Privacy. Computer Security. Triangulation. What is Private Information?
|
|
|
- Norman Burke
- 8 years ago
- Views:
Transcription
1 Privacy Computer Security Web Privacy and Security for Users pri va cy 1 a : the quality or state of being apart from company or observation : seclusion b : freedom from unauthorized intrusion <one's right to privacy> 2 archaic : a place of seclusion 3 a : secrecy 1 b : a private matter : secret 1 However, note that current definitions of privacy do not consider private and secret to be synonyms, especially in the context of the Internet. March 30, , Bryan J. Higgs 1 2 What is Private Information? Garfinkel 1 suggests the following categories of personal information: Personal Information Your name, date of birth, parents' names, etc. Private Information Personal information that is not generally known. Sometimes protected by law (e.g. educational records, bank records) Lots of other information is not protected Social Security Numbers (although they are available in many databases) Personally Identifiable Information Information from which a person's identity can be derived Example: a person's account number Anonymized Information The reverse of personally identifiable information. Aggregate Information Statistical information combined from several individuals -- e.g. Census tract information Triangulation You might be surprised at how much information may be gained from so little. For example, assume you entered information into a web site that was merely your ZIP code and your date of birth. How likely is it that you could be identified from that amount of information? There are (as of March 28th, 2004) ~ 292,897,151 people in the US. The number of distinct birthdays is (taking into account leap years) The number of people in the US with each birthday = 292,897,151 / or nearly 802,000 people The total number of ZIP codes in the US = approximately 100,000 So, the number of people in each ZIP code with the same birthday = 802,000 / 100,000 = about 8 people. This assumes an even distribution of birthdays throughout the year, and that people are evenly distributed throughout ZIP code areas, but it's still a reasonable approximation. 1 Web Security, Privacy & Commerce, Simson Garfinkel, O'Reilly 3 4
2 Web Privacy It is, in fact, very difficult to maintain your privacy when you go onto the Web. Do you realize: When you log into a web site using an account id and password your account id and your password may or may not be securely passed? What information is passed to each web server you visit? What information is passed between your browser and that web server? What cookies are being set/passed, what they contain, and for what purpose they are being used? Every web server will log information about your visit? Each web site has its own, different, privacy policy? Many of your browser activities are being captured by web sites that are looking to determine your patterns, likes and dislikes? That your browser caches information from your web browsing sessions? HTTP is a Request/Response Protocol Here's a request from a browser (Microsoft Internet Explorer V6) for a very simple page: GET HTTP/1.0 Accept: */* Accept-Language: en-us Pragma: no-cache User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; YComp ) Host: Proxy-Connection: Keep-Alive 5 6 HTTP is a Request/Response Protocol And here is the server's response: HTTP/ OK Server: Microsoft-IIS/5.0 Content Location: X-Powered-By: ASP.NET Date: Tue, 30 Mar :21:41 GMT Content-Type: text/html Accept-Ranges: bytes Last-Modified: Tue, 30 Mar :10:42 GMT ETag: "065ac95416c41:999" Content-Length: 263 <html> <head> <meta http-equiv="content-language" content="en-us"> <meta http-equiv="content-type" content="text/html; charset=windows-1252"> <title>simple Web Page</title> </head> <body> <p>this is a very simple web page.</p> </body> </html> Try it! 7 A Single Web Page Involves Many Requests/Responses That was a simple page. But in more realistic web pages, there are many components to request: The HTML page itself Any images it contains Any other components that it contains 8
3 11 12 A Multi-Element Web Page Here's an HTTP request to obtain a slightly more complex web page: GET ools/simplepagewithimage.htm HTTP/1.0 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/x-shockwave-flash, */* Accept-Language: en-us User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; YComp ) Host: Proxy-Connection: Keep-Alive 9 A Multi-Element Web Page Here's the response to this request (notice that it contains an <img> tag): HTTP/ OK Server: Microsoft-IIS/5.0 Content Location: X-Powered-By: ASP.NET Date: Tue, 30 Mar :28:52 GMT Content-Type: text/html Accept-Ranges: bytes Last-Modified: Tue, 30 Mar :26:56 GMT ETag: "0e c41:999" Content-Length: 478 <html> <head> <meta http-equiv="content-language" content="en-us"> <meta http-equiv="content-type" content="text/html; charset=windows-1252"> <title>a simple page with an image</title> </head> <body> <h1>a simple page <i>with an image</i></h1> <p><img border="0" src="../images/ringmaster.gif" width="288" height="263"></p> </body> </html> 10 A Multi-Element Web Page Now, the browser has to obtain the image in order to display it, so it makes another HTTP request: GET aweb/images/ringmaster.gif HTTP/1.0 Accept: */* Referer: aweb/tools/simplepagewithimage.htm Accept-Language: en-us Proxy-Connection: Keep-Alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; YComp ) Host: A Multi-Element Web Page The response to this is: HTTP/ OK Server: Microsoft-IIS/5.0 Content Location: X-Powered-By: ASP.NET Date: Tue, 30 Mar :28:53 GMT Content-Type: image/gif Accept-Ranges: bytes Last-Modified: Tue, 30 Mar :26:56 GMT ETag: "0e c41:999" Content-Length: Give it a try!
