We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [http]

Definition: HTTP - the Hypertext Transfer Protocol - provides a standard for Web browsers and servers to communicate. The definition of HTTP is a technical specification of a network protocol that software must implement. HTTP is an application layer network protocol built on top of TCP. HTTP clients (such as Web browsers) and servers communicate via HTTP request and response messages. The three main HTTP message types are GET, POST, and HEAD.

Filter by
Sorted by
Tagged with
3
votes
2answers
1k views

List of sites that still dont support HSTS?

I'm working on an article for work and seeking a list of the top ~500 websites (ranked by Alexa) that still don't have support for HSTS. Does such a list exist? I'm not getting any interesting hits ...
16
votes
2answers
2k views

Security benefit of browsers automatically rewriting HTTP to HTTPS? [duplicate]

I often use a guest WiFi which does the usual intercept; attempt to navigate to any HTTP website and it redirects you to the "Agree to our ToS" page, after which it will permit any traffic from your ...
-1
votes
2answers
397 views

What do DoS/ DDoS TCP SYN Floods and Layer 7/HTTP floods look like on a firewall log?

I am looking for some examples of log files for DoS or DDoS attacks that show a SYN Flood or a HTTP/Layer 7 Flood. I have had a google, but can't seem to find anything. Would the incoming packet ...
4
votes
1answer
727 views

Is some kind of CSRF possible using img/script tag to read sensitive information

Let's say i have an API at https://mysite/api/getSensitiveData that: Uses GET Protected with cookie authentication Returns JSON with some sensitive data A bad guy creates a site on his server that ...
4
votes
1answer
827 views

BeEF XSS - internal working

I am studying BeEf XSS as I think it is a very interesting tool for a penetration tester, but I have a couple of doubts about it, in particular when linking it to Cross Domain Request. So, in some ...
3
votes
2answers
127 views

Is switching protocols a security measure worth implementing?

We deploy our internet facing applications in multiple vlans and there is a rule that talking from one vlan to the next has to be done in another protocol or an other implementation of the protocol. ...
2
votes
2answers
81 views

Why return successfully to non-allowed origins

As I understand it, with CORS, on cross-origin requests, the browser will send an Origin header, and if the origin isn't allowed, the server will still send back a 200 response with a non-matching ...
4
votes
1answer
476 views

Linksys Router Tried To Access Local Website

I'm running a simple Node.JS HTTP server on my computer to test things before I push them to my real server, and forgot to close it when I stopped using it. I just looked at the logs and it shows ...
-1
votes
2answers
117 views

Why have distributions default HTTP package sources instead of HTTPS [duplicate]

Many distributions have HTTP links in their sources list for packages. Proof: https://docs.parrotsec.org/doku.php/mirrors-list https://docs.kali.org/general-use/kali-linux-sources-list-repositories ...
-3
votes
1answer
241 views

Wireshark showing HTTP on top of TLS

I am seeing an HTTP request on top of SSL in Wireshark. Can anyone explain why?
-3
votes
2answers
316 views

Reverse DoS Attack [closed]

Is there anything on a computer or a router that prevents a hacker from doing a DoS on you. So let's say that you are going to https://www.google.com/. When you enter that in the search bar, it sends ...
4
votes
1answer
712 views

Highly anonymous proxies vs anonymous proxies

From this link about highly anonymous proxies: There’s another type of anonymous proxy called Highly Anonymous Proxy. The main difference with this one is the fact that aside from hiding your IP, ...
7
votes
2answers
257 views

What are the potential vulnerabilities of allowing a large http body size?

With NGINX and PHP I am allowing 5GB files to be 'uploaded' to my server although they will not be downloaded unless they are 'legitimate' (that is for another question ;)). I was wondering is this is ...
1
vote
2answers
116 views

CORS clarification

I need some clarifications about the problems that CORS (Cross-Origin Resource Sharing) can cause. Let's suppose that site A.COM has enabled CORS, in particular: Access-Control-Allow-Origin can be ...
1
vote
2answers
114 views

Is my password compromised?

I just tried to reset my password on radioooooo.com. I didn't really pay attention to firefox's warnings because I'm used to see them on our intranet at work, but I think that when clicking the "OK" ...
20
votes
2answers
2k views

Is there any point in setting the secure cookie flag for HSTS websites?

