Tagged Questions

A web browser is an application which uses http and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer, and management.

learn more… | top users | synonyms (2)

1
vote
1answer
44 views

Questions on reflected file download (RFD) attack

I read this article, and the whitepaper by security researcher Oren Hafif which mentions the following salient points: RFD, like many other Web attacks, begins by sending a malicious link to a ...
-4
votes
1answer
48 views

How does https check md5, sha-1 and sha-2 fingerprints?

When a https site shows multiple finger prints, i.e.: md5 and sha1, or sha256 and sha1, how does the browser check? is it both just the "strongest" or whatever is convenient? This question arose ...
1
vote
1answer
119 views

Browser gives access to root directory through “/” [on hold]

If I put a '/' on my browser I have full access of my root directory. I have tried the same thing on another computer and it didn't work. So, I'm trying not to be paranoid but this is too strange. I ...
1
vote
1answer
89 views

Is it dangerous to allow clients to run JavaScript on a Server

On a webpage I have been working on, we can archive certain webpages for a user. The user can give an address and this webpage is than visited on the server and archived. Lately, I noticed that ...
4
votes
0answers
294 views

Google Chrome browser warning for goo.gl

I am getting the solid red screen Chrome browser malware warning for Google's own URL shortening website, goo.gl as well as other sites such as bit.ly and delicious.com when I try to navigate there ...
3
votes
2answers
25 views

Why browsers implement stricter policy for local files

I have a problem viewing HTML/JS/CSS files generated on disk. Specifically, several calls in javascript are blocked by Google Chrome. I googled and found an answer here: ...
-4
votes
3answers
92 views

Why doesn't Google Safe Browsing block the IP addresses of malicious websites?

If you visit a blocked domain name like www.thelotbet.cn from Google Chrome, Opera or Firefox, you will get a warning from Google Safe Browsing that this is a malicious website. But if you visit the ...
1
vote
0answers
59 views

Hidden TrueCrypt Container containing the Tor Browser Bundle

I'm considering using a hidden TrueCrypt container to keep a Tor browser bundle copy which could save bookmarks. In this case, would the TBB leave traces on the OS it started with? E.g. I use my ...
1
vote
2answers
153 views

Will Ad Block Plus block the ads that give someone Cryptowall 2.0?

Now I already know that making sure your browser plugins are either non-existent or up-to-date is one way of being on the safe side against ransomeware like Cryptowall 2.0; but since clicking ads are ...
6
votes
4answers
300 views

My ISP is injecting strange codes to every website I visit

Here's the code at the bottom of every page: <script type="text/javascript">if(self==top){var idc_glo_url = (location.protocol=="https:" ? "https://" : "http://");var idc_glo_r = ...
6
votes
2answers
1k views

Force a connection via SSL3 to detect POODLE vulnerability

I have been reading up on the POODLE vulnerability. From my understanding, and correct me if I am wrong, you need to allow connections to be made via SSLv3 on the server. The server I am currently ...
3
votes
3answers
102 views

How is the same origin policy causing my PoC to fail when I don't need to read return data?

I'm performing an authorized vulnerability analysis on a custom web service and have discovered a CSRF vulnerability. Due to there not being form tokens coupled with the service not checking for the ...
2
votes
0answers
45 views

How does a browser manage secure sessions and store session keys?

I am interested in how a browser manages secure sessions. As I understand it this is the scenario when logging into a google account: 1) Browser (B) and google Server (S) perform a handshake to ...
-1
votes
2answers
55 views

Which web browser supports a proxy in proxy configuration? [closed]

Normally you are forced to use a corporate proxy. This is necessary for the company to protect against the internet. But a side effect is, that the internet usage of every proxy user can be monitored ...
0
votes
2answers
55 views

Detect Different Machine using Browser [closed]

Some web apps like Facebook and Gmail detect the first time we try to login from a device. Assuming that a browser can't read machine name, and MAC ADDRESS. What kind of variables are they collecting ...
4
votes
4answers
1k views

Is it a security risk to use an unknown web browser?

