A web browser is an application which uses http and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer, and management.

learn more… | top users | synonyms (2)

-3
votes
0answers
11 views

Server side script to check if browser is vulnarable to SSLv3 Poodle

I want to implement a browser SSLv3 Poodle vulnerability test like https://zmap.io/sslv3/sslv3test.html on my web application. My idea is to put a routine in the application first page to tell to my ...
0
votes
1answer
20 views

Sharing sensitive information across servers on visits from the same browser

I have this scenario: Webserver domain A. Generates sensitive information when a request from a browser is received but this information is not disclosed to the browser. Webserver domain B. ...
4
votes
3answers
66 views

Same Origin Policy - XHR response

I know that Same Origin Policy (SOP) prevents a page/script from one origin to read response from another origin, but it does not prevents the page/script from making a XMLHttpRequest (XHR) request to ...
3
votes
1answer
45 views

Bing bar without admin rights

I know viruses uses exploits to gain admin rights to install software. My question is here at work, we have people end up with the Bing Bar installed from time to time on their machines. It is listed ...
0
votes
1answer
33 views

Isn't reading authentication data from the browser's storage malware behavior? [on hold]

I mean, is it ethical? Isn't it a possible breach of security? How safe is the authentication data stored by the browser in a windows PC? Case study: The issue is Avast antivirus on PC reads ...
1
vote
0answers
80 views

Consequences of disabling SSL2 and SSL3 on our webserver [migrated]

Our system is quite old and as a result gets an F grade for SSL from Qualsys SSL because the server supports SSL2 and SSl3. We have now identified all the browsers people are using. The oldest is ...
3
votes
4answers
108 views

Do search engines give searcher's IP address to sites that come up in search? [closed]

Ok so for example, I search "stackexchange" and a bunch of pages come up in the search result - of course most of them from this very site, and many other ones talking about stackexchange. Would this ...
2
votes
0answers
38 views

How to get directly to text versions of Google cached pages [closed]

http://navigators.com/cached.html According to the bottom of that site, it seems the easiest way to view websites without giving them your IP is: "Edit the heck out" of google URLs like this: ...
2
votes
1answer
39 views

Click to play plugins vs. AdBlock?

Reading through articles like Faked Flash-based ads... I'm wondering what is a better way to keep yourself safe from malvertising. Many people suggest setting your browser's plugin settings to "Click ...
2
votes
1answer
34 views

Does visiting cached pages disclose my IP address to site admin? [closed]

I know it discloses my IP to Google, but is my IP also disclosed to the owner of the site of which Google made cached pages that I'm looking at? And how about anything I do within the cached page - ...
2
votes
2answers
80 views

Foolproof way to hide your IP when browsing [closed]

is there a fool proof-ish way to hide your IP from websites you visit? I heard even if you use VPN, there can be 'leaks'? And one step more secure is Anonymizer or Tor? Can they have 'leaks', too? ...
3
votes
2answers
107 views

Payment form from http is secure? [closed]

There are lot of payment gateways (Worldpay, PayPal, ..) offering easy integration, when the plain webpage using URL redirection to the payment page. HTTPS (worldpay,paypal), where the user posts his ...
2
votes
1answer
49 views

What are some useful tags and payloads for HTML injection on CSP-protected sites?

I'm pen-testing a website that fixed most of its XSS vulnerabilities by just adding a Content Security Policy. There are still HTML injections in several places. I've tried to get a ...
0
votes
2answers
1k views

HTTPS icon red and crossed out - Chrome browser

I just would like to ask what actually means when HTTPS icon is red / crossed - out. Is this site is vulnerable to Man in the Middle Attack? Is it safe or not?
1
vote
3answers
116 views

Benefit to disabling TLS1.1 and TLS1.2?

In light of recent developments on SSL issues such as BEAST and POODLE, I decided to configure my browser to only allow TLS1.1 and higher. The trouble is, that I am finding a lot of websites which do ...
-1
votes
1answer
64 views

What are the heuristics for a malicious url? [closed]

I know that there is nothing like a safe website ,any website which is safe today could be hacked and its visitors could be served with latest malware. What I'm curious about is what checks can we ...
0
votes
0answers
29 views

Browser not blocking popups [migrated]

I have disable showing popups for all sites in my chrome browser. But when I visit http://www.hdfcbank.com/ and click Login , it show a pop up window. Why chrome is not blocking this? Are there some ...
24
votes
2answers
3k views

Does browser 'view-source' mode avoid scripting attacks?