4 15 16 One Web Page = Many Requests/Responses Did you notice how absolutely simple that web page was? Now compare that with the typical web page today there's no comparison! Note also: Elements in a web page do not all have to come from the same web site / domain. In fact, most pages that contain advertising images (and other elements) contain elements that come from a potentially large number of web sites, all of which want to learn something about your browsing habits! Web Bugs No, Web Bugs are not program bugs; they are tiny images (usually 1 pixel in size, and so visually undetectable) which are obtained from a third party web site. Here's an example: Web Bugs When I visited that page, there were two requests: and: GET HTTP/1.0 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/x-shockwave-flash, */* Accept-Language: en-us User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; YComp ) Host: Proxy-Connection: Keep-Alive GET HTTP/1.0 Accept: */* Referer: Accept-Language: en-us Proxy-Connection: Keep-Alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; YComp ) Host: ad.doubleclick.net Cookie: id= b3d84368 Web Bugs Web Bugs can also be present in: HTML-based messages Microsoft Word documents Usenet messages For more information on Web Bugs, see:
5 19 20 "Private Information" Passed via Your Browser Here's an example of how much information is passed when you browse to a web page especially one which asks for your username and password: Web Server Logs Every web server logs information about visitors to its web site(s) in a web log file (not to be confused with a WeBlog, aka "Blog"). Typical information recorded is: The name and IP address of the computer that downloaded the web page The time of the request The URL that was passed The time it took to download the file If HTTP authentication was used, the username of the user who downloaded the file Any errors that occurred The previous web page that was downloaded by the web browser (called the refer link) The kind of web browser that was used Web Server Logs A web log entry that uses Common Log Format will look like: host/ip rfcname logname [DD/MMM/YYYY:HH:MM:SS -0000] "METHOD /PATH HTTP/1.0" code bytes where: host/ip RFC name logname The hostname or IP address of the client A name from the remote server for the user. If no value is present, a "-" is substituted. If you're using local authentication and registration, the user's log name will appear; otherwise, "-" is substituted. datestamp The timestamp of the request retrieval Method (GET, PUT, POST, or HEAD); path is the path and file retrieved; HTTP/1.0 defines the protocol. code bytes HTTP completion code. 200 is successful, 304 is a reload from cache, 404 is file not found, etc. number of bytes in file retrieved. For more information about Web Log Analysis, see: RADIUS Logs RADIUS (Remote Authentication Dial-In User Service) is used by many ISPs and large organizations to validate usernames/passwords for dialup users and for accounting. Widely implemented by Cisco, Nortel, Lucent, etc. Here's an example of a RADIUS log file entry: Sun Mar 18 04:35: Acct-Session-Id = " " User-Name = "admin" NAS-IP-Address = Acct-Status-Type = Start Acct-Authentic = Local Service-Type = Administrative-User Login-Service = Telnet Login-IP-Host = Acct-Delay-Time = 75 Timestamp = Request-Authenticator = Verified
6 23 24 Mail Logs Mail messages are often logged on various servers. Here's an extract from a sendmail log: Nov 7 09:00:25 imrldmz1 sendmail[849]: [ID mail.info] fa780ou00847: to=<je@orang .ch>, delay=00:00:01, xdelay=00:00:00, mailer=esmtp, pri=128178, relay=smtp.orang .ch. [ ], dsn=2.0.0, stat=sent (Message received: GMF6WR00.DUH) Nov 7 09:00:41 imrldmz1 sendmail[864]: [ID mail.info] fa780fu00864: from=<bidconfirm(@ebay.de>, size=1975, class=0, nrcpts=1, msgid=< fa7848u20675@damar.ebay.com>, proto=smtp, daemon=mta, relay=miles.ebay.com [ ] Nov 7 09:00:42 imrldmz1 sendmail[866]: [ID mail.info] fa780fu00864: to=<searles-daniel@orang .ch>, delay=00:00:01, xdelay=00:00:00, mailer=esmtp, pri=121975, relay=smtp.orang .ch. [ ], dsn=2.0.0, stat=sent (Message received: GMF7V600.IJK) DNS The Domain Name System (DNS), is a core feature of the Internet. It is a distributed database that handles the mapping between host names (domain names), which are more convenient for humans, and the numerical IP address, which a computer uses. For example, the hostname net.rivier.edu maps to the IP address [ ] A DNS name server can be configured to log every DNS query that it receives Cookies What is a cookie? A piece of information sent by a Web server to a user's browser The browser saves the information, and sends it back to the Web server every time the browser returns to that Web site. Cookies were invented by Netscape, and introduced with Netscape Navigator 2.0 The preliminary cookie specification may be found at RFC 2965 may be found at but it is not clear that the RFC has been finalized/accepted. Cookie Applications Why are cookies needed? HTTP is a stateless protocol, but many web sites need to maintain state across many HTTP requests Typical applications include: To implement a "shopping cart" at sites such as amazon.com To identify a user so that web sites can show user-specific information such as local news, weather, etc. This is often done at so-called portals.
7 27 28 Web Server Sending a Cookie A web server sends a cookie to a client's browser by including a Set-Cookie header in its HTTP response. For example: set-cookie: RMID=c6705c ; expires=fri, 31-Dec :59:59 GMT; path=/; domain=.internet.com Contents of a Cookie The header contains a number of name=value pairs, including some special ones: expires=<time> Specifies when the cookie will expire. If no expiration time is specified, the cookie is a session cookie It is not written to disk, and lasts only as long as the current session If an expiration time is specified, the cookie is a persistent cookie It is written to disk, and will be passed on any subsequent request made to that web site. domain=<domain-name> Specifies which domain to send the cookie to (i.e. computers within that domain) path=<path> Specifies which path within the web site should be sent this cookie secure (no value) Specifies that this cookie should only be sent via SSL It is still stored unencrypted in your browser's cookie storage Browser Sending a Cookie The browser will send a cookie to a web site to which it is making a request, based on the attributes specified in the cookie. Here is a real example: GET copt=rcl;click= 4091/D=mail/S= :LREC/EXP= /A= /R=1/*;ord= ? HTTP/1.0 Accept: */* Referer: Accept-Language: en-us Proxy-Connection: Keep-Alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; YComp ) Host: ad.doubleclick.net Cookie: id= b3d84368 How Do You Control Cookies? Most browsers, by default, have far too lax control over cookies. Once you change the settings of your browser to ask when it should send a cookie to a site, you will be amazed at how many cookies are being exchanged, and with which web sites! Each browser has a different way to change cookie behavior...
