Questions tagged [http]

Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.

Filter by
Sorted by
Tagged with
2 votes
1 answer
543 views

Man in the middle using HTTPs downgrade to HTTP

In general browsers attempt to establish a HTTPs-Connection if possible. How would you force a browser to fallback to HTTP when somebody enters asdf.xyz in the search bar of his/her browser without ...
user avatar
0 votes
2 answers
146 views

HSTS without auto-upgrading HTTP to HTTPS [duplicate]

I have a website hosted at https://example.com/mysite. If you navigate to http://example.com/mysite, you get a 404. Everything that comes in over HTTP gets 404'd. I was dinged on a security audit ...
user avatar
6 votes
5 answers
5k views

Why doesn't a simple HTTP request to display a remote web page violate the same-origin policy?

On a W3Schools page, I found that HTTP requests work like this: A client (a browser) sends an HTTP request to the web A web server receives the request, and runs an application to process it The ...
user avatar
13 votes
3 answers
5k views

What risks am I taking by using an http site to play a video game that just records mouse events?

There's this game at http://slither.io which I like to play. Only inputs that I give to it are space bar, and cursor location. It's not https. Are there any risks?
user avatar
  • 249
0 votes
1 answer
108 views

Update URL over HTTP

I saw VLC (Windows) gets updates from an unencrypted URL: HTTP, not HTTPS! Do you think there's a risk for a man-in-the-middle attack?
user avatar
32 votes
1 answer
7k views

"google.com" is not HSTS protected?

Issue: Oftentimes people enter google.com directly in the browser's address bar without including either the http:// or https:// prefixes. Using Chrome DevTools on a fresh incognito session, I ran the ...
user avatar
  • 694
2 votes
1 answer
144 views

Does a website's session key have to be unguessable if it's signed?

I'm creating (what I believe to be) a cryptographically hard to guess session key to keep my users logged in by generating 32 random bytes (using crypto.randomBytes). I'm storing this in a cookie (as ...
user avatar
  • 121
1 vote
0 answers
35 views

Security Concerns with HTTP/3 / QUIC-based protocols [duplicate]

I've been seeing a large number of companies, including Cloudflare who just sent out a notice to their customers about enabling HTTP/3 via QUIC recently, touting HTTP/3 based on QUIC as 'much better' ...
user avatar
0 votes
2 answers
123 views

Is it safer to send cookies in headers than the URL?

I have a browser extension. I would like to use this browser extension to send the cookie from site A to site B. I’m doing this because I want to scrape site A from site B, but this is obviously a use ...
user avatar
  • 135
0 votes
3 answers
162 views

Https - why isn’t the initial connection encrypted / how to avoid initial suspicion?

So with https, someone can still see what website I visited, but not which pages within that website I visited, correct? why isn’t the whole process of connecting to a website - from when I start ...
user avatar
0 votes
2 answers
135 views

Can we read HTTP cookie value? [closed]

In one of the applications I'm testing, the cookie contains the username (set:cookie: username) in the HTTP header. Is it possible to read these cookie values using any methods? The site uses HTTPS.
user avatar
0 votes
1 answer
350 views

Nessus Plugin "HTTP Smuggling Detection" failing due to support for http/1.1 - how to overcome?

A new Nessus plugin (140735 - HTTP Smuggling Detection) was very recently incorporated into Tenable's PCI template and is now beeing flagged as a "medium" vulnerability and causing scans to ...
user avatar
  • 103
1 vote
1 answer
165 views

Exploit HTTP arbitrary methods

A web server allows to use HTTP methods like DAMN, FUCC, PASTA with the same effect as a GET request: for example executing GET /this.txt brings to the same result as PIZZA /this.txt. Is ...
user avatar
  • 487
0 votes
0 answers
312 views

Is this HTTP authorization token secure?

I am new to backend development and read about Authorization methods such as Basic, Bearer and OAuth 2.0. I haven't use any of these directly, but used a token based implementation. User logs in with ...
user avatar
  • 1
2 votes
1 answer
131 views

Should the Secure cookie flag also be set on HTTPS only websites?

Should the cookie secure flag be set on websites which are served only through HTTPS? The Secure attribute tells the browser to only send the cookie if the request is being sent over a secure channel ...
user avatar
  • 487
1 vote
1 answer
125 views

How to prevent HTTP header injection attack in J2EE Web application? Is there any library (Maven dependency) available for this purpose?