Let's say there's a URL www.badjs.com which is untrusted and may contain bad scripts. Intuitively, a view-source navigation to that URL does not execute any scripts so it should be safe. It would at ...
11
votes
2answers
662 views

Why does rfc6797 say “An HSTS Host MUST NOT include the STS header field in HTTP responses over non-secure transport.”

Why does the RFC prohibit the server from sending HSTS to the client over HTTP? I can see that if a HTTP client responds to that unsecure HTTP response it might cause that site to be inaccessible ...
0
votes
0answers
16 views

What is the best way to manipulate the browser fingerprint? [migrated]

The test here worries me: http://panopticlick.eff.org/ and I'd like to know if there is a good way to manipulate the browser fingerprint?
5
votes
1answer
98 views

How to add certificate pinning for a certain domain to my web browser?

There is HPKP (HTTP Public Key Pinning) which servers use to tell the client's web browser which certificates to trust (in the future) for the domain that is being contacted. Google's Chrome and ...
1
vote
1answer
119 views

Does the browser still stores the website you visited Private Browsing [incognito Firefox]?

As they clearly state in their website they mention that What does Private Browsing not save? Visited pages: No pages will be added to the list of sites in the History menu, the Library window's ...
0
votes
1answer
115 views

Is there any security benefit in stripping only `<script>` tags that contain code?

On a client's corporate network something is stripping all <script> elements that contain code, i.e. things like <script type="text/javascript">do_something();</script> will simply ...
-1
votes
1answer
52 views

Custom TLS in Browser [duplicate]

We are developing a JSF web application that has a main requirement of using our own TLS implementation (custom algorithm suites). The clients will connect via a browser. Is there any way (customising ...
0
votes
2answers
145 views

Source code disclosure vulnerability

I am a bit confused about the discussion here about hiding javascript source code. Let's say if I browse to a url like this: http://www.example.com/site/somejs.js and then what I see is something like ...
0
votes
1answer
45 views

Can video feed be used to track location of an IP?

I dont know if it is possible but i read that while a user is viewing video, the location of user can be traced without sharing its knowledge to the user. Even when user has disabled the option to ...
0
votes
2answers
110 views

Restrict website access

I want website (A) to only work if a visitor came by clicking a link from a specific other website (B). Initially I thought of using the document.referrer from website A to check whether website B is ...
2
votes
1answer
292 views

Can someone explain, in simple terms, how the FREAK attack on browsers works?

Is there a reason it only affects browsers on Windows machines and not Mac's or UNIX/LINUX environments? A lot of the wording on this site is particularly complicated and I don't understand fully what ...
1
vote
1answer
112 views

Cross Domain Javascript security [duplicate]

I used a web vulnerability scanner to scan my web site. It indicates several links with "Cross domain Java script source file inclusion." May I know how would an attacker exploit this type of ...
1
vote
1answer
632 views

Untrusted connection visiting https://www.opensource.apple.com/

Somebody on Stackoverflow posted some code from https://www.opensource.apple.com/ When I click this link in Firefox (36.0) it says "This Connection is Untrusted". But other people on that thread on ...
3
votes
1answer
65 views

Does a browser have to make multiple requests to verify an SSL certificate chain?

I've learned that SSL certificates can be chained, and the browser will use the issuer's public key to verify the issuer's signature. I have read this article, which has a very helpful diagram, but it ...
2
votes
4answers
152 views

How safe is SSL on an untrusted computer and network?