8 31 32 Microsoft Internet Explorer Cookie Control Microsoft Internet Explorer Cookie Control 29 P3P Privacy Policy: security/privacy/overview/createprivacypolicy.asp 30 Microsoft Internet Explorer Cookie Control Microsoft Internet Explorer Cookie Control
9 35 36 Microsoft Internet Explorer Cookie Control Once you've changed the cookie behavior, you'll see lots of dialogs like: Initially, you'll see lots of them whenever you are in Microsoft Internet Explorer (and also some when you're in Microsoft Outlook [Express]!) If you check the "Apply my decision to all cookies from this Web site" checkbox, and click on the Block Cookie button, then gradually, you'll see fewer and fewer of them. I've found this to be a revelation in terms of how many cookies are set on my browser, and by whom! Cookie Content Usage A cookie can be used in basically two ways: A web site can use a cookie to contain the user's actual data The cookie can contain a key into the web site's database Here's an example of a request that uses a session cookie (Yahoo! ). Which type do you think it is? GET HTTP/1.0 Accept: */* Referer: Accept-Language: en-us Proxy-Connection: Keep-Alive If-Modified-Since: Wed, 09 Jul :28:35 GMT If-None-Match: "bc40a f0c9713" User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; YComp ) Host: us.f612.mail.yahoo.com Cookie: B=6l9m9j4vlcc8e&b=2; Q=q1=AACAAAAAAAAAbw--&q2=P6aGog--; C=mg=1; U=mt=_Nah0Z2MhYt51q7jI9QLDRA8bEDl6sYVaJh6BA--&ux=OXIaAB&un=0cf6rmp6secto; F=a=6nb4VqMsvWL.HUE810Y3PKme30LHfyxOgUkK4VwW92dAwrJed4Wk7xgZaYOT&b=bsP1; CP=v=500&br=i; Y=v=1&n=0cf6rmp6secto&l=m41boi42kh4/o&p=m2602vk &jb=24 68 &r=ck&lg=us&intl=us&np=1; T=z=6qZaAB6wuaABh0gEAXL51APMTY1BjY1NzExNk5PTzU- &a=yae&sk=daaokdzyuv5ou.&d=c2wbtmpfeufurxlnrfkytvrrne9ess0byqfzquubb2sbwlcwlqf0axabr0riweddaxp6atzxwmfb QmdXQQ--; YM.Gen=i=vaJ46Ur8iCyUC6SohqziJVP0lrSkYKjdTidT3lQJrzneEKKH5YDk7bS1g6hjhyuAbIj2os0H61ti2DfrzP_q3g39ysl1fr JQhGeiB5pS_y1VMTCa70DQw_.ZHMJ4wxkzKm8thDxdEgTUDOmnT87vMictEcNpQSCx9dRdtDgtLPZTbr2L3KdZpBlziqzi_QV3HSiLr 2fWOhYX3s0MibjQuSdbaJLByBxFfq7ut34veJUKOFjlD7uB9mJvqnCL6FIJbdaZ_JdUIDtVWjNF00cmadflGP3DoIfjLecIeK4cWVk5 _rcjwuowbtt0iyslkzcvhwmj4ud6gc6oeay0dl0mh4fm_tmzm76bpqfk1s9bvp.yq_u.yvrj0s8ospz3ct75cxffvm_sbngcbxb0inu QGwrhhu44.bBCa.haoEG.v.EcRpif_mc5XeblEJevgVvlDE4lXdjdOD6YvxUxc.qaR5TLwJuO7BulByFXq0oGHaI0fdzVtJ0mGEuUes fyc4dglke6b6kxhdqjfoaotd3tfv1aiahemz_qc50uzsehenqxnykvrxbbdg.gscvbgcdch0jm5dmzmqb9wbn_bsnlelltwjgkwnatj 4I65C2x7Hqy_gcV46DeReI3dPcIe59iPMyou7e_FWRIZSuTSXKeVosU2OQDOuXdS6l_CwYI30xcY4Sr01KPOZbpp0QfwJxhecAMsi.N bypfhn0kyjogpzfklr6nwuxd9tq9uheratvjctxeu4tqjb.vufhldqrrd84-&v= Cookie Content Usage What if the cookie looked like: Cookie: USER=bryan PASSWORD=myfavoritepassword? In general, cookies can: keep data on the client's computer or: keep data on the web site's computer Current Cookie Practices Today, one of the most popular uses for cookies is to give a permanent identification number to each user, to measure the number of visitors to a web site. Advertising! Many advertisers use cookies to build comprehensive profiles of web users, via banner ads. A profile might show that a particular user is interested in sports, entertainment, camcorders, whatever. Even though profiles are supposed to be anonymous, sufficient crossindexing across multiple profiles and registration information can cause a user to be identified
10 39 40 Finding Cookies in Microsoft Internet Explorer Finding Cookies in Microsoft Internet Explorer MS Explorer maintains its cookies in a directory, one file per cookie. The directory is found from the registry entry: \HKEY_CURRENT_USER\Software\Microsoft\Windows\ CurrentVersion\Explorer\User Shell Folders\Cookies Cookie Security Users can modify the contents of cookies Thus, it is unwise for a web site to trust the contents of a cookie Apparently, there was one real case where a web site used cookies to store information about items placed in the web site's "shopping cart". The cookie's contents included the price charged for each item, which the web site trusted to be accurate. A user modified the cookie, lowering the prices in the cookie, and thus managed to obtain goods very inexpensively. Browser Cache Each browser maintains a browser cache which helps dramatically improve browsing performance. The browser cache contents can become a security issue, if they contain sensitive information (they are stored in plaintext format)
11 43 44 Browser History Browsers also keep track of recently visited URLs over a recent period. Often used to allow browsers to implement automatic completion of user-entered URLs Again, the history can become a sensitive area, especially when the URLs include search strings, account names, and the like. Microsoft Internet Explorer Browser History MS Explorer maintains its history in a directory The directory is found from the registry entry: \HKEY_CURRENT_USER\Software\Microsoft\Windows\ CurrentVersion\Explorer\User Shell Folders\History Microsoft Internet Explorer Browser History Blocking Ads and Spyware Pop-up ads have become one of the scourges of the Internet. They are certainly annoyances during your browsing experience! Spyware, similarly, has become a real annoyance, close to virus proportions. It's wise to delete the browser history in a judicious way.