If my website has HSTS and forced HTTPS (i.e. user won't be able to access the plain HTTP version of the website), is there any point in setting secure: true for the cookies?
2
votes
1answer
708 views

What's so special about `eval(“z!ax”)`?

While checking out some error logs for our site, I noticed one odd-looking request that provided many parameters that we don't use: 'q' => 'die(\'z!a\'.\'x\');', 'w' => 'die(\'z!a\'.\'x\');', '...
0
votes
0answers
2k views

Prevention of host header injection in ASP.NET?

How can we mitigate host header injection in ASP.NET? I have already configured application binding in IIS and set static hostname but still, the vulnerability exists.
-1
votes
1answer
121 views

Passing a secret in url: as a part of the url or query string? [duplicate]

If I need to make get request to an html page and thus pass a secret via the url using https, is it true that I'd need to pass it in a query string versus a part of a path url? my_domain.com/some_url/...
5
votes
1answer
243 views

How to prevent MITM session fixation attack over plain HTTP upon first request?

Websites has various methods implemented to tell browser to always use HTTPS - HSTS header, server redirec to HTTPS, CSP policy. However, the first time a user visits the site it can be over palin ...
1
vote
0answers
683 views

How to decrypt encrypted post data of an Android app? [closed]

I've seen many Android apps which send encrypted post data, tools like Fiddler and Burp can't decode that data, is there any other tool or method that can decrypt this obfuscated post data? For ...
1
vote
0answers
357 views

THC Hydra false positives on Foscam login

I bought a Foscam C1 Lite this week and I want to try to brute force the login page with THC hydra. But currently I am getting false positives with the following command: hydra -s 88 -l user -P ...
13
votes
4answers
5k views

Accessing multiple sites via HTTPS produces different, unrelated content (Peugeot club via HTTPS)

I've come across a random website Moodoo.cz. The interesting thing is that if you access it via the HTTPS: Moodoo.cz, the content completely changes. It is not that unusual - I guess server can serve ...
4
votes
1answer
3k views

How come I can see a full HTTPS requests via Fiddler?

I am testing a C# web API hosted on a remote server, and I am monitoring HTTPS traffic using Fiddler. What confuses me is that via Fiddler I can see all of the POST payload, headers and host URL ...
2
votes
1answer
100 views

Is my application affected by curl vulnerabilities if using HTTPS with a single server?

To this day two vulnerabilities are known in curl 7.57.0. Both are related to HTTP: HTTP authentication leak in redirects HTTP/2 trailer out-of-bounds read My application uses this version of curl ...
1
vote
0answers
222 views

Invalid certificate error appears on my web server for 10 minutes and then disappears

I have a raspberry pi that hosts a web server and has a DDNS registered through no-ip. I just had an issue connecting to my webserver because a certificate appeared to be installed on this server that ...
3
votes
2answers
488 views

What does the CSP require-sri-for directive protect against?

According to Mozilla: The HTTP Content-Security-Policy require-sri-for directive instructs the client to require the use of Subresource Integrity for scripts or styles on the page. I fail to see ...
0
votes
1answer
1k views

Do we need to set the X-Frame-Options header for JS files too?

I have added the X-Frame-Options header for my HTML files from web server itself. Do I still need to add it for other static files like CSS and JS( which I serve from cloudfront/s3) ?
2
votes
1answer
81 views

Decoding requests from potentially malicious Android app

I have recently been doing some security evaluation work on our Android applications, by proxying all the communication through Burp Suite. I noticed one of our devices was sending requests to a ...
0
votes
1answer
840 views

Array in HTTP GET/POST requests

In PHP server programming, URL-encoded GET/POST requests are parsed into associative "array" type upon receiving. For most of the time, query arguments can be assumed to be strings, however sometimes ...
5
votes
1answer
2k views

Refresh tokens with SPAs

We've been working with SPAs which POST through credentials to the API and receive back a JWT (access token) and refresh token. The tokens are stored, depending on the 'keep me logged in', in session ...
3
votes
1answer
111 views

What information in sent in the clear when git redirects from HTTP to HTTPS?

