Questions tagged [http]

Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.

Filter by
Sorted by
Tagged with
0 votes
0 answers
766 views

JWT token. Send in a cookie or Auth header depending on Rest vs MVC?

Reading around I gather that for a Restful API since you don't use cookies,then you send the token in the Auth header.Correct so far? When on a traditional MVC app ,do you send the token inside a ...
user avatar
  • 2,101
0 votes
2 answers
121 views

On a server to server SSL connection is there any trustable information identifying the calling server?

Imagine server A calling server B over SSL and that both servers have SSL certificates installed. Later server A again calls server B. Is there a way for server B to know that server A is the same ...
user avatar
0 votes
1 answer
181 views

What is a secure way to send credentials to the server?

I am currently making a file server (Based on HTTP) for my service. I want an upload key, so a key that is needed for uploading. To get this key, the client has to provide his login data. Let's say my ...
user avatar
0 votes
0 answers
129 views

Should I strip the "Origin" header from client requests?

I'm trying to setup an nginx reverse proxy to a web product I can't modify (it's an appliance). Client --> https://myapp.com --> nginx --> https://10.1.5.9 I managed to do so, but it ...
user avatar
  • 1
0 votes
1 answer
123 views

Does an url that redirecting infinitely have any impact to website?

I am testing a bug bounty website, and found an endpoint like www.example.com/infinite. When open it, it keep doing 302 redirect to itself until browser stops it for redirecting too many times. For ...
user avatar
1 vote
1 answer
111 views

What is happening to second response in HTTP Splitting?

Doing the webgoat HTTP splitting exercise. I feel like I'm doing something wrong or there is something that I don't understand. The idea is that since we can control the referer parameter, we can ...
user avatar
  • 123
0 votes
3 answers
267 views

Can HTTPS request parameters be seen by the PC client?

I've searched for it but couldn't find a direct answer to this relatively simple question. Most questions are about a 3rd party intersepting the HTTPS POST or GET parameters inbetween client and ...
user avatar
  • 111
1 vote
1 answer
2k views

Suspicious HTTP Requests in my logs [duplicate]

I'm running a PHP application with a user management system called userspice. It basically allows you to include the userspice PHP file and then control access to a certain PHP page. As I have seen ...
user avatar
3 votes
2 answers
182 views

Targeted .git scanner?

Starting yesterday, my honeypot has been getting a ton of git scans. I normally wouldn't think much of this, but a few weird things are happening: All of the IP addresses come from Amazon AWS They ...
user avatar
  • 103
2 votes
0 answers
103 views

http smuglling how can i do a poc in a big websites?

i try to find http smuggling in big bug bouny program if i send this to the server POST /path HTTP/1.1 Host: subdomain.domain.com User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 ...
user avatar
  • 73
0 votes
1 answer
279 views

Spoof IP address after a TCP handshake established

Is it possible to spoof the IP once a TCP handshake was performed successfully? For example: Perform the handshake Use the session with the same IP which performed handshake but on different machine ...
user avatar
0 votes
2 answers
238 views

If HTTPS only runs on a single port, why is SYN flooding an issue?

I've read online that SYN flooding is when "the attacker sends repeated SYN packets to every port on the targeted server." However, HTTPS only runs on port 443. Therefore, why is it ...
user avatar
  • 47
1 vote
1 answer
150 views

Is it possible to completely obfuscate proxy servers?

Stripe's fraud detection documentation claims it has Proxy Detection When I search for how it might be detecting traffic from proxies, I see this great answer, which show how to detect that traffic. ...
user avatar
  • 1,214
0 votes
4 answers
140 views

HTTP access from a single IP [closed]

If I were to configure a server that would be configured to only be accessible (HTTP) from a single IP address via a port, is it safe from unauthorized access?
user avatar
1 vote
1 answer
268 views

Do all files downloaded from the web, come with a checksum to verify the file?

Pretty straightforward question. Take the image here: https://i.imgur.com/oEdf6Rl.png Does it come with a checksum, which I can verify against after I have fully downloaded the file? This question ...
user avatar
2 votes
1 answer
126 views

Timeless timing attacks and response jitter

I've been researching timeless timing attacks, ie: timing attacks using concurrency rather than round trip time. Here is an article by portswigger with links to the original article by Van Goethem. ...
user avatar
  • 123
1 vote
1 answer
207 views

Can an error page (like 404) served without X-Frame-Options be exploited?