12 47 48 Pop-up Ad Blockers One problem MS Internet Explorer is that Microsoft actually has financial agreements with certain companies, which can mean that they are slow/unwilling to modify their browsers to prevent pop-up ads and similar scourges. Other browser producers have been more enlightened: Netscape Navigator 7.1 has pop-up blocking built in Mozilla 1.5 has pop-up blocking built in Mozilla Firefox also has pop-up blocking The Avant Browser does too. To see how they compare, see: Pop-up Ad Blockers Then there are other solutions to block pop-up ads: Free toolbars from Google, Dogpile, MSN, and Yahoo I've used Google's toolbar with good results: Many other utilities (do a Google search for "pop-up ad blockers") Even Microsoft is apparently producing a built-in Internet Explorer pop-up blocker in Windows XP Service Pack 2, purported to be shipping in the first half of Spyware You may not realize how ubiquitous Spyware is. Really the only way to find out whether you have spyware on your machine is to get a spyware eliminator program, and run it. The best (at least I have had good luck with it) seems to be: Spybot - Search & Destroy HTTP Proxies An HTTP proxy acts as an intermediary between your browser and the Internet. Browser HTTP proxy Internet
13 51 52 HTTP Proxies Here are some reasons for installing an HTTP proxy: To enhance security, by only allowing a single machine true access to the Internet; all other machines have to use the HTTP proxy. The HTTP proxy can hide information about the other machines. To enhance network bandwidth: By limiting which machines can access the Internet By caching commonly-used pages in the HTTP proxy To control content: The HTTP proxy can be programmed to make certain sites (such as pornography sites, etc.) inaccessible. Many pop-up ad blockers implement an HTTP proxy to control content in this way. Many commercial and free HTTP proxies are available Setting up Internet Explorer to Use an HTTP Proxy Setting up Internet Explorer to Use an HTTP Proxy Local HTTP Proxies One other reason for installing an HTTP proxy is to monitor HTTP traffic and content for learning purposes. In this case, you would likely install a Local HTTP Proxy on your own machine. There are many available, often free. One I've been using is the Java HTTP Proxy Server which I've used to capture requests and responses, and generally explore HTTP exchanges.
14 55 56 Java HTTP Proxy Server Java HTTP Proxy Server Java HTTP Proxy Server Let's try a demo! Anonymous Browsing When you browse the web normally, you leave tracks behind, and people are watching your every page visit. "Just because you're not paranoid doesn't mean they're not after you!"
15 59 60 Anonymous Browsing You can remove some of the information that you would leave behind, by browsing anonymously: Browse from a public terminal at a library But beware Net Nannies and the Patriot Act! Use an ISP that uses a web cache or a proxy server This may, or may not, hide your machine's information Be sure to understand your ISP's privacy policy Use an anonymous web browsing service: Anonymizer.com Freedom Others do a Google search for " anonymous web browsing " Security The main privacy issues are: SPAM! Viruses, worms, Trojan horses, etc. Confidentiality of contents There are other issues, but we won't talk about them here SPAM As we all know, SPAM (with or without viruses) is the number one problem on the Internet, and it's getting worse. You can defend yourself in a number of ways: First, be very careful divulging your address Have one real, carefully controlled, address, and other (potentially disposable) ones for entering into web pages, etc. Use a web-based system, such as Yahoo!, Hotmail, etc. They all have some level of SPAM filtering I use Yahoo!, and like their SPAM filtering Use an anti-spam program on your machine For example, Norton Anti-SPAM ( ) Most seem to expect Microsoft Outlook or Outlook Express I wasn't impressed with Microsoft Outlook's Junk mail filtering Eudora 6.0 client (paid-only) has SPAM filtering. Viruses If you use a Web-based service, they usually have anti-virus built in. I use Yahoo! , and have found their antivirus software to be very effective. Besides, most of the time, you leave messages on the server and never download them unless you need to. Regardless, you need to practice safe computing: You really need to run an anti-virus program on your own computer (PCs are the most subject to viruses), and: You need to keep its virus data up to date on nearly a daily basis. I have used Norton AntiVirus, with much success There are even free antivirus programs available I have used AVG Anti-Virus with success So there's no excuse for not running an anti-virus program!
16 Confidentiality When combined with anonymous browsing, web-based can provide private and nearly untraceable . I wouldn't trust this against court orders, however... You could use PGP with your conventional (freely downloadable PGP plugs into Microsoft Outlook) An interesting option is the use of Hushmail, a web-based service: Unlike Yahoo!, Hotmail, etc., Hushmail encrypts all messages passing through its system Even Hushmail can't read your , so court orders may be impossible to satisfy (although who knows what the Patriot Act might have done to that?) Summary Again, we've covered a lot of ground on this topic. Web security and privacy is a large set of topics, and I can't claim completeness on the subject, but hopefully you've learned some useful facts and ideas
reference: HTTP: The Definitive Guide by David Gourley and Brian Totty (O Reilly, 2002)
1 cse879-03 2010-03-29 17:23 Kyung-Goo Doh Chapter 3. Web Application Technologies reference: HTTP: The Definitive Guide by David Gourley and Brian Totty (O Reilly, 2002) 1. The HTTP Protocol. HTTP = HyperText
Protocolo HTTP. Web and HTTP. HTTP overview. HTTP overview
Web and HTTP Protocolo HTTP Web page consists of objects Object can be HTML file, JPEG image, Java applet, audio file, Web page consists of base HTML-file which includes several referenced objects Each
Regain Your Privacy on the Internet
Regain Your Privacy on the Internet by Boris Loza, PhD, CISSP from SafePatrol Solutions Inc. You'd probably be surprised if you knew what information about yourself is available on the Internet! Do you
THE PROXY SERVER 1 1 PURPOSE 3 2 USAGE EXAMPLES 4 3 STARTING THE PROXY SERVER 5 4 READING THE LOG 6
The Proxy Server THE PROXY SERVER 1 1 PURPOSE 3 2 USAGE EXAMPLES 4 3 STARTING THE PROXY SERVER 5 4 READING THE LOG 6 2 1 Purpose The proxy server acts as an intermediate server that relays requests between
Network Technologies
Network Technologies Glenn Strong Department of Computer Science School of Computer Science and Statistics Trinity College, Dublin January 28, 2014 What Happens When Browser Contacts Server I Top view:
No. Time Source Destination Protocol Info 1190 131.859385 128.238.245.34 128.119.245.12 HTTP GET /ethereal-labs/http-ethereal-file1.html HTTP/1.