If a user tries git commands pointed at an http://gitlab.example.com address (and they have not connected to this domain before), the gitlab.example.com server redirects (or rewrites) to https://...
2
votes
0answers
1k views

how to fix Out-of-band resource load (HTTP) issue identified by BURP scan

I have Salesforce application which is using my web application hosted in one of our customer's server (IIS 8.0). BURP Scan has identified one issue in my web application. Issue is something like ...
0
votes
1answer
87 views

Avoiding redirects

I'm working on a site where users can input URLs. The URLs should point to sites where you can buy an item (for birthday/special event/...) It also sends out mails to e-mail addresses the user ...
0
votes
2answers
76 views

Is securing Apache with SSL certificates enough to protect all of the underlying applications? [duplicate]

I have a few applications that serve HTTP content on localhost. I have installed apache and configured reverse proxy so that apache routes all the traffic to the underlying applications based on URL ...
1
vote
1answer
413 views

Impersonating Client Certificate Authentication with Same Subject Name

I am looking into the security of a service which uses client certificates for authenticating only known callers. We run a C# Web API Service that checks every request certificate subject if it is ...
1
vote
1answer
123 views

Best way to secure local REST server?

Currently I have a raspberry pi connected to my home security system. I have written a Python daemon running a HTTP server (very insecure I know, but this is still under construction) so I can send it ...
6
votes
2answers
352 views

What is the risk of using http on an internal webserver?

We have a web server exposed to the internet, it uses SSL/https. Requests to this server are redirected through a firewall to a back end web server which only uses http. That server has access to the ...
-1
votes
1answer
1k views

Do I need SSL/TLS for TCP

It might sound stupid but I could not find the straight answer. Do I need to worry about communication security if I use only TCP socket to communicate between 2 machines? Is the byte stream can be ...
0
votes
1answer
609 views

Web server responding to an HTTP request from a spoofed IP address

Hypothetically speaking - if my web server gets an http request for a given file, say default.html, and let's say the requesting IP address has been spoofed, what happens when my server responds to ...
2
votes
1answer
705 views

Is CSRF token validation required for http method other than POST and GET? [duplicate]

If I set actions for logged in users to be performed through HTTP methods other than GET or POST, then Javascript HTTP requests respecting the Same Origin Policy (SOP) or Cross-Origin Resource Sharing ...
1
vote
2answers
193 views

Is HTTP secure within a WPA2-PSK connection?

I'm running a small, low power web server chip which creates a Wi-Fi access point using WPA2-PSK AES encryption. This chip is never connected to the public Internet or any other network. A client ...
5
votes
3answers
1k views

Upgrade-Insecure-Requests as an alternative for HSTS

I have seen that websites automatically transform HTTP requests into HTTPS without the HTTP Strict Transport Security (HSTS) Header. So does the following line in the request fully alleviate the ...
1
vote
0answers
24 views

Concerns when passing all OPTIONS requests through authorization proxy gateway

I have a React based application which uses RESTful services on backend distributed on private network. To communicate with such services using AJAX, client application sends all its request through ...
2
votes
1answer
257 views

(Issue) Unusual ads on HTTP websites

Most of the things written here is based on my current knowledge of networking, Any kind of help would be appreciated. I am facing an issue regarding ads on websites not secured with HTTPS (this is ...
2
votes
2answers
127 views

Is there any way to authenticate a HTTP client only once?

I'm working on an application that acts as a back end (REST API) for a Google Chrome extension. Data is supposed to be sent from and to the client. The way it works is: The data that comes from the ...
31
votes
3answers
4k views

Should domains which only make redirects (aka tiny urls) be encrypted (https)?

For this question I will use the following domains: example.com - an online shop exmpl.com - a domain which is used for sharing items. exmpl.com will be used for redirects (e.g. http://exmpl.com/foo ...
2
votes
3answers
149 views

What are some potential attacks that could be done to a website that doesn't manage url-encoding properly?

A month or so ago I was in the middle of one of my "Distributed Applications" classes and the professor was explaining us how to """properly""" authenticate users in a server. To demonstrate how to ...
4
votes
0answers
121 views

How can I properly secure the WiFi setup process of an IoT device?

My company develops a WiFi-connected IoT product. I want to make sure that the process of getting the user's WiFi credentials into the device is as safe as possible. At the moment, the product is in a ...
5
votes
2answers
252 views

What tool(s) can be used for MitM in a controlled environment to decrypt+relay HTTPS over MTLS traffic with SNI?

I have a fully controlled environment (routing, DNS, CA, private keys, certificates) between two closed appliances that communicate over HTTPS. The traffic is over a mutual TLS authenticated channel, ...