Collaborate Disseminate
We are implementing zipkin tracing in our product and have some hesitation about accepting and returning the propagation headers for publicly accessible http requests. The zipkin server itself is not publicly accessible. It seems very usef… Continue reading What are the security risks of trace context propagation headers?
In one of the applications I’m testing, the cookie contains the username (set:cookie: username) in the HTTP header. Is it possible to read these cookie values using any methods? The site uses HTTPS.
When I receive an email sent by someone using a webmail service (e.g. Gmail, etc.), I can find the IP address of the sender’s email server in the email headers.
But do the email headers also contain the IP address of the desktop (client) c… Continue reading Is the IP address of the client present in the email headers for webmail services and for desktop clients?
I’m assessing the security level of a webapp and one of the test cases is the CSP header. I always use the Google CSP evaluator to assess the header. Let’s consider the following CSP header:
Content-Security-Policy:
img-src ‘self’ https://… Continue reading Do object-src and base-uri bypasses still work on Content-Security-Policies?
A lot of websites scanned with securityheaders.io are missing different headers.
Should all of these headers be reported as findings or just few of them which are more critical?
Continue reading Should all the headers reported by securityheaders.io be considered as findings?
I am currently trying to learn HTTP Request Smuggling vulnerability to further enhance my pen testing skills. I have watched a couple of videos on Youtube and read articles online regarding it but still have a couple of questions in mind:
… Continue reading HTTP Request Smuggling Basics
In order to write an application for myself that prevents me from visiting websites that let me download files of a certain type, I am trying to find a way to reliably tell if an URL lets me download a file and if so then tell me the filen… Continue reading How could a software reliably tell if an URL makes me download a file and what its filename and mimetype are? (without downloading the file) [migrated]
E-waste is a gigantic problem, and it can seem impossible as a lone individual to make any kind of dent in it. But [akshar1101] is trying to do their part by looking past the defective aspects of broken, discarded electronics to draw out the possibilities of what’s left.
This friendly …read more
Can my IP address ever be included in the header of emails I send? Or do email servers never include my IP address in my emails’ headers?
My web application need to make call to 3rd party REST API which is protected by Basic authentication on some user click. We are planning to use a technical user for the call.
This will expose the Authorization header in network call in br… Continue reading Authorization Header in dev tools