Ethereal Lab: HTTP 1. The Basic HTTP GET/response interaction 1190 131.859385 128.238.245.34 128.119.245.12 HTTP GET /ethereal-labs/http-ethereal-file1.html HTTP/1.1 GET /ethereal-labs/http-ethereal-file1.html
HTTP. Internet Engineering. Fall 2015. Bahador Bakhshi CE & IT Department, Amirkabir University of Technology
HTTP Internet Engineering Fall 2015 Bahador Bakhshi CE & IT Department, Amirkabir University of Technology Questions Q1) How do web server and client browser talk to each other? Q1.1) What is the common
1. When will an IP process drop a datagram? 2. When will an IP process fragment a datagram? 3. When will a TCP process drop a segment?
Questions 1. When will an IP process drop a datagram? 2. When will an IP process fragment a datagram? 3. When will a TCP process drop a segment? 4. When will a TCP process resend a segment? CP476 Internet
Project #2. CSE 123b Communications Software. HTTP Messages. HTTP Basics. HTTP Request. HTTP Request. Spring 2002. Four parts
CSE 123b Communications Software Spring 2002 Lecture 11: HTTP Stefan Savage Project #2 On the Web page in the next 2 hours Due in two weeks Project reliable transport protocol on top of routing protocol
An Insight into Cookie Security
An Insight into Cookie Security Today most websites and web based applications use cookies. Cookies are primarily used by the web server to track an authenticated user or other user specific details. This
The Hyper-Text Transfer Protocol (HTTP)
The Hyper-Text Transfer Protocol (HTTP) Antonio Carzaniga Faculty of Informatics University of Lugano October 4, 2011 2005 2007 Antonio Carzaniga 1 HTTP message formats Outline HTTP methods Status codes
Multifactor Authentication
10 CHAPTER The user can integrate additional access control devices like biometric devices to the Cisco PAM to ensure security. These devices are configured as Generic Readers in the Cisco PAM server.
HTTP Protocol. Bartosz Walter <Bartek.Walter@man.poznan.pl>
HTTP Protocol Bartosz Walter Agenda Basics Methods Headers Response Codes Cookies Authentication Advanced Features of HTTP 1.1 Internationalization HTTP Basics defined in
CloudOYE CDN USER MANUAL
CloudOYE CDN USER MANUAL Password - Based Access Logon to http://mycloud.cloudoye.com. Enter your Username & Password In case, you have forgotten your password, click Forgot your password to request a
Cookies Overview and HTTP Proxies
Cookies Overview and HTTP Proxies What is a Cookie? Small piece of data generated by a web server, stored on the client s hard drive. Serves as an add-on to the HTTP specification (remember, HTTP by itself
Crowbar: New generation web application brute force attack tool
Crowbar: New generation web application brute force attack tool 1 Tables of contents Introduction... 3 Challenges with brute force attacks... 3 Crowbar a fresh approach... 3 Other applications of crowbar...
By Bardia, Patit, and Rozheh
HTTP By Bardia, Patit, and Rozheh HTTP - Introduction - Hyper Text Transfer Protocol -uses the TCP/IP technology -has had the most impact on the World Wide Web (WWW) - specs in RFC 2616 (RFC2616) HTTP
CS640: Introduction to Computer Networks. Applications FTP: The File Transfer Protocol
CS640: Introduction to Computer Networks Aditya Akella Lecture 4 - Application Protocols, Performance Applications FTP: The File Transfer Protocol user at host FTP FTP user client interface local file
HTTP Caching & Cache-Busting for Content Publishers
HTTP Caching & Cache-Busting for Content Publishers Michael J. Radwin http://public.yahoo.com/~radwin/ OSCON 2005 Thursday, August 4th, 2005 1 1 Agenda HTTP in 3 minutes Caching concepts Hit, Miss, Revalidation
World Wide Web. Before WWW
World Wide Web Joao.Neves@fe.up.pt Before WWW Major search tools: Gopher and Archie Archie Search FTP archives indexes Filename based queries Gopher Friendly interface Menu driven queries João Neves 2
How to Disable Common Pop-Up Blockers
How to Disable Common Pop-Up Blockers Listed below are some of the more popular Pop-up Blocking software packages and the workarounds that should be followed in order to disable the Pop-Up blocking feature
Security-Assessment.com White Paper Leveraging XSRF with Apache Web Server Compatibility with older browser feature and Java Applet
Security-Assessment.com White Paper Leveraging XSRF with Apache Web Server Compatibility with older browser feature and Java Applet Prepared by: Roberto Suggi Liverani Senior Security Consultant Security-Assessment.com
sessionx Desarrollo de Aplicaciones en Red Web Applications History (1) Content History (2) History (3)
sessionx Desarrollo de Aplicaciones en Red José Rafael Rojano Cáceres http://www.uv.mx/rrojano Web Applications 1 2 Content History (1) History Http CGI Web Tiers ARPANet Email, Ftp, IRC, news Explosive
The Web: some jargon. User agent for Web is called a browser: Web page: Most Web pages consist of: Server for Web is called Web server:
The Web: some jargon Web page: consists of objects addressed by a URL Most Web pages consist of: base HTML page, and several referenced objects. URL has two components: host name and path name: User agent
How To Use Moodle Online Class On A Pc Or Mac Or Ipad (For Acedo) On A Computer Or Mac) On Your Computer Or Ipod Or Ipo (For An Ipo) For Acedor Or Mac (
Welcome to Stanly Online, This document has been sent to you to supply the information you need to: access our online learning system AND find help, should the need arise Accessing : Your online class
RoomWizard Synchronization Software Manual Installation Instructions
2 RoomWizard Synchronization Software Manual Installation Instructions Table of Contents Exchange Server Configuration... 4 RoomWizard Synchronization Software Installation and Configuration... 5 System
1 Accessing E-mail accounts on the Axxess Mail Server
1 Accessing E-mail accounts on the Axxess Mail Server The Axxess Mail Server provides users with access to their e-mail folders through POP3, and IMAP protocols, or OpenWebMail browser interface. The server
Get Started Guide - PC Tools Internet Security
