Collaborate Disseminate
We have 3-4 S/4 HANA applications in our environment and want to enable HTTP Security Headers, but couldn’t figure out how to go about it. We then approached SAP directly and even their solutions are not working, and their support team has… Continue reading Enabling HTTP Security headers in S/4 Hana web applications
I use an Apache proxy to funnel traffic to an IIS server. The IIS server sends me emails if some bad actor attacks my site with an sql injection attack. It captures their IP address, and sends me the URL that was used.
The other day I got … Continue reading How to best limit SQL injection attacks that are being funneled through an Apache proxy I control
I’m currently doing research on evasion attacks that seek to bypass a Deep-learning based Network Intrusion Detection System.
In order to achieve this, I need to know what the constraints are for the TCP window size field in the TCP packet… Continue reading What happens if a sender changes the TCP window size over multiple packets that have the same ACK number?
How can i set a custom header using javascript or php? I am trying to add a custom header to my html form but i’m new to programming so i’m still learning.
I’d like to add a custom header to my form and my current form code is this one:
&l… Continue reading how can i set a custom header with javascript or php?
This is an unconventional approach of CSRF that I came across while doing the pentest for an Android mobile application. The original request is as follows (NB: Values have been edited):
POST /edit/ HTTP/1.1
User-Agent: example Android (22… Continue reading CSRF Bypass using User-Agent
Can somebody confirm me that the HTTP-XXS-protection header and the X-content-type header is useless in the case of a REST api who provide only json to clients ?
Can someone explain me why exaclty ?
Thanks.
In the security test report, I have a recommendation to add Expect-CT header to the HTTP response from web application, additionally developers set this to:
Expect-CT: max-age=0, report-uri=
I am not sure if it is a good idea to add this… Continue reading Adding Expect-CT header to HTTP response
I have a MVC web Application which is hosted on IIS10. During vulnerability scanning it is noticed that the application supports Host Header Injection. The application domain allows to redirect to mallicious domain when it is intruded by … Continue reading Host header injection IIS [closed]
If i know the value of bearer token of the victim, can i generate a get csrf page and set a custom Autorization: Bearer [token] header?
Continue reading Is CSRF possible if i know the value of the authorization bearer token?
Looking for recommendations for security in sending token (e.g. JWT Token) through a GET vs POST request to the server.
There are two options:
Sending token through Headers as part of HTTP GET request
Sending token via request Headers… Continue reading Sending token through GET vs POST