Collaborate Disseminate
TLS unique value is present in TLS 1.2 version.
In Golang, I can get the value of the TLS unique value from the http response through the field TLS.
I’d like know how I can get it from Apache.
Is there an environment variable that already … Continue reading How to retrieve TLS unique value from Apache?
I am writing a mobile application for an already existing web app.
In the backend, I implemented the usual cookie-based session ID authentication. with a CSRF token generated on login and sent with each request in a custom header.
the prob… Continue reading Is it secure to use session ID as authentication token received from an HTTP header?
I have developed a website with codeigniter 3 and I have also updated it to the latest version of codeigniter.
My website has been hacked in the same way for several days.
The hacker puts two files in my root of host (public_html directory… Continue reading Codeigniter website is hacked regularly by an unknown method [closed]
With standard XSSI, an attacker can include a remote script which contains user-bound secrets across origins, and then read them out.
I have an endpoint which returns sensitive Javascript code, but the request to fetch it is POST-based (th… Continue reading Is POST-based XSSI possible?
We have recently developed a web application with a RESTful API backend. This web app need to have a certain security certification (something called PCI-DSS), and thus it is being scanned occasionally to identify potential vulnerabilities… Continue reading Why is the absence of a Content-Type header with a HTTP 204 response considered a security vulnerability and what should we do about it?
When I make a normal Python request to some site without any proxies, I get a 429 response, which is too many requests. However, when I open up Burpsuite proxy and add:
import requests
# Set up the proxies dictionary for Burpsuite
proxies… Continue reading Burpsuite proxy does not get HTTP error 429 but vanilla python requests do?
If I send an unknown domain name in the HTTP request header ‘Host’ to a webserver and the webserver responds with a HTTP status code 301/302 (redirect) along with a HTTP response header ‘Location’ reflecting my initial Host header input.
D… Continue reading Is a random unknown HTTP request header ‘Host’ that is reflected in the HTTP response ‘Location" header (3xx) a open redirect or DNS rebinding?
I’m looking into the risks associated with the use of the HTTP ‘Etag’ header and found the following relevant information already.
Information Disclosure (inodes)
This article titled: "Vulnerabilities that aren’t. ETag headers" f… Continue reading Should the use of the HTTP ‘ETag’ header be avoided for security and privacy concerns?
As of 2023, still many webservers support HTTP/1.0 and HTTP/1.1 while not supporting recent HTTP/2 and/or HTTP/3 protocols. I understand that newer HTTP versions offer various performance enhancements, but I’m particularly interested in th… Continue reading What security risks are involved in using older HTTP protocols such as HTTP/1.x that would justify upgrading to HTTP/2 or HTTP/3?
I’m exploring the history and evolution of the HTTP protocol and I know that HTTP/0.9 is generally not used anymore. It’s clear how features evolved in newer HTTP versions and how primitive HTTP/0.9 actually is with no support for headers,… Continue reading Is HTTP/0.9 considered "End-of-Life" (EOL) due to security vulnerabilities or risks?