I'm checking some HTTP headers in the server response. I get a 404 error page. Could in some scenario an attacker leverage a missing X-Frame-Options header in a 404 page?
user avatar
  • 487
0 votes
2 answers
350 views

How do servers protect against straight up sending a HTTP request that is actually some malware or HTML code? [closed]

I know servers have something to block you from just sending them an HTTP request that is actually some malware or a webpage that is malicious, because it would be so easy to just spam HTTP requests ...
user avatar
  • 29
0 votes
1 answer
136 views

What exploit is trying to be leveraged here? (Apache access.log)

I've just deployed a barebones Apache server on Digital Ocean, only hosting static files. No PHP et al. I'm not too bothered to see random exploit attempts, but 99% of the requests are of this similar ...
user avatar
  • 1
0 votes
0 answers
18 views

Security implications of protecting private data with a long URI exclusively [duplicate]

A website hosts private/personal information at a very long and unpredictable URI, yet access to this URI is completely unauthenticated. Are there any major security issues with this? I can think of ...
user avatar
  • 563
-1 votes
2 answers
206 views

People say "false positives" in request smuggling. What does it mean? [closed]

I always see "false positives" or "false negatives" in HTTP request smuggling forum posts. What does it mean? Example: HTTP Desync Attacks: Request Smuggling Reborn
user avatar
  • 73
1 vote
1 answer
151 views

How can a site preemptively notify browsers to enforce an SSL on their domain?

I learned about this years ago and don't remember enough of the keywords to search for it appropriately. Its where sites can tell the browser that the site must not allow the site to be downgraded to ...
user avatar
  • 1,495
0 votes
1 answer
134 views

why the website cant understand my request in http smuggling?

hi I started to find bug bounty vulnerabilities and i think i found a te.cl vulnerability in a website. i send GET / HTTP/1.1 Transfer-Encoding: chunked Host: subdomain.domain.com User-Agent: Mozilla/...
user avatar
  • 73
2 votes
0 answers
113 views

Is the HTTPS lock sign displayed if reasources are loaded from insecure sites?

We all know that if you visit a secure site which uses https, all modern browsers will show a padlock sign if it has a CA certified certificate. My questions are: Suppose there is an image loaded in ...
user avatar
  • 155
1 vote
1 answer
143 views

Custom response for Web Application Firewall (WAF)

What should be the custom response code when WAF blocks a request due to matched rules or policy violation. We should kept the response code as 403 or 200 when WAF returns a response against a blocked ...
user avatar
  • 4,764
1 vote
0 answers
101 views

Intercept HTTP requests for invalid domains in Linux

I am using Ubuntu 18.04. When making a HTTP request to invalid domains, I get a HTML page with javascript code that redirects me to uniregistry a landing page. More specifically, when trying to load ...
user avatar
  • 207
2 votes
1 answer
313 views

What are these long hexadecimal HTTP requests? [closed]

I'm receiving long hexadecimal requests on my webserver, such as: /...
user avatar
  • 21
1 vote
2 answers
738 views

What does using a VPN offers over HTTPS + DoH in terms of protection?

What are the security risks that someone using HTTPS (everywhere) + DoH is vulnerable to, comparing to someone using a "trusted" VPN?
user avatar
0 votes
1 answer
89 views

Should I redirect http request to https from my system's application or from DNS or other? [closed]

I want to create a web server that does redirects HTTP to HTTPS. What is the simplest method to do this but also secure? Should the DNS handle this? (For example, Route53) I used to do this with my ...
user avatar
  • 101
22 votes
9 answers
7k views

How does one take advantage of unencrypted traffic?

Let's assume an ecommerce site works over HTTP, rather than HTTPS. What are the practical dangers here? How could an attacker exploit this? Whenever I read about dangers of unencrypted traffic, it is ...
user avatar
1 vote
1 answer
236 views

Is it safe to visit any website in TOR when the Security Bar is set at Maximum? (Safest)

Someone has sent me a link on Tor which when visited instantly read that the website itself was not available and that apparently the link is broken somehow. When using Tor i use the option "...
user avatar
0 votes
1 answer
185 views

Secure HTTP login in an embedded (IoT) system

HTTPS in an embedded (IoT) system is (as far as I know) not necessarily a good solution. Basic Authentication is not secure. Acceptable in an internal network. Idea: Login.html (when called up) sends ...
user avatar
4 votes
0 answers
392 views

Is an out-of-band request via DNS by abusing the X-Forwarded-For header exploitable

By changing the X-Forwarded-For header in a request, I am able to have it sent an OOB interaction with Burp Collaborator requesting a DNS lookup of type A. Is there any risk to this vulnerability or ...
user avatar
1 vote
1 answer
209 views

Did Wireshark capture an update of Adobe Acrobat Reader over an unencrypted connection?

