP using MITMProxy, and the Server responds with an unauthenticated-error. If the whole authentication would be using headers (Basic, etc...), the Proxy should ...
0
votes
1answer
182 views

Wireshark - How to see the domain of HTTPS websites visited

How can I see the domain name of https websites that are visited on my network? I know I'm not able to see the full url, just the websites ip or domain. I think it my be possible with a reverse dns ...
6
votes
1answer
829 views

How to force a browser when connecting to a specific domain to be https only using only the client machine?

Is it possible to force a client (browser or host machine or etc) to only make https connections to a specific URL/domain? (preferably non-admin/root fixes if possible) Here is a fabricated ...
1
vote
1answer
166 views

PHP HTTP Reverse Shell?

Is there a PHP HTTP reverse shell? I haven't been able to find one, only ones that transmit using TCP packets (not HTTP). Note, I mean actually using HTTP packets as the C2, not just transmitting TCP ...
0
votes
1answer
83 views

Is there any standard that encrypts domain name of the certificate?

I guess widely used protocols today don't encrypt the domain names in TLS certificates. Does HTTP/3 and TLS 1.3 encrypt domain names of web sites?
0
votes
1answer
109 views

No certificate found alert in nodejs https server in mobile

I have created a website using nodejs . And using ssl certificate from sslforfree.com . It is working fine on desktop and i checked it in SSL Checker it is working fine . But in mobile it is showing ...
1
vote
1answer
152 views

Could my boyfriend be hiding his encrypted emails inside of my inbox? [closed]

is it possible that my boyfriend could be hiding his encrypted emails inside of my email inbox with my email address and I can't read them? And if it if that is possible is there way that I can ...
0
votes
0answers
233 views

Information disclosure with AWS response headers

I'm currently testing a web application hosted on AWS. In the response headers, I've noticed various Amazon-related headers, I've never really seen before. The headers include: x-amzn-RequestId: <...
0
votes
1answer
166 views

How Hathaway ISP shows renewal reminder in non secure website?

I am using prepaid broadband plan of Hathaway (in India). Few more days are left for the plan to get expired and I observed the below screenshot. This popup comes only when I visit any non-secure ...
1
vote
1answer
185 views

Custom Suricata's HTTP alert isn't triggered when using “..” as part of the scanned uri. Why? [closed]

I have a doubt with a Suricata custom rule. If I do: alert http any any -> any 80 (msg:"blabla"; content:"abc"; http_uri; sid:1000000;) I can get requests to http://x.x.x.x/abc uri in fast.log ...
1
vote
1answer
60 views

Remote detection of spring framework

I would like to know if there is a remote way to understand if a web app uses the Spring framework. In particular Spring security. Is there any kind of analysis on HTTP headers that can provide ...
0
votes
1answer
84 views

DNS Spoof Adware

Someone recently boasted about adware which can inject ads from most networks, and using DNS spoofing would make the providers think that the ads were on a website owned by me (i.e. www.myscamsite.com)...
3
votes
2answers
483 views

Does someone need to be connected to my network to sniff HTTP requests?

TL;DR Would a potential attacker need to have my Wi-Fi password and be connected to my network in order to read HTTP requests? Over the past year or so, I have made a few DIY home automation projects....
8
votes
3answers
1k views

A link redirect to http instead of https: how critical is it?

I just join a project, and while browsing the code, I realize that some links redirect to another web page, in HTTP instead of HTTPS. The linked website has an https version, and there was no reason ...
0
votes
0answers
38 views

Retrieve hostnames for IP addresses to connect to HTTP services, when no (reverse) DNS PTR records are available?

I'm conducting a penetration test, where I'm facing the following problem: After having retrieved a set of IP addresses through tools like whois, I cannot successfully connect to the HTTP-based ...
0
votes
1answer
125 views

DNS Spoofing Detection with JavaScript

I've came across an interesting question today - how can a JavaScript detect that a DNS Spoofing attack has been made against the client its running upon? Scenario: Edit: wrong scenario was ...
0
votes
1answer
175 views

Preventing path traversal knowing only the input

I am tasked with preventing a path traversal attack over HTTP by intercepting and inspecting the (unencrypted) transported data without direct access to the target server. From some research it ...
38
votes
5answers
7k views

Should I use HTTPS on a domain that will only be used for redirection?

If I have a domain, https://www.example.com. It has an SSL certificate for that domain only. I also want to redirect people who only type example.com in their browser's address bar. Should I secure ...
0
votes
0answers
40 views

Is it okay to implement key files via HTTPS form?

I've been messing around in VeraCrypt and KeePassXC for a while now. And I'm trying to improve my privacy and security. I've been experimenting with different authentication methods. VeraCrypt and ...