Collaborate Disseminate
If client/browser trying to access http via 80, most likely it will be redirected to https/443 due to server configuration.
Will browser actually automatically establish new connection to port 443 or reuse the previous connection?
How exac… Continue reading Will browser establish new TCP connection when being redirected from http to https? [closed]
I am trying to connect to a supplier API but they have a whitelist of the IPs which can consume their API. I gave them my server IP so that they could add it to the whitelist but it is still not working.
I suspect this is coming from my company proxy which hides IP, so I did some tests : weirdly enough, I noticed that the real IP of my server could not be detected on most websites like “who.is” or “whatismyipaddress.com”. But as soon as I would try the same thing on websites using HTTP such as “http://www.mon-ip.com/en/my-ip/”, then the proxy is detected and my server IP is found out.
I don’t have a very deep understanding of HTTP and HTTPS so I have no idea how using http makes it possible to detect the proxy and find out the real IP. I tried checking request headers and it doesn’t seem that the IP is transmitted in HTTP requests…
I’ve looked up some topics on SO and couldn’t manage to find anything closely related to that matter (best I found was How can a website find my real IP address while I’m behind a proxy? which is somehow confusing me even more). Would someone be able to enlighten me on how http makes it possible to detect proxies and find out the real IP being used ?
Continue reading Why is my IP address hidden over HTTPS but not HTTP while I’m behind a proxy?
If a webpage is served over https and to authenticate it receives both login and password as unencrypted POST parameters (free text) is it considered unsafe?
Continue reading Authenticating with unencrypted POST credentials – is it safe? [duplicate]
I’m using nginx here as an example, but this is really more of a conceptual question about SSL termination and TCP that could apply to any web server.
Basically, if web server A receives TCP traffic on port 443 (the first nginx config) and… Continue reading When passing through SSL from web server A to web server B (via nginx), does web server A need SSL configured as well, or just web server B?
Is there a way to find the different HTTP methods from an API URL? For example, api.apithing.com/<method call>
I am looking for different POST requests.
In a web mvc application I have the user login and then he is navigated to a View which presents some data fetched from the database based on a unique Id of the user. He can continue to other views to get more details etc.
After authentica… Continue reading Altering requests after authenticating
I’m not an expert of security.
I heard it’s not recommended to enable GZIP compression for HTTPS requests, that would open a security issue (see SO answer: https://stackoverflow.com/a/4063496/17307650 and https://en.wikipedia.org/wiki/BREA… Continue reading Gzip only request body of HTTPS request security BREACH?
I’m currently playing with cmd.jsp webshells on a Java webapp in tomcat.
This is the request (sending via burpsuite)
PUT /path/cmd.jsp HTTP/1.1
Host: 69.69.69.69
Content-Length: 579
<%@ page import="java.util.*,java.io.*"… Continue reading cmd.jsp – Tomcat – Understanding HTTP Status Code (302)
Can someone explain the difference between the Access-Control-Allow-Origin header and the Cross-Origin-Resource-Policy header?
According to MDN:
The Access-Control-Allow-Origin response header indicates whether the response can be shared … Continue reading Security Headers: Access-Control-Allow-Origin vs. Cross-Origin-Resource-Policy (CORP)
If I have sensitive HTTP routes that could be subject to timing attacks (trying to guess an ID, user, etc.), is there a way without modifying the application code that it could be wrapped with a network tweak, proxy, or some other program … Continue reading Is there a generic way to prevent HTTP timing attacks for sensitive requests?