HTTP

One small step for a browser, one giant leap for web security!

With the release of Chrome 68 we're seeing a fundamental shift in our expectations of security on the Web, we will now see the 'Not Secure'...

Free Post

HSTS

Migrating from HTTP to HTTPS? Ease the pain with CSP and HSTS!

The Chrome Security Team have just announced that they're removing the yellow warning triangle from pages with mixed content. From now on, these pages will show with the...

Free Post

HSTS

Introducing SecurityHeaders.io

After looking around for a quick and easy way to analyse the HTTP response headers of websites, I regularly found myself looking in Chrome Dev Tools. This isn't...

Free Post

cookies

Web Security - The hidden dangers of hunting for a new house

When looking for a new house to buy in the UK, the chances are at some point you will end up on the website of RightMove or Zoopla. With RightMove claiming they are "the UK's number one property website" and...

Free Post

HSTS

Issuing HSTS policy in PHP

HSTS is a great way of protecting visitors to your website by ensuring their browser only uses a secure connection to communicate. If you use shared hosting and don't have access to change the header configuration, or you simply want to test...

Free Post

HSTS

Manually enforcing HSTS in Google Chrome

HSTS Policies are usually distributed by a web server as a HTTP Response Header. Whilst some sites enforce HTTPS by issuing a redirect, many do not implement HSTS and leave the user vulnerable to a MiTM attack. HSTS Policies can be added to Google...

Free Post

encryption

HSTS - The missing link in Transport Layer Security

HTTP Strict Transport Security (HSTS [https://scotthel.me/d8j3]) is a policy mechanism that allows a web server to enforce the use of TLS [https://scotthel.me/s8d7]in a compliant User Agent (UA), such as a web browser. HSTS allows for a more...

Free Post

encryption

Virtual Private Networks (VPNs) - The guardians of your online privacy

A Virtual Private Network (VPN) allows you to connect devices or networks together with a reliable and secure connection. Most frequently used in corporate environments to link offices in different geographic locations, a VPN allows the sharing of resources efficiently and securely. Their recent...

Free Post

code injection

Code Injection - TLS (SSL) is not all about privacy, it's about integrity too

TLS isn't just about ensuring your data remains private whilst transiting the Internet, it's also about ensuring the integrity of the data. In this post I will demonstrate a HTML injection attack and show you what a man in the...

Free Post

cain

Advanced Session Hijacking - Is coffee shop WiFi such a good idea?

Learn just how easy it is to hijack sessions over the LAN or Wifi and why using that free WiFi at your local coffee shop could cost you more than you expect! In a previous blog post [https://scotthelme.co.uk/session-hijacking-ssl-doesnt-mean-secure/] I gave...

A collection of 10 posts

One small step for a browser, one giant leap for web security!

Migrating from HTTP to HTTPS? Ease the pain with CSP and HSTS!

Introducing SecurityHeaders.io

Web Security - The hidden dangers of hunting for a new house

Issuing HSTS policy in PHP

Manually enforcing HSTS in Google Chrome

HSTS - The missing link in Transport Layer Security

Virtual Private Networks (VPNs) - The guardians of your online privacy

Code Injection - TLS (SSL) is not all about privacy, it's about integrity too

Advanced Session Hijacking - Is coffee shop WiFi such a good idea?

Upcoming Events

Cheat Sheets

Projects

Upcoming Events

Cheat Sheets

Projects

Follow