A web browser is an application which uses http and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer, and management.

learn more… | top users | synonyms (2)

0
votes
0answers
2 views

How does infection through web surfing work?

Often I read about compromise due to visit a malicious site which download some exploit to your computer. I've never seen a detailed process, all books/tutorials I read just say sentences like "once ...
1
vote
5answers
67 views

Beyond patching, how can I reduce the risk of browser exploits?

Keeping web browsers on the most up to date version and also the plugins that are used is pretty much all we do. Is there anything I else I can do to reduce the risk of browser exploits? The only ...
-6
votes
2answers
51 views

Large web application security challenges [closed]

What are the biggest challenges of security in web applications? I want to do a search in the area but I'm not sure what I want to look, I want something that people think it is impossible to serve ...
1
vote
1answer
52 views

How does Yandex Alpha sign me in automatically?

I downloaded the new Yandex Alpha browser. When installing, I chose not to make it the default browser and not to send anonymous usage statistics. I never got a prompt whether I wanted to import ...
-2
votes
0answers
27 views

What is the lowest significant level of security for the personal devise user, at present? [closed]

By present the last couple years and were the next years is going. In terms of a single person considering their lowest level signal to the internet using computing hard electronics, what is the ...
2
votes
2answers
55 views

How to display friendly notification about no TLS 1.0 support in browser [closed]

A browser that only has SSL 1.0 support won't be able to establish an HTTPS session with a server that has only TLS 1.1 and TLS 1.2 support. This typically results in a cryptic (to a normal user) ...
1
vote
2answers
38 views

How to avoid referer information leakage during password reset

Most password reset systems involve emailing the user a one-time link that lets them reset their password. The token needs to be in the URL, as most email clients do not allow HTML emails to perform ...
11
votes
2answers
722 views

How safe is it to use developer's version of the browsers [closed]

I have heard that the developer versions of browsers (chrome and firefox) are less secure than stable versions of them. Is it true? Is there any sense in using developer editions of browsers for ...
-5
votes
1answer
79 views

How to avoid DDoS Attack [closed]

I buy my train ticket from our railway local web site. When ticket open for sale on web site then web site original traffic remain 50 (Just an example). Our railway web site is attacked by DDoS for ...
6
votes
2answers
85 views

Information Transfer Between Browsers and Tabs

Is it possible for a webpage to detect or otherwise be aware of what other tabs in the same browser, or even other open webpages in other browsers are doing or transmitting? I am well aware of ...
3
votes
1answer
60 views

How can two clicks lead to better security in the context of, e.g., Twitter and Facebook share buttons?

The sharing section of Jedox's webpage has the Facebook, Twitter, Google+ and Linkedin share options in default inactive state. You need to first click it to activate and click again to get the share ...
1
vote
2answers
75 views

Is it considered a CSRF if it requires a unique identifier which is not a CSRF token - not tied to the user session?

Consider an end point such as below. Let's imagine that this endpoint updates an address of the signed in user, changing the zip code. The address to update is identified by the address ID ...
2
votes
1answer
110 views

How does firefox sync password recovery work?

According to Mozilla Sync-new-security-model, Firefox servers are not able to decrypt your sync data without your password. So I figured that, the browser generates a key from your password, encrypts ...
0
votes
0answers
12 views

Error 207: ERR_CERT_INVALID [migrated]

I'm trying to make it so people can create a private key via the browser via the element and then after have it so that an X.509 cert is sent to them that's then installed into the browser. But I ...
2
votes
1answer
61 views

What happens if a page with an invalid SSL cert responds with a 302 redirect to a page with a valid cert? Do you still get the warning?

Alice navigates to https://example.com. https://example.com delivers an invalid certificate. https://example.com 302 redirects to https://www.example.com https://www.example.com delivers a valid ...
0
votes
1answer
100 views

Open source alternatives to tamper data

I'm developing a browser(firefox) plug-in which essentially checks for malicious input. My current approach is to store all input fields sent in GET/POST requests, try to heuristically determine ...
0
votes
1answer
41 views

Add certificate authority to one browser only

For testing purposes, I'd like to add a "CA" to the list of trusted-CA's of one browser - and use it only for testing. I want to make sure that it won't get added to the computer's trusted CA list. ...
1
vote
1answer
1k views

Why is 'avast! Web/Mail Shield Root' listed as CA for google.com?

