Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Questions tagged [http]

Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.

Filter by
Sorted by
Tagged with
2
votes
2answers
770 views

Nmap not following redirect when using “http-title” script

I am trying to scan a bunch of IPs for their http-title. Now the problem I have is that nmap pretty much never follows any redirects. Usually the title I want is behind that redirect though. For ...
0
votes
3answers
148 views

Can information sent over unencrypted http still be seen if I'm on an encrypted wifi?

I was booking a haircut online and noticed that when they made me sign up for an account, the credentials were not being encrypted (or at least that's what firefox was telling me). It's not a huge ...
0
votes
1answer
39 views

Is there any other way through which an attacker can obtain user data from HTTP response except MITM and CORS attack?

I am doing some research for my college project and I want to ask is there any other way through which an attacker can obtain data from HTTP response except MITM and CORS attack. For an example, If I ...
1
vote
1answer
42 views

Dangers of Sending Onetime Pin numbers over http

Are there any dangers of sending a one time pin number from customer to my server over HTTP? Somebody is arguing that its okay since it will only be used once. So there's no chance of an attacker ...
1
vote
1answer
687 views

How to pass a localhost check for an incoming request?

I'm trying to send a request to an http server hosted on a machine. The http server is in C# and drops any packets that are not from localhost: public void Request(HttpListenerContext context) { ...
4
votes
3answers
129 views

client/server trust after authenticating over HTTPS then dropping to plaintext?

Disclaimer If this question is ridiculous it's because secure public key exchange sounds impossible before you learn about it. So I'm asking about things that may be impossible. Question Is it ...
3
votes
1answer
277 views

What are the benefits to HTTPS between two servers I control?

The current setup we have is two servers that are held internally in my building. One of these is only accessible internally, the other is public facing. The internal server communicates with the ...
2
votes
2answers
207 views

Bypassing rate limit on home router

I'm studying Info Security and was poking around my home router (it's a cheap one) with a python script trying to brute force the admin password for the web interface (it uses HTTP basic and the ...
1
vote
1answer
71 views

What is the safest method to send authentication data to API?

I use Vue.js on frontend and GoLang on backend. With Vue I'm sending AJAX request with credentials for sign in/sign up. Should I use HTTP Basic Auth, or just send them in request body? In case you are ...
1
vote
1answer
330 views

Signing webhooks with JWT — overkill with TLS?

I have a server that sends webhook notifications to client servers. Before the client server begins processing anything, it should be certain that the webhook originated from my server, and that it ...
3
votes
1answer
189 views

Spam link returns empty redirect to google.com - am I missing something?

In this question someone received what was clearly a spam link. Sometimes I'm curious enough to take a peek, which I usually do with curl or other command line tools (less risk of drive-by malware, ...
2
votes
1answer
86 views

After performing a SSL strip, can you upgrade back to HTTPS with your own encryption from the proxy?

Let's say you are performing a SSL strip. From what I can understand, it modifies either the client or server packets (in the http/https protocol), which indicate that it supports encryption to not ...
1
vote
0answers
55 views

Bloom filter to prevent replay attacks in signed HTTP requests

I'm thinking about an authentication sheme of a REST API in a setting where the only thing the server stores about a client, is their public key (the asymmetric encryption scheme should not matter). ...
-2
votes
1answer
101 views

Should HTTPS work automatically on my website or does it need to be allowed somehow? [closed]

If I simply type in security.stackexchange.com into my browsers URL bar, it uses HTTPS to fetch data from the server. Is it possible for a website to not work over HTTPS? Does it have to be ...
3
votes
1answer
576 views

Is cache-control: no-cache enough for sensitive information like bank accounts, etc.?

I have read somewhere that when storing sensitive information on a website you should include cache-control: no-store for telling the browser not to store that information on the local system. But I ...
3
votes
1answer
697 views

Injecting a TCP packet into existing connection

let's see a scheme: and I would like to consider two cases: All IP addresses are public, a cloud is symbol for the Inernet. The first one The H has an established TCP connection: C = (210.10.10....
0
votes
1answer
84 views

What party is protected by not turning on CORS?

Here's what I know about CORS: It allows you to access data on another domain from the frontend of any other website, as long as the access-control-allow-origin property is properly set on the machine ...
0
votes
1answer
106 views

Is there a way to send a password over JSONP (GET) over HTTPS (SSL)? Crypto maybe?