My J2EE application is vulnerable to HTTP header injection attack. I want to make it secure from this vulnerability. Also, I am searching if any library (Maven dependency) available for this.
user avatar
  • 11
1 vote
3 answers
117 views

Should all the headers reported by securityheaders.io be considered as findings?

A lot of websites scanned with securityheaders.io are missing different headers. Should all of these headers be reported as findings or just few of them which are more critical?
user avatar
  • 487
0 votes
2 answers
393 views

HTTP Request Smuggling Basics

I am currently trying to learn HTTP Request Smuggling vulnerability to further enhance my pen testing skills. I have watched a couple of videos on Youtube and read articles online regarding it but ...
user avatar
0 votes
1 answer
122 views

Internal HTTPS recommended security practices

So I'm by no means a security expert. I'm just a recently graduated software developer who is working on a contract project and I want to ensure I'm taking appropriate security measures for my client. ...
user avatar
  • 101
0 votes
1 answer
6k views

how can I bypass recaptcha while using python requests? [closed]

How can I bypass the recaptcha on a website with python requests so that I don't have to solve it?
user avatar
-1 votes
1 answer
1k views

How can I fuzz a http server? [closed]

I was researching fuzzing using AFL and hongofuzz and they mainly support applications that run in the terminal. After that I came across a list of resources for network fuzzers, and found afl-net ...
user avatar
0 votes
1 answer
1k views

How do I redirect HTTPS site to another HTTPS site over LAN using a linux? [closed]

Is there a tool, or a command for linux that can make possible to redirect HTTPS site to another HTTPS site on LAN? i'm using Kali Linux, and all the tools and commands that i found was to redirect ...
user avatar
  • 1
-1 votes
2 answers
569 views

Ensure Http request comes from a Android/IoS mobile app to server? [duplicate]

Say I build a mobile app. For the sake of the example, the app is an Android App and let's call it the Client And this mobile app communicates with a server application. For the sake of this example, ...
user avatar
  • 185
0 votes
1 answer
879 views

TLS 1.2 and HTTPS [duplicate]

This question may be silly but I've a hard time understanding TLS 1.2 and accessing a website via HTTPS. I've received a report from a web security tool that my website is not HTTPS and I have to ...
user avatar
  • 1
2 votes
2 answers
718 views

MITM attack with HSTS implemented websites

I want to perform a Man-in-the-Middle attack against my own network for educational purposes. I want the following scenario: Perform a MITM attack with Bettercap, navigate to a website and accept the ...
user avatar
0 votes
2 answers
459 views

How to understand a single packet embedded with multiple requests?

When I read Multi VERB Single Request: This Attack is also a variation of the Excessive Verb Attack strategy. The attacking BOT creates multiple HTTP requests, not by issuing them one after another ...
user avatar
0 votes
1 answer
101 views

Encrpyting HTTP sensitive data without SSL certificate

I am implementing a server that contains most of the information the clients have to retrieve. Sensitive information has to be exchanged between client and server, and due to this, I would like to ...
user avatar
1 vote
1 answer
234 views

Does sslstrip have to do something with Bettercap's certificate?

I am trying to perform a MITM attack using bettercap against a website that doesn't have the HSTS security policy implemented at all. When I try the following command: bettercap -T ...
user avatar
0 votes
1 answer
78 views

Initial requests sent over HTTP by default [duplicate]

Before the invention of HSTS security policy, if a user didn't specify the protocol in the URL, were all the initial requests sent over HTTP by default for every website?
user avatar
3 votes
2 answers
3k views

Can we use CORS policy to restrict API calls from native mobile app?

We can use CORS to restrict API calls to a specific host in a web app. How to do the same for native mobile app? I want to restrict API calls from my app alone. Is it possible to do so?
user avatar
  • 133
0 votes
1 answer
223 views

CSP Violation ms-appx-web://

We have a java application which allows users to upload attachments and save it on the server. The application has a content security policy defined like this: base-uri 'self'; child-src 'self'; form-...
user avatar
  • 113
0 votes
0 answers
2k views

How to Spoof JA3 Signature?

I am using python requests library to make HTTP calls. However website bot detection is using JA3 fingerprint verification and blocking me. Is there any way I can spoof the JA3 signature.
user avatar
  • 1
0 votes
0 answers
55 views

the difference between SSL pinning and using just HTTPS connection [duplicate]

I know that if i used HTTPS the connection will established after the handshake so (the user will ping the the link then the server will give him public key so the client can provide him with ...
user avatar
0 votes
1 answer
241 views

Why http microsoft connection in netstat check?