Get Started Guide - PC Tools Internet Security Table of Contents PC Tools Internet Security... 1 Getting Started with PC Tools Internet Security... 1 Installing... 1 Getting Started... 2 iii PC Tools
Emailing from The E2 Shop System EMail address Server Name Server Port, Encryption Protocol, Encryption Type, SMTP User ID SMTP Password
Emailing from The E2 Shop System With recent releases of E2SS (at least 7.2.7.23), we will be allowing two protocols for EMail delivery. A new protocol for EMail delivery Simple Mail Transfer Protocol
Demystifying cache. Kristian Lyngstøl Product Specialist Varnish Software AS
Demystifying cache Kristian Lyngstøl Product Specialist Varnish Software AS Montreal, March 2013 Agenda - The types of caches involved - The benefits of a cache - HTTP - Reverse proxy specifics Not: L1/L2
How to Search the Internet
Technology In Action 1 Technology In Action Chapter 3 Using the Internet: Making the Most of the Web s Resources 2 Topics Internet basics Internet data Internet service providers Web browsers URLs Hyperlinks
Hypertext for Hyper Techs
Hypertext for Hyper Techs An Introduction to HTTP for SecPros Bio Josh Little, GSEC ~14 years in IT. Support, Server/Storage Admin, Webmaster, Web App Dev, Networking, VoIP, Projects, Security. Currently
Alteon Browser-Smart Load Balancing
T e c h n i c a l T i p TT-0411405a -- Information -- 24-Nov-2004 Contents: Introduction:...1 Associated Products:...1 Overview...1 Sample Configuration...3 Setup...3 Configuring PC1...4 Configuring PC2...4
MailEnable Web Mail End User Manual V 2.x
MailEnable Web Mail End User Manual V 2.x MailEnable Messaging Services for Microsoft Windows NT/2000/2003 MailEnable Pty. Ltd. 486 Neerim Road Murrumbeena VIC 3163 Australia t: +61 3 9569 0772 f: +61
System Administration Training Guide. S100 Installation and Site Management
System Administration Training Guide S100 Installation and Site Management Table of contents System Requirements for Acumatica ERP 4.2... 5 Learning Objects:... 5 Web Browser... 5 Server Software... 5
MS Outlook 2002/2003. V1.0 BullsEye Telecom Email
IMAP Settings Manual Our application allows you to access your email in many different ways. For those of you who do not wish to use the Webmail interface, you may also manage your email and custom folder
Outlook Web Access Tipsheets
You can use a Web browser to access your Outlook mailbox from any computer with an Internet connection. You can use Outlook Web Access with Microsoft Internet Explorer, Mozilla Firefox and many other browsers.
T14 SECURITY TESTING: ARE YOU A DEER IN THE HEADLIGHTS? Ryan English SPI Dynamics Inc BIO PRESENTATION. Thursday, May 18, 2006 1:30PM
BIO PRESENTATION T14 Thursday, May 18, 2006 1:30PM SECURITY TESTING: ARE YOU A DEER IN THE HEADLIGHTS? Ryan English SPI Dynamics Inc International Conference On Software Testing Analysis and Review May
F-Secure Internet Security 2012
F-Secure Internet Security 2012 F-Secure Internet Security 2012 TOC 3 Contents Chapter 1: Getting started...7 How to use automatic updates...8 Check the update status...8 Change the Internet connection
Instructions for Disabling Common Pop-up Blockers
Instructions for Disabling Common Pop-up Blockers Reliance Standard maintains a series of web-based applications that require you to allow pop-up windows. Listed below are some of the more popular pop-up
How to Temporarily Allow Popups for the Current Session
How to Temporarily Allow Popups for the Current Session NOTE: The following procedure works on most browsers, but there may be some that don t. Try it anyway. Press the ctrl key while clicking on the Go
How To Understand The History Of The Web (Web)
(World Wide) Web WWW A way to connect computers that provide information (servers) with computers that ask for it (clients like you and me) uses the Internet, but it's not the same as the Internet URL
CONTENT of this CHAPTER
CONTENT of this CHAPTER v DNS v HTTP and WWW v EMAIL v SNMP 3.2.1 WWW and HTTP: Basic Concepts With a browser you can request for remote resource (e.g. an HTML file) Web server replies to queries (e.g.
Clientless SSL VPN Users
Manage Passwords, page 1 Username and Password Requirements, page 3 Communicate Security Tips, page 3 Configure Remote Systems to Use Clientless SSL VPN Features, page 3 Manage Passwords Optionally, you
How to Disable Common Pop-Up Blockers
How to Disable Common Pop-Up Blockers Listed below are some of the more popular Pop-up Blocking software packages and the workarounds that should be followed in order to disable the Pop-Up blocking feature
Web. Services. Web Technologies. Today. Web. Technologies. Internet WWW. Protocols TCP/IP HTTP. Apache. Next Time. Lecture #3 2008 3 Apache.
JSP, and JSP, and JSP, and 1 2 Lecture #3 2008 3 JSP, and JSP, and Markup & presentation (HTML, XHTML, CSS etc) Data storage & access (JDBC, XML etc) Network & application protocols (, etc) Programming
How-to: HTTP-Proxy and Radius Authentication and Windows IAS Server settings. Securepoint Security System Version 2007nx
Securepoint Security System Version 2007nx HTTP proxy authentication with radius to a Windows 2003 server The Remote Authentication Dial-In User Service (RADIUS) is a client-server-protocol which is used
Internet Technologies 4-http. F. Ricci 2010/2011
Internet Technologies 4-http F. Ricci 2010/2011 Content Hypertext Transfer Protocol Structure of a message Methods Headers Parameters and character encoding Proxy Caching HTTP 1.1: chunked transfer and
GRICdial User's Guide
GRICdial User's Guide Table of Contents System Requirements Getting Connected Additional Settings Main Menu Functions Setting up Proxy FAQ System Requirements For Windows 95 You should have the following
ACCOUNT SERVICES HELP
ACCOUNT SERVICES HELP 1. How do I create an on line account? Before you can view your on line account information you first need to register a username profile. You do this by clicking on the Register
The following multiple-choice post-course assessment will evaluate your knowledge of the skills and concepts taught in Internet Business Associate.
