A web browser is an application which uses http and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer, and management.
0
votes
3answers
71 views
Can my web accesses be known by individuals?
Someone, I think it was on Charlie Rose, said that anybody who wants to can currently discover what websites have been visited by some person of interest. That assertion was possibly made as a way of ...
2
votes
5answers
137 views
Using Private Browsing mode while connected to organization's network
At the workplace I use the organization's network for accessing internet (well that's the only option).
I am not sure if the network administrators monitor what I browse, how frequently I access ...
2
votes
1answer
89 views
How Browsers prevents Malware and Phishing attacks
I want to know how phishing and malware protection features are implemented in modern browsers like Chrome, Firefox, IE etc. Are these features heuristic based, or do browsers maintain a list of ...
-7
votes
0answers
61 views
Want to check deleted browser history? [closed]
I want to check the deleted browser history through command prompt ?
I've checked the command "ipconfig" still not satisfied, i need proper detail of the browser history.
3
votes
1answer
71 views
Secure information exchange between web applications using browser redirection
We're implementing a web application (US) that needs to exchange sensitive information with a third-party web application (THEM). The way we'd like it to work is that an end user clicks a hyperlink, ...
3
votes
2answers
191 views
How is a website determining my location even via VPN? [duplicate]
I'm currently in China, and accessing the Internet via a VPN in the USA. When I access Google maps or other location-based web services, they all show my location as that of the VPN server. However, ...
1
vote
3answers
134 views
Website URL to point users to in order to “make a point” about security [closed]
It is 'common knowledge' that unpatched, older browsers and operating systems are dangerous, but when I tell people that they should not do their online banking in IE 6 on a pirated XP service pack 0, ...
4
votes
1answer
65 views
Security consequence of Javascript hole in an online chat?
For an online chat that allows basic HTML, what happens if they leave an open way for a potential hacker to execute javascript on everyone who is in the chat?
What is the worst thing they could do?
2
votes
1answer
145 views
Can your Windows or Linux username be exposed to websites?
For example:
Accessing a website with javascript enabled can expose information such as browser, fonts and local time. Can it, theoretically, expose your Windows or Linux username?
Will saving a ...
1
vote
3answers
255 views
Can a website still detect my real MAC address even if I use different virtual machine each time I visit the website?
Suppose I use a proxy and a different virtual machine each time I visit a particular website, will a website still be able to detect my MAC address and/or uniquely identify me?
Assume that the website ...
16
votes
4answers
901 views
IMG tag vulnerability
Is it safe to display images from arbitrary domains? I.e. let's say I have an image on my page:
<img src="http://badguy.com/image.gif" />
What if image.gif will return some js attack vector, ...
2
votes
2answers
131 views
Identify code being run on website
I do not normally deal with internet security problems but this one has got me interested.
The issue is with a specific site, lets say example.com, and how it it visited.
If the address is typed ...
3
votes
2answers
67 views
What precaustions should be taken when the file displayed by a webpage is specified by the GET value
My website shows some files based on the get value in the URL. For example http://www.mysit.com/navigate.php?d=firstpage.html The thing is navigate.php knows which folder to look in and it's not in ...
2
votes
2answers
93 views
Security of viewing a website containing Java applets offline
I've been wondering whether viewing a website offline increases the security risk.
The reason why I'm asking is that having been a short time java applet developer (for a small task) I've come to ...
3
votes
1answer
170 views
How can Bank of America tell that I'm logging in on a computer I haven't used with them before?
When you sign into Bank of America for the first time on a computer that you haven't used with them before, they detect this and force you to answer one of your security questions. I think I've seen ...
4
votes
1answer
111 views
Resources/materials for implementing secure web services?
I'm implementing a REST-style (note: it needs to be more pragmatic than canonical) web API and I would like to secure it. The language I'm using is rather fresh and doesn't have a lot of high quality ...
3
votes
2answers
224 views
Any browser that supports script-nonce?
I was trying to include script-nonce on my html file, but seems like none of the current browsers support it.