I understand sending passwords in the clear over GET is not considered secure because the query string can be logged by multiple eavesdroppers. However if I REALLY need to use JSONP to submit a ...
0
votes
1answer
321 views

Can I get malicious malware in my computer or any kinds of virus by registering through Google/Facebook to a specifc site?

Lately, there is a start up company in Israel called Initiative Q and currently it gives out coins (that are similar to bitcoin but they don't run on Blockchain technology) in order to advertise their ...
2
votes
2answers
456 views

What's the benefit of JWT if user needs to send his credentials once anyway?

JWT tokens seem like a very good idea. You can send a request to some API without using your username/password secret pair. Still, I don't fully understand the benefits that it gives. I have two ...
2
votes
2answers
91 views

Network provider blocking URL, even though connection made to IP

I came across an interesting case today, which with my limited knowledge I'm unable to understand the working of. I was trying to access a bit.ly link, but it is blocked by my University. Knowing ...
2
votes
1answer
2k views

How do CORS proxy websites work?

While I was developing the front-end side of my web project, I got an CORS protection error. Not surprising since my front-end project was not in the same origin. After some search on how to bypass ...
1
vote
1answer
274 views

Suspiscious HTTP request to nginx server in server log, what is it?

I have an nginx server running an instance of and express/nodejs server. I was going through the logs to see what was being requested, and I noticed a few normal attempts for common flaws in things ...
4
votes
2answers
1k views

How does Google protect against scraping?

I'm trying to implement security against scraping on my website to prevent basic scraping techniques. Google seems to have a very good protection against scraping, but it's so good that I'm unable to ...
-1
votes
1answer
1k views

301 Moved Permanently on nginx server

If I request this: http://mysite.com/\/\http://evilzone.org Response: HTTP/1.1 301 Moved Permanently Location: https://mysite.com/\/\http://evilzone.org Is it a vulnerability?
1
vote
0answers
162 views

Hide data from wireshark on localhost

Assuming you're working with an old network protocol, or insecure/unencrypted protocol (HTTP for example), is there a way to make it difficult for network sniffers from capturing the packets? An MITM ...
3
votes
1answer
279 views

What is httpvh:// and is it the result of something malicious?

I was working on a client's old website and I noticed that some of their YouTube links were broken and looked like this: httpvh://www.youtube.com/watch?v=jNQXAC9IVRw At first I assumed it was some ...
1
vote
0answers
92 views

Security of AWS Lambda Communicating to Non-HTTPS API

Wondering what attacks might look like in the following scenario. I have a web service that pings an AWS lambda (behind API gateway), which makes a couple of transactions (sends email, adds to ...
4
votes
1answer
232 views

What information is still exposed when visiting an HTTPS website using DNS over TLS?

DNS over TLS is now supported in Android Pie, which allows a user to define a private DNS server, and by DNS providers such as CloudFlare's 1.1.1.1. This opens up the world of DNS security to more ...
15
votes
3answers
4k views

Is this bank website secure enough? No https in login page

Today I opened a bank account to invest my savings. Here's the link to the login page: http://www1.directatrading.com/ I noticed it doesn't use Https protocol (neither is that page nor in the landing ...
2
votes
2answers
170 views

Clickjacking vulnerability of file attachment downloads?

A portion of our system exposes an HTTP file handler that transmits a file to the client provided that authentication and file ID are correct, and no response if not. The ASP.net server this is ...
4
votes
1answer
232 views

Weird attack making my server CPU super high

I noticed that my server CPU is super high and the reason is grep "A" command After a deep look, that what I've found in my active internet connections list (netstat -tupn) tcp 0 0 ...
3
votes
2answers
690 views

Hydra gives right password if used after 3 minutes else gives wrong passwords

I have a D-Link DCS 5222LB IP camera. I am trying to bruteforce the IP camera. The camera uses basic HTTP authentication. I use the following command: hydra -l admin -P passlist.txt -t 3 http://...
1
vote
4answers
585 views

Security concerns surrounding HTTP GET in Web Development

I'm currently a developer making my first foray into web development, mostly using C# ASP.NET services such as MVC and Web API. Getting into the HTTP side of things, I'm currently deciding whether or ...
0
votes
1answer
2k views