I checked established connections with "netstat" command in command prompt, and I found that there are some connections with ip's of microsoft (I checked ip online) that have http (and not ...
user avatar
  • 3
-2 votes
1 answer
366 views

HTTP/3 No more TLS or TCP [closed]

I was reading documentation about HTTP/3, and in the article, they sed that they are no longer TLS or TCP. So it's mean that a web site with no SSL 80 will be changed to what port and 443 will be ...
user avatar
2 votes
2 answers
956 views

Does content-type header having a blank value in the response body, cause any security problem?

I have one HTTP request which is responding with no content value (No response body). Is it necessary to have a content-type header specified for these kinds of responses?
user avatar
1 vote
2 answers
235 views

How to know if an RFI/LFI attack was successful?

Let's say that an attacker wants to search websites for RFI/LFI vulnerability with a script, he's fuzzing the URL with a list of remote/local files. And he prints the headers that return from the ...
user avatar
9 votes
1 answer
989 views

Does HTTP/2 prevent security vulnerabilites like CRLF injection?

Which vulnerabilites does HTTP/2 prevent? More specifically: Does it prevent HTTP request smuggling? Does it prevent HTTP response splitting / CRLF injection?
user avatar
2 votes
0 answers
543 views

HTML Injection to blind SSRF testing retrieves only DNS Query

I recently came across an application that was vulnerable to HTML injection on the invite function. When I insert <img src="image.jpg"> the image got rendered on the mail I received. I ...
user avatar
0 votes
2 answers
171 views

Can a Slow Post HTTP attack be done from a single client?

Can a Slow Post HTTP attack be done from a single client? The following source cites this line: https://medium.com/fantageek/understanding-socket-and-port-in-tcp-2213dc2e9b0c Ports are 16-bit numbers,...
user avatar
  • 1
0 votes
3 answers
1k views

Is http to https port forwarding a vulnerability? [duplicate]

I work in an organisation where a TMG server with port forwarding has been used successfully for a number of years to forward all http traffic to https for a particular web application. This meant ...
user avatar
  • 3
0 votes
1 answer
283 views

Hydra brute-force login with a timestamp

I am attempting to run a brute-force attack on my router just as a proof of concept and have hit a problem in that the POST request requires a parameter of the current timestamp. Here is my current ...
user avatar
2 votes
0 answers
853 views

Unable to start reverse shell over HTTP

I am able to get a reverse shell working locally over TCP, but failing to trigger it remotely over HTTP. Locally over TCP: Attacker terminal runs netcat to listen for a connection over port 8000: nc -...
user avatar
  • 21
6 votes
6 answers
3k views

Best guidance for allowing users to connect via HTTP in case of a certificate error

I've coded my app to use https, but if a https transaction fails for any reason, I assume it's because the server isn't configured for https, and thereafter start all transactions with http. Seems ...
user avatar
  • 1,964
1 vote
2 answers
94 views

Solution to User Initial HTTP Requests Unencrypted Despite HTTPS Redirection?

It is my understanding that requests from a client browser to a webserver will initially follow the specified protocol e.g, HTTPS, and default to HTTP if not specified (Firefox Tested). On the server ...
user avatar
-1 votes
2 answers
608 views

What is the real risk of clicking a link? [closed]

If I were to click a link on any of my devices, be it over text message, email, or from a webpage, and enter no information/actions with the target page. What is the worst that could happen?
user avatar
16 votes
7 answers
17k views

Are URL parameters of GET and POST requests over HTTPS secure?

It's well known that GET requests with ?xx=yy arguments embedded can be altered in transit, and therefore are insecure. If I change the request to POST, and use HTTPS, then the parameters are in the ...
user avatar
  • 1,964
0 votes
0 answers
138 views

How can a SOCKS5 proxy know client's datetime?

It seems that SOCKS5 proxies somehow know the client's timezone (at least) or maybe even the precise datetime. I determined this because the proxy tears the connection in case the local timezone on ...
user avatar
1 vote
0 answers
102 views

Can server-side caching misconfiguration lead to stolen logins?

If a webapp sends Cache-Control: private it shouldn't be cached for example with nginx proxy_cache. What could happen if it was cached anyhow? Could another visitor see the personalized login of ...
user avatar
  • 660
1 vote
0 answers
129 views

Why are browsers making PUT requests for static assets on my site?

Our site hosts static assets at /assets/…. In debugging a font-related issue, I looked through our logs for unusual activity. I found a bunch of requests like these method path ...
user avatar

1 2 3
4
5
28