If I see a login form that's not using HTTPS (it only diplays http:// in the URL) how can I determine if this request is forwarded to a secure server?
3
-
1What do you mean by a "secure server"? If you're not using HTTPS, you're not over a secure connection.– heavydDec 19, 2013 at 16:58
-
While @arco444 answer is good and correct, you should assume its not secure - even if it is posting to HTTPS as the request could be rewritten to someone elses HTTPS server, ie the system could already be compromised. Moxy Marlinspike has done in depth talks about subverting https, and it would be relatively trivial to attack this.– davidgoDec 19, 2013 at 18:00
-
@davidgo, thank you for your answer. Please convert your comment to an answer and I'll accept it.– prmthsJan 13, 2014 at 12:51
Add a comment
|
2 Answers
Expanding on the comment of @arco444, you should assume its not secure - even if it is posting to HTTPS as the request could be rewritten to someone elses server, ie the system could already be compromised. Moxy Marlinspike has done in depth talks about subverting https, and it would be relatively trivial to attack this.
I assume you're referring to the form action, and whether this does a POST or similar to https.
You could view the page source, there's a chance the destination will be in the "action" parameter if the form is in html, though a lot of sites are unlikely to use this method.
In that case, use Firebug or Chrome developer tools and select the network tab, put some dummy data in the form and submit it, and look at the resulting requests your browser makes.