Sniffing an outbound HTTPS packet - only intercepted by certain software, can't decrypt

I'm trying to sniff an SSL-encrypted outbound packet. It's sent by the game Mass Effect 3 to an EA web service. When I sniff packets with Nirsoft SocketSniff, I can see the packet (positively ...
-2
votes
1answer
117 views

How to force authentication over HTTPS - Wordpress

During our last PCI scan, we received these 2 fail points: "Basic Authentication over HTTP" and "Web Page Transmits Login Credentials Without Encryption." Both were on Port 2077. Though our ...
1
vote
1answer
679 views

Hydra: Brute force an http form, all arguments are supplied but the login error has other string formats and is too big

I am using Hydra to brute force a login http form (Method: post), but I'm getting false positives (passwords that aren't valid) I believe I know the reason, I just don't know how to handle it: The ...
3
votes
1answer
1k views

Tunnel ssh over http with custom headers

I'm trying to set up corkscrew to make an SSH tunnel over HTTP, but I need to add custom headers after the "CONNECT" statement and before the ssh tunnel. Does corkscrew support it? If yes, how can I ...
0
votes
1answer
208 views

How is HTTP converted to HTTPS when no HSTS is present?

Suppose you have a website http://example.com Now, you also have an SSL certificate, which means users can access the site securely using https://example.com But if I just write http://example.com ...
3
votes
3answers
326 views

Given a secure channel, are there any benefits in using SCRAM over a username and password?

Given that a communication over HTTP uses SSL encryption uses public key pinning to prevent MiTM attacks is security in any way elevated by using Salted Challenge Response Authentication Mechanism (...
1
vote
1answer
67 views

Can my computer run malicious Javascript due to Man-in-the-middle attack on the connection with HTTP site?

There is an example for illustration purposes: Let's suppose that there is educational site about Celtic mythology. It's purely read-only site, not even comments are allowed. It's also very simple, ...
-1
votes
1answer
311 views

Secure version of httpd package [closed]

I am using Linux xyz.co 3.10.0-514.21.1.el7.x86_64 #1 SMP x86_64 x86_64 x86_64 GNU/Linux Tried to install latest version of httpd which is 2.4.33. But it is not available for RHEL7. That's why I ...
1
vote
1answer
688 views

HTTPS without SSL VS HTTP [duplicate]

I'm working on local server for Linux repositories. We have been using HTTPS without SSL Verification for establishing connection between the Server and the Agents. Are there really any differences ...
1
vote
2answers
127 views

E-commerce website that uses plaintext HTTP but redirects to PayPal during checkout

I need to purchase a few items (t-shirts, dvds, etc.) on an old e-commerce website that hasn't been updated in a while and doesn't use HTTPS to encrypt data in transit. The website does not have any ...
1
vote
2answers
514 views

Basic Auth over HTTP redirected to HTTPS - does it leak?

I'm creating a Flask API and I'm somewhat unfamiliar with the attack surfaces that exist in redirecting from HTTP to HTTPS, or requesting HTTP when HSTS header has been sent previously. Lets say a ...
1
vote
0answers
142 views

Is there any value to encrypting connections to localhost? [duplicate]

This is related to this question: Do I need to encrypt connections inside a network?, but I'm taking it a step further. We have an application that uses a lot of microservices that are hosted on the ...
0
votes
1answer
140 views

Strange HTTP GET Requests

My server has a static IP and listens to a port (8000) when it get's a file it automatically saves it with predefined extension. It's an internal project and no one knows about this server. I see few ...
1
vote
1answer
825 views

Can you forward TLS connections according to SNI domain without terminating the connection at the reverse proxy?

I am developing an application that needs to expose two services: REST API with https and client certificate authentication (https://api.device.example.org:4431, server certificate issued by private ...
1
vote
0answers
45 views

Why doesn't a CORS preflight request cause another?

According to MDN documentation, every non-simple request is doomed to fall into an infinite recursion: I want to send a non-simple CORS request (with the verb PUT e.g.) My browser tries to send a ...
12
votes
1answer
1k views

Current status of SameSite cookie

Recently I got to know about SameSite cookie attribute which is used to mitigate the CSRF attacks. AFAIK SameSite attribute for cookies is implemented in Chrome and some other browsers. Since I'm ...