A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

learn more… | top users | synonyms (2)

0
votes
0answers
48 views

Browser Autopwn2 Unable to exploit Firefox 47.0.1

Virtual Appliance: VMWare Workstation 12 Player Local VM: Kali Linux 2 Remote (Victim) VM: Windows XP Browsers on Remote VM: Firefox 47.0.1, IE 6 This article explains Browser Autopwn2 exploit. I ...
2
votes
2answers
73 views

Is wget'ing a single HTML file basically free of risk?

There is a lot of potentially malicious stuff on the web. In fact, there are so many things that can happen that browsing to a location you know nothing about can be dangerous, like http://www.example....
0
votes
0answers
27 views

Client side encryption over SSL

I need to handle hyper secure data collected from webforms on a site. I was thinking of using whole site SSL encryption with client side encryption of the forms data. Due to a higher than usual risk ...
3
votes
0answers
32 views

How does a website know my location? Checked with ipleaks and VPN seems to work correctly

Recently I have been using a VPN to watch a free web series available only in the US -- on a website called https://go90.com. Until a few days ago everything was running smoothly with just Hola VPN. ...
3
votes
2answers
56 views

How to trust root CA

When I download a browser such as Mozilla, it comes bundled with several root Certificates. How do I trust that these certificates are legitimate? How do I know that my download does not contain ...
3
votes
3answers
30 views

How does the same origin policy apply to two different windows of a browser?

One particular scenario I am interested in: If I a open one chrome browser window with --disable-web-security option, then SOP is disabled. Will this window be able to access data on websites opened ...
0
votes
0answers
38 views

I may have been compromised, now what?

How to trace and single out this Malware in Browser Extensions? Chrome/ Opera? I had installed the extension mentioned in the thread above. It contained Malware the redirected Java functions mainly. ...
1
vote
0answers
41 views

How secure is the native browser password autofill?

Safari, Chrome, Firefox, Edge, and IE all either have a suggest-password feature, or password archival feature. How secure are these passwords when stored on a computer? If replicated, how secure ...
0
votes
0answers
17 views

Risk from browser add-ons?, from external sources [duplicate]

Can a user agent switcher read my passwords? what if it is not mallicious but weak, could it be a faultline for others to hack me?
0
votes
0answers
51 views

Comparison of security of PDFs on different platforms (web browser/adobe/android/iOS/mac) [closed]

There have been quite a few exploits of PDFs. Patches do claim to fix these exploits but what are the chances that PDFs are still widely used today as an exploit vector via zero-days? Of course, the ...
0
votes
1answer
24 views

Beef conection timeout problem [closed]

I'm unable to get the connection back from the victim in beef framework when the victim clicks the beef exploitation link. Anyone know what I might be doing wrong?
-2
votes
1answer
44 views

is there any way to get the cookie from another tab or iframe's parent in browsers?

i was given a task to find a working way to bypass windows and android browsers same origin policy to be able to get the cookie of an open Tab in victim's browser (like Gmail or ... cookie). but as ...
2
votes
1answer
58 views

Cross domain iframe security

How exploitable is a site listening to browser messages from anyone? I am working on a site where I have found some iframe issues. The case is that site A has an iframe of site B, and site A listens ...
0
votes
2answers
29 views

Why do SSL enabled sites don't reply back according to “hosts” file record?

I was playing with the hosts file under my linux distro. Added an entry 192.168.3.121 www.facebook.com in the /etc/hosts file. Created 2 servers which link to an index.html file at ports 80 ...
1
vote
1answer
35 views

How can I add my website to preload entries set of well-known browsers like Firefox or Chrome?

I have a website like https://www.example.com. I need to force all users visiting my site to use HTTPS connections. I thought about HSTS but I don't know how to add my site to the preload entries of ...
2
votes
2answers
77 views

How to protect against clickjacking via pop-under windows?

Huang and Jackson described a method of clickjacking that does not rely on iframes, but on pop-under windows. Is this attack still relevant today, or is it prevented by pop-up blockers? Is there any ...
-1
votes
0answers
38 views

Browser change the IP addesses of the POST requests

On my work PC i have web server working on localhost for development purpose, i use vhosts to access the projects - example: mycompany.dev -> 127.0.0.1 In this project there is a protection against ...
3
votes
1answer
106 views

How secure is HTML5 web storage (sessionStorage and localStorage)?