The more I read about TLS, the more I get convinced that the browser is the weakest link in the chain. I know that nobody agrees with me as there are no articles about that in Google, but it looks ...
2
votes
2answers
59 views

Steps after getting hit with malware or browser exploits on Xubuntu

Well, today I was browsing the internet and I suddenly got redirected to a chinese hosted malware site and firefox started going crazy. I checked the url on virustotal with my phone and it found other ...
5
votes
3answers
918 views

Can CSS file contain malware? [duplicate]

I know that javascript files can contain malware. However, I am not so sure about CSS files. They only affect how the page is displayed, right? I know that css files can be used for clickjacking but I ...
3
votes
1answer
36 views

Enabling Unsigned ActiveX

A third-party wants to provide a web app which they say only works if we enable unsigned ActiveX (unfortunately users are required to use IE). I understand what 'signing' is, as well as the basic ...
0
votes
0answers
24 views

How does a browser know if a site supports https [migrated]

A lot of sites now default to https. Where beforehand i would have had to asked for https specifically (ie: typing out https://www.google.com) now even if I type out just www.google.com or even ...
1
vote
1answer
43 views

using multiple Firefox profiles to increase security

I am wondering whether it would increase security in any significant way, if I would use two separate Firefox profiles, one for normal browsing and the other for private/secure websites, such as my ...
1
vote
2answers
35 views

Xubuntu guest session security

lately I've been using the guest session on my xubuntu install because I am lazy and I was wondering what the security implications can be on the rest of the system if there is a web browser exploit ...
2
votes
2answers
43 views

Question regarding browser windows when integrating with 3rd party payment software

I've been told that when integrating with a 3rd party payment gateway, the other website's window should not be opened in an iFrame or a separate window - that the current application window itself ...
31
votes
2answers
2k views

Why do browsers enforce the same-origin security policy on iframes?

I did a small test on Chrome (V37) today. I created a small page and loaded it to the browser: <!DOCTYPE html> <html> <head> <title>Untitled Document</title> ...
3
votes
1answer
127 views

How will SHA1 deprecation affect internal CA's?

I am hearing that the SHA1 Deprecation notices from MS/CHROME only apply to certs that are a part of a public trusted root program. This makes one believe that IE will have new logic built in to allow ...
0
votes
1answer
72 views

Reflected XSS script passing through URL how to make it work and what are the preconditions for it to work?

Trying to learn about security I set up the most simple website on my localhost consisting of one html page that a apache server serves. I first started trying and appending the JS script that would ...
31
votes
9answers
4k views

Why is it a security problem not to update one's browser?

Is it in general a security problem not to update your browser. Firefox constantly prompts me to update my browser, but how dangerous is it to not update? As part of this question, I would like to ...
2
votes
1answer
80 views

XSS: alert() not executed on different OS/computer

I've encountered a strange behavior while I was performing a security audit of a web application. Some user controlled inputs were displaying their values, unencoded, into the page that processed the ...
1
vote
1answer
48 views

Understanding cross origing requests from a web page

Reading up the XSS attacks on wiki I see that it says an injected script could send data/cookies to the attackers site. How is this achieved? Are there no checks/restrictions on cross origin requests ...
1
vote
2answers
138 views

Can my University see what Stack exchange account I am logged into?

I have to log into an account to use the university internet, so I imagine they can see all the sites I view, but can they see what account I am logged into, and can I do anything to hide this?
1
vote
1answer
86 views

Is it possible to compromise Bing to redirect user to a malware?

I just got a new laptop and the first thing I wanted was to install Chrome. I opened IE and searched for "google chrome" in Bing. The first result was an ad with the link pointing to ...
0
votes
2answers
32 views

what is the cons and pros of using webfiltering based on cloud security?

nowadays some vendors offering web filtering based on cloud security , where your web traffic will be forwarded to vendor cloud to be filtered and controlled at the vendor proxy , the vendor will ...
1
vote
1answer
56 views

BREACH attack and content length

I've been researching BREACH, and while I can understand how it might work if you have access to the the browser (to send crafted requests) and the wire (to capture compressed response length), I ...
2
votes
1answer
115 views

How effective is Opera Mini's encryption? Can it hide activity on a WiFi network?