Is anyone aware of any version of any browser that supports this functionality?
I'm ...
2
votes
4answers
309 views
Is it safe to allow users multiple login at different browsers & computers?
We are currently developing a web application. The developers have allowed multiple login. e.g an user can log-in to multiple computers at the same time. They are quoting Gmail account as an example ...
-1
votes
2answers
157 views
How web browser can shutdown computer [closed]
I would like to deverlop one web application, enduser can configure shutdown computer when task has completed, i have search via internet but i have nothing to complete that.
Web browser can ...
4
votes
1answer
123 views
How can browser select suggestions for my private searches?
I use a VPN service that provides a pool of IP addresses, I clean history/cookies/etc - all the browsing data before a session.
Regardless, when I type in the search of one particular search engine, ...
2
votes
4answers
319 views
If someone steals my laptop while I'm logged in, how can I protect my browser?
My question has its roots in an xkcd from this week:
http://xkcd.com/1200/
Isn't this true and ironic? We place so much emphasis on browser security and OS security -- and rightly so -- yet if I ...
1
vote
1answer
157 views
Using a Web Server to steal NTLM credentials
I am trying to design an attack vector against an organization in which the pen tester (myself), steals NTLM credentials through HTTP. I am thinking of these scenarios:
1- I set up a web server on my ...
5
votes
1answer
83 views
Signing a browser extension
I want to make a browser extension available to users. Can I sign my extension so that users can verify it is authentic, without needing to trust the web site where they got the extension from nor ...
-3
votes
1answer
111 views
What keeps Facebook information safe from botnets and infected computers?
I've read a few articles which suggest that somewhere around 30-50% of PC's are infected with malware. Supposing that means that hackers then have control of those computers to do as they please (root ...
3
votes
4answers
303 views
how can you inject malicious code into an innocent-looking URL?
I am learning about XSS attacks. Wikipedia says that in a non-persistent attack an attacker may provide an innocent-looking URL that "points to a trusted site but actually has an XSS vector." What ...
10
votes
3answers
367 views
What bad coding practices makes a browser extension vulnerable?
I'm trying to scan JavaScript files for vulnerabilities using JSHint. Specifically, I'm scanning the JavaScript files of browser extensions. To look for possible vulnerabilities I'm looking for bad ...
11
votes
2answers
191 views
Why do browsers allow public websites to attack intranet sites?
When I'm visiting a website on the public internet, the website can cause my browser to send requests to a local IP address (such as 10.0.0.1). This can be used to attack internal web sites, e.g., ...
8
votes
2answers
151 views
Any tool for scanning vulnerabilities in browser extensions?
I am scanning browser extensions of Chrome and Firefox for vulnerabilities. Is there any tool which would help me do this?
2
votes
6answers
229 views
Can one reliably show HTTPS status in browser (not just the lock in the URL bar)?
I'm almost certain this isn't possible, as it would probably be too exploitable, but I wanted to ask the community just in case.
Is there a way to determine and display the state of HTTPS on a page ...
4
votes
3answers
230 views
Are secret URLs secure over HTTPS?
Imagine a service that makes sensitive information available under a secret URL via HTTPS only, without requiring any other authentication. In fact, these are already widespread.
What level of ...
1
vote
1answer
67 views
1
vote
1answer
259 views
bypass a regex filtration to perform an xss attack
Does the regex [\w/$!.*-]+$ stop the injection of payloads like :
"><script>alert(4)</script>
" onload="alert(4)"
...
0
votes
1answer
66 views
undetectable virtualization apps to spoof web browsers [closed]
monitoring web pages for malicious iframes (root kits) without VM is not safe. when its possible to detect virtualization just by javascript, which software provide undetectable VMs ? QEMU is safe?
1
vote
1answer
151 views
What is the “about:blank” context for browser security and privacy?
This blog is describing a way to hide the referer header in various situations. Specifically he is referring to things that run in the about:blank context.
What is the about:blank context?
How does ...