Course Assessment Answers-1 Course Assessment The following multiple-choice post-course assessment will evaluate your knowledge of the skills and concepts taught in Internet Business Associate. 1. A person
Web Security: SSL/TLS
CSE 484 / CSE M 584: Computer Security and Privacy Web Security: SSL/TLS Spring 2015 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, Yoshi Kohno,
Privacy Policy - LuxTNT.com
Privacy Policy - LuxTNT.com Overview TNT Luxury Group Limited (the owner of LuxTNT.com). knows that you care how information about you is used and shared, and we appreciate your trust that we will do so
Chapter 6 Virtual Private Networking Using SSL Connections
Chapter 6 Virtual Private Networking Using SSL Connections The FVS336G ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN provides a hardwarebased SSL VPN solution designed specifically to provide
ITSC Training Courses Student IT Competence Programme SIIS1 Information Security
ITSC Training Courses Student IT Competence Programme SI1 2012 2013 Prof. Chan Yuen Yan, Rosanna Department of Engineering The Chinese University of Hong Kong SI1-1 Course Outline What you should know
NSi Mobile Installation Guide. Version 6.2
NSi Mobile Installation Guide Version 6.2 Revision History Version Date 1.0 October 2, 2012 2.0 September 18, 2013 2 CONTENTS TABLE OF CONTENTS PREFACE... 5 Purpose of this Document... 5 Version Compatibility...
Outline Definition of Webserver HTTP Static is no fun Software SSL. Webserver. in a nutshell. Sebastian Hollizeck. June, the 4 th 2013
Definition of in a nutshell June, the 4 th 2013 Definition of Definition of Just another definition So what is it now? Example CGI php comparison log-file Definition of a formal definition Aisaprogramthat,usingthe
Module 45 (More Web Hacking)
(More Web Hacking) In this Module, you'll lear how to use netcat to perform cursory server reconnaissance. You'll lear what a web proxy is and how it functions. You'll know how to enable your browser to
Parallels Plesk Automation. Customer s Guide. Parallels Plesk Automation 11.5
Parallels Plesk Automation Customer s Guide Parallels Plesk Automation 11.5 Last updated: 17 March 2015 Contents Quick Start with Hosting Panel 4 Set Up Your First Website... 4 1. Create Your Site... 5
Safe internet for business use: Getting Started Guide
Safe internet for business use: Getting Started Guide Table of Contents 1. Preface 1 2. Before You Install 2 2.1 Disabling Firewalls 2 2.2 About Accelerators 3 3. About Profiles 4 4. Installation and Initial
Competencies (1 of 2)
Chapter 2 The Internet, the Web, and Electronic Commerce Competencies (1 of 2) Discuss the origins of the Internet and the Web Describe how to access the Web using providers and browsers Discuss Internet
Airtel PC Secure Trouble Shooting Guide
Airtel PC Secure Trouble Shooting Guide Table of Contents Questions before installing the software Q: What is required from my PC to be able to use the Airtel PC Secure? Q: Which operating systems does
Webmail Using the Hush Encryption Engine
Webmail Using the Hush Encryption Engine Introduction...2 Terms in this Document...2 Requirements...3 Architecture...3 Authentication...4 The Role of the Session...4 Steps...5 Private Key Retrieval...5
1 Introduction: Network Applications
1 Introduction: Network Applications Some Network Apps E-mail Web Instant messaging Remote login P2P file sharing Multi-user network games Streaming stored video clips Internet telephone Real-time video
Securing SharePoint Server with Windows Azure Multi- Factor Authentication
Journal of Mobile, Embedded and Distributed Systems, vol. VII, no. 1, 2015 ISSN 2067 4074 Securing SharePoint Server with Windows Azure Multi- Factor Authentication Petru-Radu NARITA Department of Economic
Chapter 27 Hypertext Transfer Protocol
Chapter 27 Hypertext Transfer Protocol Columbus, OH 43210 Jain@CIS.Ohio-State.Edu http://www.cis.ohio-state.edu/~jain/ 27-1 Overview Hypertext language and protocol HTTP messages Browser architecture CGI
Installing GFI MailSecurity
Installing GFI MailSecurity Introduction This chapter explains how to install and configure GFI MailSecurity. You can install GFI MailSecurity directly on your mail server or you can choose to install
Using TestLogServer for Web Security Troubleshooting
Using TestLogServer for Web Security Troubleshooting Topic 50330 TestLogServer Web Security Solutions Version 7.7, Updated 19-Sept- 2013 A command-line utility called TestLogServer is included as part
Technical Note. Configuring Outlook Web Access with Secure WebMail Proxy for eprism
Technical Note Configuring Outlook Web Access with Secure WebMail Proxy for eprism Information in this document is subject to change without notice. This document may be distributed freely only in whole,
Using RADIUS Agent for Transparent User Identification
Using RADIUS Agent for Transparent User Identification Using RADIUS Agent Web Security Solutions Version 7.7, 7.8 Websense RADIUS Agent works together with the RADIUS server and RADIUS clients in your
Bitrix Site Manager ASP.NET. Installation Guide
Bitrix Site Manager ASP.NET Installation Guide Contents Introduction... 4 Chapter 1. Checking for IIS Installation... 5 Chapter 2. Using An Archive File to Install Bitrix Site Manager ASP.NET... 7 Preliminary
Installation Guide for Pulse on Windows Server 2012
MadCap Software Installation Guide for Pulse on Windows Server 2012 Pulse Copyright 2014 MadCap Software. All rights reserved. Information in this document is subject to change without notice. The software
Quick Start. Installing the software. for Webroot Internet Security Complete, Version 7.0
Quick Start for Webroot Internet Security Complete, Version 7.0 This Quick Start describes how to install and begin using the Webroot Internet Security Complete 2011 software. This integrated suite delivers
A Java proxy for MS SQL Server Reporting Services
1 of 5 1/10/2005 9:37 PM Advertisement: Support JavaWorld, click here! January 2005 HOME FEATURED TUTORIALS COLUMNS NEWS & REVIEWS FORUM JW RESOURCES ABOUT JW A Java proxy for MS SQL Server Reporting Services
Hardware/Software Recommendations And System Support Reference Information November 10, 2004
Hardware/Software Recommendations And System Support Reference Information November 10, 2004 Recommended: Pentium III or higher, Pentium IV recommended 800 MHz or faster Internet Explorer 6.0 or higher
Installation Guide For ChoiceMail Enterprise Edition
