#http-headers

Webtech - Identify Technologies Used On Websites #CMS #Website #Hacking #Web

[ad_1]

We knew that there are already tools doing this, for example Wappalyzer or CERN’s WAD, but we wanted a modular tool capable of reading Wappalyzer database as well as an user-supplied one, since we often encounter new or custom web-frameworks. For this reason we developed the detection of uncommon HTTP Headers, which are not in the technologies database yet. Since during our penetration…

Fix: Nginx : strip header on HTTP, add header on HTTPS #dev #answer #computers

Nginx : strip header on HTTP, add header on HTTPS

I’m configuring an Nginx server so as to serve as a reverse proxy to serve a Django app (run on Gunicorn).

My problem is that I want my site secured with HTTPS, and so I want my Django app to be able to determine whether a connection is secure or not. I am using Django 1.4, so I do have access to the SECURE_PROXY_SSL_HEADER, which I configured as

Fixed: Amazon S3 not sending Content-Type header #fix #programming #computers

Amazon S3 not sending Content-Type header

I have an application that downloads content from various sources. It relies on the “Content-Type” header being set on images. The majority of web-servers do this correctly but it appears Amazon S3 server is not setting the Content-Type.

I assume Amazon servers are configured correctly so what could be the problem? Are these images not uploaded…

Solution: nginx passing back custom header #computers #development #dev

nginx passing back custom header

I have the following example

location / { proxy_read_timeout 2000; proxy_next_upstream error; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $http_host; proxy_pass_header X_CUSTOM_HEADER; proxy_redirect off; proxy_max_temp_file_size 0; proxy_pass https://prod; break; }

Now when i use…

Solution: What's the use of X-Powered-By, Server and other similar HTTP headers? #solution #programming #fix

What’s the use of X-Powered-By, Server and other similar HTTP headers?

What’s the use of Server, X-Powered-By and other similar headers? Looks like the consensus is they should be removed so that automatic vulnerability scanners doen’t immediately know which version of which software they’re dealing with and so automatic vulnerability discovery gets harder.

Are there scenarios where it is indeed…

Fix: Impact of Connection Close vs Keep-alive #answer #it #solution

Impact of Connection Close vs Keep-alive

I’m configuring our servers, and due to the nature of our load balancer, we can’t send connection keep-alive headers. I’m trying to determine the impact of sending these headers to both the end-user and the server. Will either one notice anything?

Answer [by Mircea Vutcovici]: Impact of Connection Close vs Keep-alive

Keep alive will greatly enhance the…

How to: Difference between `curl -I` and `curl -X HEAD` #programming #fix #dev

Difference between `curl -I` and `curl -X HEAD`

I was watching the funny server type from http://www.reddit.com with curl -I http://www.reddit.com when I guessed that curl -X HEAD http://www.reddit.com would do the same. But, in fact, it doesn’t.

I’m curious about why.

This is what I observe running the two commands:

curl -I: works as expected, outputs the header and exists.

curl -X HEAD: does…

How-to: nginx real_ip_header and X-Forwarded-For seems wrong #development #solution #programming

nginx real_ip_header and X-Forwarded-For seems wrong

The wikipedia description of the HTTP header X-Forwarded-For is:

X-Forwarded-For: client1, proxy1, proxy2, …

The nginx documentation for the directive real_ip_header reads, in part:

This directive sets the name of the header used for transferring the replacement IP address. In case of X-Forwarded-For, this module uses the lastip in the…