1
vote
1answer
106 views
Browser cache, cookies, active logins and other data
This question is regarding common browsers, even though I may refer to Firefox settings. Not IE though, I wouldn't expect that to be in any way secure.
I'm seeking to know how secure it is to let the ...
2
votes
1answer
96 views
Detecting Virtualization from web browser
is that possible active adversaries who injecting malicious iframes (root kits), without Flash, Java or any other plugin detect that we using virtualization by javascript or timing differentials and ...
1
vote
2answers
98 views
How do browsers know which cookie to get?
I tried writing a script that would display the contents of a cookie set by another website but it didn't work.
<?php
echo 'Website cookie is '.$_COOKIE['locale'];
?>
But I get an undefined ...
1
vote
1answer
56 views
Java applet authenticity problem
I implemented an applet in java to authenticate users at my website by the usage of MIFARE cards and everything is working good. However I am concerned about the applet's authenticity, in other words, ...
1
vote
1answer
81 views
generating RSA keys through the browser
HTML5 has the element that sends an SPKAC to the server (as I understand it).
But how do you do it in IE?
One CA's websites gives me the following prompt:
This Web site is attempting to perform a ...
3
votes
1answer
720 views
How does DHE-RSA-AES256-SHA compare to RC4 as the Cipher for SSL?
I read a lot of issue [1] currently stating that RC4 is broken and is at risk.
I just checked my web server (nginx) and it is using the default settings, which is
DHE-RSA-AES256-SHA
How does this ...
4
votes
2answers
167 views
JInitiator is obsolete and I should reject it on grounds of security, right?
I'm getting a lot of flack and resistance from developers for not allowing a large (200+ users) roll-out of Oracle's JInitiator (http://www.oracle.com/technetwork/testcontent/jinit-084453.html) as ...
7
votes
1answer
251 views
Device fingerprinting & Mass Computer Surveillance
Device fingerprinting is one of the biggest privacy problems as explained because people think cleaning cookies, using proxy servers or blocking domains can protect them (when blacklisted trackers ...
3
votes
5answers
313 views
Does the padlock on my browser really indicate a reasonable assurance against eavesdropping?
I know that there have been broken or weak SSL implementations. Do browsers actually have decent standards for what they'll accept and display "the padlock"?
Furthermore, are there any practical ...
5
votes
2answers
192 views
RC4 bias protection with padding in TLS
On the answer to my previous question about RC4 vulnerabilities in TLS, Thomas Pornin gave a great answer, in which he said:
One way to "fix" RC4, which has been suggested many times, is to drop ...
1
vote
2answers
65 views
Where are the private keys stored in Persona/Browser ID?
I'm trying to understand where the private keys are stored in the Persona system, and how they are protected.
Can anyone elaborate on where the crypto material is created, stored, and what is ...
10
votes
2answers
209 views
What should I look for when auditing a Browser extension / plugin?
I've been asked to do a security audit on a cross-browser plugin for desktop browsers developed by a third party. I am a web developer with a reasonable grasp of Javascript but am not a browser ...
3
votes
1answer
1k views
DOM Based XSS attacks: what is the most dangerous example?
I knew that XSS attacks (“non-persistent” and “persistent”) can hijack user session, deface websites, conduct phishing attack, etc.
However, I can't understand what is dangerous of DOM Based XSS if ...
2
votes
1answer
71 views
Return AWS signature over HTTP
I am performing multipart upload to S3 straight from the browser, i.e. bypassing my back-end.
My JS code sends a hand-shake request to S3 (a POST), then uploads the file in chunks of 5MB (a PUT for ...
4
votes
3answers
182 views
Is there any way I can block (or conditionally approve of) iFrames on the client side?
Given that iFrames are used in many common exploits, I'd like to conditionally disable iFrames except for sites that require it such as GMail, or MasterCard SecureCode.
I also suspect the ...
3
votes
4answers
235 views
FireFox's restore previous session restores logins authenticated by server's sessions
In a website I'm building when I login, close FireFox, open FireFox and try to go to the website again I must login again (as expected) BUT if I select "Restore Previous Session" I am logged in again. ...