My home router is an AVM FritzBox and it's able to log all incoming and outgoing traffic in a file format readable by Wireshark. Some days ago I started capturing all traffic for about an hour to get ...
user avatar
  • 31
10 votes
1 answer
1k views

Is basic HTTP proxy authentication secure?

I have been looking for cloud based proxies, and I notice that it's very common to authenticate to a proxy using basic auth over an unencrypted connection. I don't understand why this is considered ...
user avatar
0 votes
1 answer
141 views

How to know if the response is from the CDN and not the origin?

I am doing some bug hunting. I inserted a malicious payload into a request. But I am not sure if the response is from CloudFlare or the origin. Are there special headers which help me to distinguish ...
user avatar
0 votes
1 answer
171 views

RestApi Libsodium SealedBox end-to-end request encryption scheme

I am making an API that uses the following steps for encryption. All of this is implemented using libsodium. First of all the client has to make an initial request to the server for getting his public ...
user avatar
1 vote
1 answer
538 views

How to make Squid Proxy undetectable by ip-check.net? [closed]

I have setup squid proxy on a CentOs server where I set forwarded_for to delete and denied request headers on the /etc/squid/squid.conf file. However, whilst connected to the proxy, if I visit http://...
user avatar
  • 11
0 votes
0 answers
87 views

How does AWS verify signed requests?

How does AWS request signing and verification work? Let's say I have created a signed request using this guide. How does AWS service verify this signature? I see 2 options with their respective flaws (...
user avatar
  • 101
1 vote
1 answer
668 views

Snort Inline Mode(IPS) Routing Packet Forwarding

I'd like to build an IPS which would be a seperate endpoint than the router and/or protected servers. To achieve this I've installed to my Ubuntu server Snort with DAQ(AFPACKET). The instructions I've ...
user avatar
1 vote
1 answer
467 views

Isn't HTTPS enough to prevent MITM in mobile apps? Why is SSL Pinning needed?

I am making a webview that is going to be part of a native iOS and Android app, I implemented the webview using HTTPS as a protocol, and developed my NodeJS app there. But the security team from where ...
user avatar
  • 693
2 votes
1 answer
132 views

Arbitrary query parameter reflected in server response header. Is it exploitable?

SCENARIO: If I send requests like these: http://site.com/page?safe_param=1?my_arbitrary_param=2 The server responds with a normal HTTP response but within common headers it includes also the ...
user avatar
  • 487
-3 votes
1 answer
205 views

What type of attacks does HTTPS protect against? [closed]

What are some example attacks that could be vulnerable if HTTP is used, and that can be overcome in HTTPS? The only one I can think of is man in the middle attacks, where the intercepted traffic is in ...
user avatar
  • 3
1 vote
1 answer
129 views

What you can do with super cookies on subdomain to harm domain?

When you search in Google for user cookies top results are VPN services that say that it's used by ISP to track the users. Wikipedia Supercookie say nothing about HTTP headers and what exactly are ...
user avatar
  • 209
1 vote
1 answer
298 views

HTTP Headers: Document Policy vs. Permissions-Policy/Feature-Policy

I'm checking the options to harden my web app by setting the appropriate HTTP headers. Besides the Content Security Policy (CSP) there are two another approaches: Document Policy and Permissions-...
user avatar
  • 113
0 votes
1 answer
270 views

Intensive 586 (ms-shuttle) port scan/exploit/hacking attempts

Recently i wanted to play a bit with TCP/UDP networking (and touch some custom HTTP server impl) on C# and found out that i'm getting requests from totally unknown dudes, such as this one: FROM: [::...
user avatar
1 vote
1 answer
436 views

Why is php-fpm trying to connect somewhere on port 443?

I have nginx and php-fm set up to front a word press site. I used certbot to setup TLS. When I load any page, I see selinux violations and it looks like php-fpm is trying to reach out to some port ...
user avatar
1 vote
1 answer
136 views

XSS injection in the name of a file to be sent

I found a reflected XSS in a POST request that sends a file to the web server. The HTTP POST Request The HTTP 200 OK Response When I want to try to insert document.cookie in the payload, the web ...
user avatar
  • 13
-2 votes
1 answer
175 views

Can someone tell me whats the encryption in this? [closed]

khgpd://zpn.xddspbx.nrf/j/9djwth14tmct9tf/uzdwvrrnonv.tue?gz=0 This is an encrypted text and is most prob a url....pls decode it or tell me which cipher is it, this is not for any security breaches ...
user avatar
2 votes
1 answer
133 views

Should I check Host header or ServerName for CSRF defense when serving behind proxies?

In a CSRF defense based on checking forbidden headers, should I check Origin/Referer header against the ServerName configuration directive, or is it sufficient to simply check against the HTTP Host ...
user avatar
  • 328

1 2
3
4 5
28