I just noticed something weird in my browser: the certificate for www.google.com has been issued by avast! Web/Mail Shield Root. Should I be worried? I am using avast! Antivirus so it's probably a ...
-2
votes
1answer
36 views

Tools or scripts to scrape browser credentials and data?

I'm exploiting machines in a network and I'm currently trying to scrape data to further my testing from the compromised machines. There's no SOE build so i've got a variety of different environments. ...
1
vote
1answer
80 views

How does a browser choose which certificate to use if my web server has multiple certificates?

I'm using Apache 2.4, with two certificates, one RSA signed by CACert, and one ECC self-signed. Neither of these certificates provide a path to a broswer-trusted root certificate. My question is ...
0
votes
2answers
92 views

Browser page “Not resolved” page hijacked by yandex [closed]

Any domain that cannot be resolved defaults to yandex right now, on any browser on my system. Helper objects or extensions are not installed. It turns out that the ISP (Turk Telekom) is employing ...
1
vote
1answer
58 views

Reflected file download Scenario

I'm making a Java-based web application that is intentionally vulnerable to Reflected File Download (RDF). White paper is here I read the requirements of reflected file download vulnerability as ...
8
votes
1answer
682 views

Browser password manager vs third party password manager

How usable and secure are 3rd-party password managers like Roboform, Lastpass, and 1password from the built-in Chrome and Mozilla password managers? What are the advantages of using 3rd-party password ...
3
votes
1answer
129 views

Regarding Windows password and Chromes Remember password Feature

Google Chrome browser helps in password management by prompting users to remember their passwords for the websites. These saved passwords can be accessed from the browsers "settings" menu, and to do ...
2
votes
1answer
95 views

While logged in to Google etc., can a malicious site discover my ID?

If I visited a malicious site while being logged in to Google, Hotmail, Facebook, or Twitter in the same browser window, how hard is it for the site to discover my account IDs without my explicit ...
2
votes
1answer
340 views

Questions on reflected file download (RFD) attack

I read this article, and the whitepaper by security researcher Oren Hafif which mentions the following salient points: RFD, like many other Web attacks, begins by sending a malicious link to a ...
-4
votes
1answer
107 views

How does https check md5, sha-1 and sha-2 fingerprints?

When a https site shows multiple finger prints, i.e.: md5 and sha1, or sha256 and sha1, how does the browser check? is it both just the "strongest" or whatever is convenient? This question arose ...
1
vote
1answer
145 views

Browser gives access to root directory through “/” [closed]

If I put a '/' on my browser I have full access of my root directory. I have tried the same thing on another computer and it didn't work. So, I'm trying not to be paranoid but this is too strange. I ...
1
vote
1answer
102 views

Is it dangerous to allow clients to run JavaScript on a Server

On a webpage I have been working on, we can archive certain webpages for a user. The user can give an address and this webpage is than visited on the server and archived. Lately, I noticed that ...
5
votes
1answer
436 views

Google Chrome browser warning for goo.gl

I am getting the solid red screen Chrome browser malware warning for Google's own URL shortening website, goo.gl as well as other sites such as bit.ly and delicious.com when I try to navigate there ...
3
votes
2answers
40 views

Why browsers implement stricter policy for local files

I have a problem viewing HTML/JS/CSS files generated on disk. Specifically, several calls in javascript are blocked by Google Chrome. I googled and found an answer here: ...
-4
votes
3answers
132 views

Why doesn't Google Safe Browsing block the IP addresses of malicious websites?

If you visit a blocked domain name like www.thelotbet.cn from Google Chrome, Opera or Firefox, you will get a warning from Google Safe Browsing that this is a malicious website. But if you visit the ...
1
vote
0answers
87 views

Hidden TrueCrypt Container containing the Tor Browser Bundle

I'm considering using a hidden TrueCrypt container to keep a Tor browser bundle copy which could save bookmarks. In this case, would the TBB leave traces on the OS it started with? E.g. I use my ...
1
vote
2answers
219 views

Will Ad Block Plus block the ads that give someone Cryptowall 2.0?