In situations where the consumer doesn't trust/control the workstation and the network, can consumer safely do potentially sensitive activities (like making a payment or transferring confidential ...
34
votes
8answers
5k views

Why do browsers default to http: and not https: for typed in URLs? [duplicate]

When I type example.com without any scheme into the browser bar and press Enter it is interpreted as HTTP://example.com, not HTTPS://example.com. Why? And where are the plans to fix this? (To be ...
3
votes
3answers
255 views

External cross domain include script

One of my web application underwent a vulnerability assessment recently, and one of the findings is about cross domain include script. Our web app uses addthis_widget.js from AddThis to bookmark ...
0
votes
1answer
66 views

Clarification on a website security

I am new to work on website handling and here are my questions. 1) How can I ensure that the pages accessing is secure enough for data transmission , sql injection and several other attacks. 2) How ...
2
votes
1answer
62 views

Secure Flash with Click to Play Plugins in the Enterprise

In the recent light of repeating critical Flash vulnerabilities there are recomendations to use browserplugins like click-to-play to prevent unnecessary flash content to automatically load with every ...
1
vote
1answer
27 views

Can a Certificate Authority associated with Active Directory publish a client certificate to a browser?

Can I use some integration of Windows Active Directory and a Certificate Authority to embed a client certificate in a browser that will be trusted by a server? I have a private domain and control ...
-2
votes
2answers
90 views

How would I start becoming knowledgable about hacking and able to do it? [closed]

Is there a site I can start reading tutorials to simpler stuff to build up my skills??? Or is someone willing to give me a task (easy one) to do?
0
votes
1answer
30 views

Secure keyboard entry with JavaScript or Flash?

Is it possible to perform secure keyboard entry (similar to what is offered in the OS X Terminal app) using only web technologies and/or Flash? If not, is there any way to more broadly guarantee ...
11
votes
2answers
906 views

How can I hide my logged in sessions from other websites?

Most people go on browsing the web while connected to their facebook/gmail/etc. accounts. Other websites somehow know what accounts you're logged in. For example, if you go to hide.me's torrent page, ...
1
vote
2answers
103 views

Can Professor See Open Tabs Or History? [closed]

I have a professor that has online quizzes. They mentioned on the first day that they can see the other tabs open in the browser so don't try to cheat by looking up answers. Is this possible? If not ...
2
votes
3answers
63 views

Are auto complete forms a security concern?

I know when I fill out forms with address and email it will attempt to auto complete the rest of the information. Is it possible to include more hidden fields on the page in order to get more ...
0
votes
1answer
43 views

From a security perspective, why not a screenshot api for browser? [closed]

I mean a javascript api for capturing a renderered html page, or current viewport, and dump content onto an image. While there are obvious attacks, such as taking screenshot of sensitive information, ...
4
votes
2answers
115 views

find if 0-day flash bug was exploited (on a particular machine)

There have been several critical 0-day exploits in the past days/weeks in Flash alone. Nobody knows how long the 0-days have been exploited, and it is reasonable to expect that there are 0-days being ...
3
votes
1answer
84 views

How is this web resource hidden from the user? [closed]

Motivation: I've been interested in how various agencies hide data, either through incompetence or willful intent, that is required to be "open". Specifically I've seen oil companies use images to ...
3
votes
1answer
116 views

How does the same-origin policy apply between browser tabs? [duplicate]

Let's assume that we have 2 open tabs in a browser containing page A (A.html, A.js) into the first tab and page B (B.html, B.js) into the second tab and that page A and B have the same origin (scheme, ...
9
votes
2answers
442 views

How to improve the security and privacy of Firefox

What would be a sensible approach to enhance the security and privacy of Firefox? I did not find a question about this and I feel that some guidelines for casual web users would be handy. Currently ...
3
votes
1answer
115 views

Login to one site using other site's credentials

I am frequently seeing websites that allows a user to log-in to their site using other websites log-on credentials. If there is a page that allows me to log-in using my google account or facebook ...
5
votes
1answer
115 views

Why is a child window allowed to change the location of its parent?

Maybe a silly question. When opening a new tab via target="_blank", the page that loads in that tab is allowed to set a new location in the parent tab using: ...
0
votes
1answer
133 views

Can HTTPS be compromised by first contact?

Let's say I am behind my PC and want to go to any secured website (HTTPS). I have the direct IP address so any possible hack on DNS level is not possible (because I am not using it ;) ). The packet ...