Why should I use HSTS?

HSTS lets you avoid man-in-the-middle (MITM) attacks that use SSL stripping. SSL stripping is a technique where an attacker forces the browser to connect to a site using HTTP so that they can sniff packets and intercept or modify sensitive information. HSTS is also a good method to protect yourself from cookie hijacking. Read more about man-in-the-middle attacks (MITM) .

When your browser tries to connect to an HSTS-protected site using HTTP, it is redirected to an HTTPS site. Then, the browser receives an HSTS header. From this moment, your browser will remember to only use HTTPS when connecting to this site and will not try HTTP anymore (for a time defined in the HSTS header, usually a year). Watch a Google Developers video about HSTS .

What is HSTS preloading and how to use it?

To make sure that your users are protected from the first time that they visit your site, you may add your site to the HSTS preload list in the browser. This means that the next version of the browser will include your site on a static list of sites that are only to be loaded using HTTPS. However, begin by reading this article carefully to learn how to prepare and what are the consequences of HSTS preload. Add your HSTS site to the HSTS preload list .

Web Security Blog | Page 40 of 140

What Is HSTS Used for? – problems, errors, fixes

Web Security Zone | May 8, 2019 by Tomasz Andrzej Nidecki

HSTS stands for HTTP Strict Transport Security. It is a method used by websites to declare that they should only be accessed using a secure connection (HTTPS). If a website declares an HSTS policy, the browser must refuse all HTTP connections and prevent users from…

XML External Entity Vulnerability in Internet Explorer

Web Security Zone | May 7, 2019 by Tomasz Andrzej Nidecki

When exploiting a typical XML External Entity (XXE) vulnerability, the attacker attempts to gain access to the content of files on a Web server. However, XXE vulnerabilities may also allow the attacker to steal private data from the user. Such a case was recently discovered…

Bypassing SOP using the browser cache

Web Security Zone | April 30, 2019 by Aleksei Tiurin

Misconfigured caching can lead to various vulnerabilities. For example, attackers may use badly-configured intermediate servers (reverse proxies, load balancers, or cache proxies) to gain access to sensitive data. Another way to exploit caching is through Web Cache Poisoning attacks. The browser cache may look like…

Visit Us at the Malta A.I. & Blockchain Summit 2019

Events | April 29, 2019 by Tomasz Andrzej Nidecki

Acunetix will be exhibiting at the Spring Edition of the Malta A.I. & Blockchain Summit. The event will take place on May 23-24 at the Hilton Business Centre in St. Julian’s in Malta. The summit focuses on AI, Big Data, Blockchain, IoT, and Quantum Technologies…

Session Token in URL Vulnerability

Web Security Zone | April 25, 2019 by Bernhard Abele

The HTTP protocol and web servers are stateless by nature. This means that there is no way for them to track user activity. The web server treats every request as a new one. For this reason, browsers and web servers need to use session tokens….

Common Injection Attack Types, Examples, Prevention

Web Security Zone | April 18, 2019 by Ian Muscat

Injection Attacks Injection attacks refer to a broad class of attack vectors. In an injection attack, an attacker, sometimes with the use of automated hacking software, supplies untrusted input to a program. This input gets processed by an interpreter as part of a command or…

What is Code Injection (Remote Code Execution)

Web Security Zone | April 15, 2019 by Ian Muscat

Code Injection or Remote Code Execution (RCE) enables the attacker to execute malicious code as a result of an injection attack. Code Injection attacks are different than Command Injection attacks. Attacker capabilities depend on the limits of the server-side interpreter (for example, PHP, Python, and…

Remote Code Execution in bootstrap-sass Ruby Package

Web Security Zone | April 11, 2019 by Tomasz Andrzej Nidecki

If you are using Ruby to develop applications, run the latest update of Acunetix to make sure that you are safe. A very popular Rails gem bootstrap-sass was recently compromised. A malicious version of the package (3.2.0.3) was available in the official RubyGems repository for several…

Mutation XSS in Google Search

Web Security Zone | April 10, 2019 by Tomasz Andrzej Nidecki

Are you sure that your website is safe from Cross-site Scripting if Google Search was not for five months? On September 26, 2018, one of the developers working on the open-source Closure library (originally created by Google and used in Google Search) created a commit…

Acunetix Web Security Blog