I'm curious since I discovered the nature of how browsing works in Opera Mini. A URL request is sent to Opera's servers, they download the page then compress it to lower bandwidth. They use a file ...
1
vote
1answer
92 views

Is drive-by-download possible with NoScript?

I am using and getting my friends to use NoScript, and the argument I usually have to use to convince them is "It prevent website to infect you without you downloading something (by yourself)". But ...
1
vote
1answer
99 views

Is Payment using an iframe more secure than using as Javascript library?

Traditionally most Payment providers only provide Hosted Payment Sites via redirect or iframe. But now an increasing number is also supporting payment integration via a Javascript library. I imagine ...
-1
votes
1answer
134 views

Can Chrome's Incognito mode be disabled? [closed]

Is there a way to disable the use of anonymous navigation window (an Incognito window) in Google Chrome for a computer?
4
votes
1answer
81 views

How to prevent installation of Google Chrome extensions

You can prevent the installation of Google chrome extensions on a Desktop?
5
votes
4answers
621 views

What is a good browser for web application pen testing? [closed]

I am getting started in testing web applications, and I am having trouble verifying vulnerabilities. It seems all modern browsers have protections against things like XSS. When something like Burp ...
2
votes
1answer
135 views

How does this website prevent directing away from it

I'm using the latest version of Firefox with Ghostery and Adblock plus installed. This website somehow prevents navigation away from it. How does it do this and how can it be protected against? I ...
54
votes
1answer
3k views

“Allow __ to be fullscreen?”

I have been asking myself for a while what's the purpose of that popup showing up in pretty much all the modern browsers upon entering the full-screen mode of a video or website. It appears to be a ...
1
vote
2answers
89 views

Are input fields that don’t have name=“” sent via the browser [closed]

Are input fields that don’t have name attributes susceptible to MITM attacks (w/o SSL) or any other attack? For example: <form action="" method="post"> <label ...
0
votes
0answers
38 views

What are empty requests in web server log?

In enginx access.log I have plenty of request logs like this: 1.2.3.4 - - [18/Aug/2014:12:09:33 +0200] "-" 400 0 "-" "-" As you see there is neither browser specification nor any target url. I am ...
2
votes
3answers
79 views

Flash cookie and man-in-the-middle

I am using the Scala Play web framework. In it, there is a PLAY_FLASH cookie used to flash messages to the user (it's a cookie so it will still work after several redirects). I put HTML in the cookie ...
0
votes
1answer
190 views

Firefox vs. Chrome extensions: Which are---ceteris paribus---more secure?

As an 'extension' to earlier questions on this topic (for instance here and here), What makes Firefox extensions (appear) more secure than Chrome extensions? Do they just appear to be more secure, ...
0
votes
1answer
219 views

Browser and SSL support

According to http://en.wikipedia.org/wiki/Transport_Layer_Security#Web_browsers most browsers support SSL 3.0. And with my understanding (please correct me if I am wrong), when a browser just ...
0
votes
2answers
73 views

How the address bar manage the XSS?

I was playing with OWASP Mutillidae II and in one page I've found one vulnerability. In the address bar I've wrote something like : ...
9
votes
1answer
489 views

XSS Technique - & JavaScript Include

I was looking through the OWASP XSS Filter Evasion Cheat Sheet, and there was one technique that was completely new to me: & JavaScript includes <BR SIZE="&{alert('XSS')}"> I ...
0
votes
0answers
20 views

How JavaScript malware targets browsers? [duplicate]

What are the main components that JavaScript malware targets on the browsers ? Which aspects of browsers on which JavaScript takes advantage to exploit them ? And which techniques are used by ...
8
votes
2answers
536 views

How are browsers able to find and construct an alternate trusted chain path?

We had a web server that had the wrong SSL certs installed yet the browser was able to find another trusted path to a root and supply the page properly over HTTPS. We also have proprietary software ...