I'm thinking of using either sessionStorage or localStorage to store some important user data. The extension's functionality will only work in the context of a particular website that defaults to ...
7
votes
2answers
629 views

Did XSS reach its end-of-life with the introduction of the HTTP X-XSS-Protection header?

With the introduction of the HTTP X-XSS-Protection header it seems to me that the vulnerability impact (read: amount of possibly affected users with modern browsers) is drastically reduced. Firstly, ...
3
votes
2answers
92 views

Does displaying images on profiles by URL have security implications?

I am Developing a Web Application Currently, in which users can Make a Profile and Fill out the User's information, In this i have also kept a Section for Profile Picture, in that i have used a logic ...
0
votes
0answers
35 views

Java Exploits - Not using the browser plugin

I'm looking for examples of Java exploits that do not leverage the Java browser plug-in/Browser applet to run. For example: Drive-by downloads that download a Java file that is run by the JRE but ...
3
votes
2answers
93 views

Do the most used browsers have similar security?

I read that Pwn2Own stopped attacking Firefox, apparently because it didn't make "serious security improvements" since the last competition. Should I understand it as "Firefox is significantly more ...
7
votes
2answers
441 views

Can viruses access passwords that have been saved by a browser?

Say I use Chrome on a new computer to log in to a website, and I select the option to have the browser remember the password. Then I download a straight-up smorgasbord of viruses of every kind. Can ...
1
vote
1answer
59 views

Why do browsers not protect against scripts coming with images?

I understand that this is how it goes: Malformed Image --> Buffer Overrun --> Stack Over Flow --> Execute Malware Pushed On Stack And though I don't a huge amount about this, I know that I ...
8
votes
2answers
121 views

Why do browsers send such detailed user agent strings?

Modern web browsers leak a ridiculous amount of information through the User-Agent header. The following is an example for Safari on iPad, from Wikipedia: Mozilla/5.0 (iPad; U; CPU OS 3_2_1 like Mac ...
0
votes
1answer
70 views

Is it safe to send the user's encrypted password back to them in the browser? Why?

I have planned to send the encrypted password from the application back to the user. I am currently using AES to encrypt user passwords. I want to send the user's encrypted password back to them in ...
1
vote
2answers
97 views

Can I trust browsers not to snoop into my activities?

Is there anything stopping web browsers from snooping into our activities? I don't mean web history or any of that generic stuff (Chrome already collects them, right?), but is it technically possible ...
7
votes
3answers
129 views

Passive fingerprinting of HTTPS client

Is it possible to passively fingerprint a HTTPS client, based solely on data visible to a network eavesdropper? In other words, consider a network monitoring box that can see all the packets (but ...
15
votes
1answer
184 views

Preventing a site from appearing in the 'Most Visited' or 'speed dial' section of a web browser

Are there any established ways of preventing a website from appearing as an icon on the 'Most Visited' / 'Speed dial' / start page of a web browser? One example of this is the tab that opens by ...
-1
votes
1answer
77 views

What to do after exposure to a drive-by infection?

I clicked on a link that pretty clearly offered exposure to a drive-by infection. I won't post the link itself, but I got it from a link which is inside a reddit link (obviously the reddit website ...
2
votes
1answer
88 views

What is vulnerable in this comprehensive browser setup to avoid fingerprinting/tracking?

What is vulnerable in this browser setup to avoid fingerprinting/tracking for general browsing that is still easy to use? The setup is as follows: Firefox on my personal machine with several ...
1
vote
1answer
73 views

Browsers and SSLv3 End-of-Life

Is there a point in time at which browsers will refuse to connect to web servers that support SSLv3 in addition to TLS 1.0/1.1/1.2? Will they produce warnings? I assume the browser would be content ...
6
votes
3answers
2k views

Isn't HTTPS insecure over a hacked router? [duplicate]

I have heard that a hacker can become a proxy using the router your device is connected to and send his own public key to you instead of you getting the server's public key - which the browser will ...
3
votes
1answer
60 views

How can a modern Windows/Linux system be compromised by a heap overflow in Chrome?

