Archiv: Hypertext Transfer Protocol (HTTP) / versions


02.04.2022 - 17:50 [ Open Observatory of Network Interference (OONI) ]

New blocks emerge in Russia amid war in Ukraine: An OONI network measurement analysis

(3rd March 2022)

– Different censorship techniques. To block websites, OONI data shows that Russian ISPs adopt the following censorship techniques (beyond throttling):

– DNS manipulation, redirecting in some cases to blockpages
– HTTP man-in-the-middle, serving blockpages
– TLS man-in-the-middle
– Injection of a RST packet after the ClientHello during the TLS handshake (most prevalent)
– Timing out the session after the ClientHello during the TLS handshake
– Closing the connection after the ClientHello during the TLS handshake

04.09.2021 - 19:46 [ SecurityMagazine.com ]

Disappearing DNS: DoT and DoH, Where one Letter Makes a Great Difference

(February 6, 2020)

While both offer encryption of DNS data using the same TLS protocol, there are some very important differences:

– Protocol layering: while DoT is essentially DNS over TLS, DoH is in fact DNS over HTTP over TLS.
– Different port numbers: DoT traffic uses a dedicated port 853, and can thus be distinguished at the network layer. DoH uses port 443 (HTTPS) due to the protocol layering.
– Different capabilities: DoT is largely the same DNS as we know it, while DoH to an extent combines features of DNS and HTTP.

24.03.2021 - 16:22 [ SecurityMagazine.com ]

Disappearing DNS: DoT and DoH, Where one Letter Makes a Great Difference

(February 6, 2020)

While both offer encryption of DNS data using the same TLS protocol, there are some very important differences:

– Protocol layering: while DoT is essentially DNS over TLS, DoH is in fact DNS over HTTP over TLS.
– Different port numbers: DoT traffic uses a dedicated port 853, and can thus be distinguished at the network layer. DoH uses port 443 (HTTPS) due to the protocol layering.
– Different capabilities: DoT is largely the same DNS as we know it, while DoH to an extent combines features of DNS and HTTP.

24.03.2021 - 15:12 [ LinuxSecurity.com ]

6 ways HTTP/3 benefits security (and 7 serious concerns)

(29 Jun 2020)

HTTP3, the third official version of hypertext transfer protocol (HTTP), will not use the transmission control protocol (TCP) as did its predecessors. Instead, it uses the quick UDP internet connections (QUIC) protocol developed by Google in 2012.

24.03.2021 - 15:08 [ Jake Miller / labs.bishopfox.com ]

h2c Smuggling: Request Smuggling Via HTTP/2 Cleartext (h2c)

(Sep 8, 2020)

The revival of HTTP request smuggling has led to devastating vulnerabilities in our modern application deployments. An HTTP request smuggled past the validation of an edge server can lead to serious consequences, including forged internal headers, access to internal management endpoints, and a variety of opportunities for privilege escalation.

HTTP/2 (or HTTP/3) is a promising solution to the issues we’ve faced with request smuggling, but support for HTTP/1.1 isn’t going away anytime soon. In the meantime, we’re still in for more surprises from our good friend HTTP/1.1.

In this post, I demonstrate how upgrading HTTP/1.1 connections to lesser-known HTTP/2 over cleartext (h2c) connections can allow a bypass of reverse proxy access controls, and lead to long-lived, unrestricted HTTP traffic directly to back-end servers.