Now I already know that making sure your browser plugins are either non-existent or up-to-date is one way of being on the safe side against ransomeware like Cryptowall 2.0; but since clicking ads are ...
9
votes
4answers
1k views

My ISP is injecting strange codes to every website I visit

Here's the code at the bottom of every page: <script type="text/javascript">if(self==top){var idc_glo_url = (location.protocol=="https:" ? "https://" : "http://");var idc_glo_r = ...
6
votes
3answers
3k views

Force a connection via SSL3 to detect POODLE vulnerability

I have been reading up on the POODLE vulnerability. From my understanding, and correct me if I am wrong, you need to allow connections to be made via SSLv3 on the server. The server I am currently ...
3
votes
3answers
162 views

How is the same origin policy causing my PoC to fail when I don't need to read return data?

I'm performing an authorized vulnerability analysis on a custom web service and have discovered a CSRF vulnerability. Due to there not being form tokens coupled with the service not checking for the ...
3
votes
2answers
84 views

How does a browser manage secure sessions and store session keys?

I am interested in how a browser manages secure sessions. As I understand it this is the scenario when logging into a google account: 1) Browser (B) and google Server (S) perform a handshake to ...
-1
votes
2answers
66 views

Which web browser supports a proxy in proxy configuration? [closed]

Normally you are forced to use a corporate proxy. This is necessary for the company to protect against the internet. But a side effect is, that the internet usage of every proxy user can be monitored ...
0
votes
2answers
63 views

Detect Different Machine using Browser [closed]

Some web apps like Facebook and Gmail detect the first time we try to login from a device. Assuming that a browser can't read machine name, and MAC ADDRESS. What kind of variables are they collecting ...
4
votes
4answers
1k views

Is it a security risk to use an unknown web browser?

The more I read about TLS, the more I get convinced that the browser is the weakest link in the chain. I know that nobody agrees with me as there are no articles about that in Google, but it looks ...
2
votes
2answers
93 views

Steps after getting hit with malware or browser exploits on Xubuntu

Well, today I was browsing the internet and I suddenly got redirected to a chinese hosted malware site and firefox started going crazy. I checked the url on virustotal with my phone and it found other ...
5
votes
3answers
967 views

Can CSS file contain malware? [duplicate]

I know that javascript files can contain malware. However, I am not so sure about CSS files. They only affect how the page is displayed, right? I know that css files can be used for clickjacking but I ...
3
votes
1answer
44 views

Enabling Unsigned ActiveX

A third-party wants to provide a web app which they say only works if we enable unsigned ActiveX (unfortunately users are required to use IE). I understand what 'signing' is, as well as the basic ...
1
vote
1answer
60 views

using multiple Firefox profiles to increase security

I am wondering whether it would increase security in any significant way, if I would use two separate Firefox profiles, one for normal browsing and the other for private/secure websites, such as my ...
1
vote
2answers
60 views

Xubuntu guest session security

lately I've been using the guest session on my xubuntu install because I am lazy and I was wondering what the security implications can be on the rest of the system if there is a web browser exploit ...
2
votes
2answers
48 views

Question regarding browser windows when integrating with 3rd party payment software

I've been told that when integrating with a 3rd party payment gateway, the other website's window should not be opened in an iFrame or a separate window - that the current application window itself ...
31
votes
2answers
4k views

Why do browsers enforce the same-origin security policy on iframes?

I did a small test on Chrome (V37) today. I created a small page and loaded it to the browser: <!DOCTYPE html> <html> <head> <title>Untitled Document</title> ...
4
votes
1answer
155 views

How will SHA1 deprecation affect internal CA's?

I am hearing that the SHA1 Deprecation notices from MS/CHROME only apply to certs that are a part of a public trusted root program. This makes one believe that IE will have new logic built in to allow ...
0
votes
1answer
151 views

Reflected XSS script passing through URL how to make it work and what are the preconditions for it to work?

Trying to learn about security I set up the most simple website on my localhost consisting of one html page that a apache server serves. I first started trying and appending the JS script that would ...