Wikipedia's article on Heap Overflow states: there are primarily three ways to protect against heap overflows. Several modern operating systems such as Windows and Linux provide some ...
3
votes
2answers
156 views

Should I use websockets (ws) or secure websockets (wss) for my game?

I'm making a game and I'm using websockets for 99% of communication. The only http(s) is on initial page load and when logging in/registering. I'm a complete noob so correct me if I'm wrong, but SSL ...
5
votes
1answer
54 views

Why don't web templating frameworks HTML escape all data by default?

I recently discovered an XSS vulnerability in an application that uses JSP to render pages. The vulnerable code in the JSP was something like this: <td>${customer.notes}</td> It was ...
0
votes
2answers
96 views

Can I get malware just by navigating to a webpage? [duplicate]

Is going to a webpage a risk per se? If yes, how does work, and how can we defend ourselves from this? I have to constantly review websites and I get the links from job seekers (that is, I'd navigate ...
5
votes
3answers
59 views

When testing out security vulnerabilities on sites such as OWASP Projects, should we be in a secured/protected environment?

I was curious if there is any need to secure/protect ourselves when doing projects on sites like OWASP to learn about vulnerabilities or "Wargames/Challenges" such as what's posted in these links How ...
1
vote
1answer
124 views

Why does Chrome send four browsers in the user-agent header?

I am using Chrome in linux with Version 51.0.2704.63 (64-bit). I recorded a HTTP request of Chrome and here is part of the recording: User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (...
1
vote
2answers
90 views

Is Stegosploit a real concern with modern browsers?

http://stegosploit.info/ I looking into having users upload their images directly to AWS S3 to save on costs (rather than going through a traditional server and re-encoded with mozjpeg), but this ...
4
votes
1answer
64 views

Do Social Network Mobile Apps Track Your Browsing?

Facebook are known to track you even after you have logged out of your Facebook account. With mobile apps being given permission to access so much information on the devices, is it possible for ...
1
vote
1answer
131 views

Firefox security certificate issues: FUD or truth?

I was doing a little reading over at gHacks, and came across this comment attributed to Joey Spinosa regarding certificates in Firefox: These certificates are installed automatically by the ...
1
vote
2answers
133 views

XSS vectors in img src and background-image url

I'm a little confused about XSS vulnerabilities when serving img.src and background url. From what I understand, the only way to execute javascript in this case, is to use javascript protocol. Let's ...
0
votes
1answer
75 views

Virus Warning after clicking on a Google search results link

When researching a high school project on the guillotine, my daughter googled: quillotine quotes One of the top results was: topfamousquotes.com/quotes-about-guillotine/ Apparently she ...
5
votes
1answer
110 views

Is the native sandbox of Chrome and Firefox enough or would SELinux improve its security?

Chrome on Windows and Linux and Firefox on Windows are executed in a sandbox. On Linux, is the Chrome sandbox enough or would we gain security if we use SELinux to protect the Chrome execution? I ...
1
vote
1answer
65 views

XSS Page Cannot be Displayed

When I try XSS on various websites, such as inserting " onmouseover="alert(1) in a search box, I either get a message saying You don't have permission to access this page or This page cannot be ...
2
votes
5answers
80 views

Is it beneficial to run the browser from a different user account for personal devices?

On Linux, when launching the browser does it help security if I don't run it from my main user (not root, but still has my personal information in it) as follows: su FirefoxUserName -c 'firefox' ...
0
votes
1answer
28 views

How can I determine the common cryptographic suites I need to enable on my browser for common websites?

How do I determine the common cryptographic suites I need to enable on my browsers (I use IE11, Firefox/Nightly 49, Chrome 51) running on Windows for common websites, for eg, www.google.com, www.w3....
3
votes
1answer
151 views

Browser exploits based purely on HTML + CSS

In 2011, Eli Fox-Epstein demonstrated a Rule 110 machine in HTML + CSS3. This led some to say that the combination of HTML + CSS3 is Turing complete. Regardless of whether HTML + CSS3 is technically ...
0
votes
2answers
183 views

Firefox and chrome infected with hohosearch and newsearch123.com [duplicate]

A fortnight before, I downloaded a keygen file, which I presumed to be fine, but when I started the installation, I felt there is something weird. So I was about to start the installation, but I ...