Installation Guide For ChoiceMail Enterprise Edition How to Install ChoiceMail Enterprise On A Server In Front Of Your Company Mail Server August, 2004 Version 2.6x Copyright DigiPortal Software, 2002-2004
Table of Contents. Open-Xchange Authentication & Session Handling. 1.Introduction...3
Open-Xchange Authentication & Session Handling Table of Contents 1.Introduction...3 2.System overview/implementation...4 2.1.Overview... 4 2.1.1.Access to IMAP back end services...4 2.1.2.Basic Implementation
The Web History (I) The Web History (II)
Goals of Today s Lecture EE 122: The World Wide Web Ion Stoica TAs: Junda Liu, DK Moon, David Zats http://inst.eecs.berkeley.edu/~ee122/ (Materials with thanks to Vern Paxson, Jennifer Rexford, and colleagues
Infor Xtreme Browser References
Infor Xtreme Browser References This document describes the list of supported browsers, browser recommendations and known issues. Contents Infor Xtreme Browser References... 1 Browsers Supported... 2 Browser
Cyclope Internet Filtering Proxy. - Installation Guide -
Cyclope Internet Filtering Proxy - Installation Guide - 1. Overview 3 2. Installation 4 2.1 System requirements 4 2.2 Cyclope Internet Filtering Proxy Installation 4 2.3 Client Browser Configuration 6
Step-by-Step Configuration
Step-by-Step Configuration Kerio Technologies Kerio Technologies. All Rights Reserved. Printing Date: August 15, 2007 This guide provides detailed description on configuration of the local network which
Reading an email sent with Voltage SecureMail. Using the Voltage SecureMail Zero Download Messenger (ZDM)
Reading an email sent with Voltage SecureMail Using the Voltage SecureMail Zero Download Messenger (ZDM) SecureMail is an email protection service developed by Voltage Security, Inc. that provides email
SSL VPN Portal Options
1. ProSecure UTM Quick Start Guide This quick start guide describes how to use the SSL VPN Wizard to configure SSL VPN portals on the ProSecure Unified Threat Management (UTM) Appliance. The Secure Sockets
Configuring Single Sign-on for WebVPN
CHAPTER 8 This chapter presents example procedures for configuring SSO for WebVPN users. It includes the following sections: Using Single Sign-on with WebVPN, page 8-1 Configuring SSO Authentication Using
Corporate Telephony Toolbar User Guide
Corporate Telephony Toolbar User Guide 1 Table of Contents 1 Introduction...6 1.1 About Corporate Telephony Toolbar... 6 1.2 About This Guide... 6 1.3 Accessing The Toolbar... 6 1.4 First Time Login...
DEPLOYMENT GUIDE. Deploying F5 for High Availability and Scalability of Microsoft Dynamics 4.0
DEPLOYMENT GUIDE Deploying F5 for High Availability and Scalability of Microsoft Dynamics 4.0 Introducing the F5 and Microsoft Dynamics CRM configuration Microsoft Dynamics CRM is a full customer relationship
Chapter 5 Configuring the Remote Access Web Portal
Chapter 5 Configuring the Remote Access Web Portal This chapter explains how to create multiple Web portals for different users and how to customize the appearance of a portal. It describes: Portal Layouts
Enterprise Toolbar User s Guide. Revised March 2015
Revised March 2015 Copyright Notice Trademarks Copyright 2007 DSCI, LLC All rights reserved. Any technical documentation that is made available by DSCI, LLC is proprietary and confidential and is considered
TCP/IP Networking An Example
TCP/IP Networking An Example Introductory material. This module illustrates the interactions of the protocols of the TCP/IP protocol suite with the help of an example. The example intents to motivate the
PREMIUM MAIL USER GUIDE
PREMIUM MAIL USER GUIDE WHO THIS USER GUIDE IS FOR This document is for users of BigPond Premium Mail. It describes the features of BigPond Premium Mail from a user s perspective. It contains: A general
Working With Your FTP Site
Working With Your FTP Site Welcome to your FTP Site! The UnlimitedFTP (UFTP) software will allow you to run from any web page using Netscape, Internet Explorer, Opera, Mozilla or Safari browsers. It can
Entrust Managed Services PKI Administrator s Quick Start Guide
Entrust Managed Services PKI Administrator s Quick Start Guide Each Managed Services PKI organization requires an administrator also known as a local registration authority (LRA) whose duty it is to manage
Student ANGEL FAQs. General Issues: System Requirements:
Student ANGEL FAQs General Issues: What is ANGEL? How do I log in? What is my username and password? How do I activate my account? I forgot my C number/password, what do I do? I registered after the first
Administering Jive for Outlook
Administering Jive for Outlook TOC 2 Contents Administering Jive for Outlook...3 System Requirements...3 Installing the Plugin... 3 Installing the Plugin... 3 Client Installation... 4 Resetting the Binaries...4
MailFoundry Users Manual. MailFoundry User Manual Revision: MF2005071100 Copyright 2005, Solinus Inc. All Rights Reserved
MailFoundry User Manual Revision: MF2005071100 Copyright 2005, Solinus Inc. All Rights Reserved Page 1 of 91 Chapter 1: Introduction... 4 What are Spam Profiles?... 4 Models Covered In This Manual... 4
How to Disable Common Pop-Up Blockers
How to Disable Common Pop-Up Blockers Listed below are some of the most popular pop-up blocking software packages, and instructions to enable pop-up windows with them. Pop-up windows must be enabled to
User Manual. Onsight Management Suite Version 5.1. Another Innovation by Librestream
User Manual Onsight Management Suite Version 5.1 Another Innovation by Librestream Doc #: 400075-06 May 2012 Information in this document is subject to change without notice. Reproduction in any manner
Kaseya 2. Installation guide. Version 7.0. English
Kaseya 2 Kaseya Server Setup Installation guide Version 7.0 English September 4, 2014 Agreement The purchase and use of all Software and Services is subject to the Agreement as defined in Kaseya s Click-Accept
Using Remote Desktop with No-IP
Page 1 of 6 Lost Password? Sign-up Now!. com Support : Guides and Tips : Remote Access : Using Remote Desktop with No-IP Overview The use of Microsoft's Remote Desktop Connection to access another computer
DEPLOYMENT GUIDE Version 1.2. Deploying F5 with Oracle E-Business Suite 12
DEPLOYMENT GUIDE Version 1.2 Deploying F5 with Oracle E-Business Suite 12 Table of Contents Table of Contents Introducing the BIG-IP LTM Oracle E-Business Suite 12 configuration Prerequisites and configuration