A web browser is an application which uses http and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer, and management.

learn more… | top users | synonyms (2)

0
votes
1answer
228 views

Web site blocked by Windows defender and is marked as unsafe in IE

I posted this originally on Drupal Stack Exchange, and it was recommended that I try here for an answer. Here is the original question: Visiting my Drupal 7 site just now with IE 11, I get this ...
-4
votes
0answers
18 views

Server side script to check if browser is vulnarable to SSLv3 Poodle [migrated]

I want to implement a browser SSLv3 Poodle vulnerability test like https://zmap.io/sslv3/sslv3test.html on my web application. My idea is to put a routine in the application first page to tell to my ...
0
votes
1answer
24 views

Sharing sensitive information across servers on visits from the same browser

I have this scenario: Webserver domain A. Generates sensitive information when a request from a browser is received but this information is not disclosed to the browser. Webserver domain B. ...
4
votes
3answers
68 views

Same Origin Policy - XHR response

I know that Same Origin Policy (SOP) prevents a page/script from one origin to read response from another origin, but it does not prevents the page/script from making a XMLHttpRequest (XHR) request to ...
3
votes
1answer
46 views

Bing bar without admin rights

I know viruses uses exploits to gain admin rights to install software. My question is here at work, we have people end up with the Bing Bar installed from time to time on their machines. It is listed ...
0
votes
1answer
33 views

Isn't reading authentication data from the browser's storage malware behavior? [on hold]

I mean, is it ethical? Isn't it a possible breach of security? How safe is the authentication data stored by the browser in a windows PC? Case study: The issue is Avast antivirus on PC reads ...
1
vote
0answers
80 views

Consequences of disabling SSL2 and SSL3 on our webserver [migrated]

Our system is quite old and as a result gets an F grade for SSL from Qualsys SSL because the server supports SSL2 and SSl3. We have now identified all the browsers people are using. The oldest is ...
3
votes
4answers
109 views

Do search engines give searcher's IP address to sites that come up in search? [closed]

Ok so for example, I search "stackexchange" and a bunch of pages come up in the search result - of course most of them from this very site, and many other ones talking about stackexchange. Would this ...
2
votes
1answer
41 views

Click to play plugins vs. AdBlock?

Reading through articles like Faked Flash-based ads... I'm wondering what is a better way to keep yourself safe from malvertising. Many people suggest setting your browser's plugin settings to "Click ...
2
votes
2answers
80 views

Foolproof way to hide your IP when browsing [closed]

is there a fool proof-ish way to hide your IP from websites you visit? I heard even if you use VPN, there can be 'leaks'? And one step more secure is Anonymizer or Tor? Can they have 'leaks', too? ...
2
votes
0answers
39 views

How to get directly to text versions of Google cached pages [closed]

http://navigators.com/cached.html According to the bottom of that site, it seems the easiest way to view websites without giving them your IP is: "Edit the heck out" of google URLs like this: ...
2
votes
1answer
35 views

Does visiting cached pages disclose my IP address to site admin? [closed]

I know it discloses my IP to Google, but is my IP also disclosed to the owner of the site of which Google made cached pages that I'm looking at? And how about anything I do within the cached page - ...
16
votes
4answers
5k views

Should sensitive data ever be passed in the query string?

Should sensitive data ever be passed via the query string as opposed to the postback? I realize that the query string will be encrypted, but are there other reasons to avoid passing data in the ...
3
votes
2answers
107 views

Payment form from http is secure? [closed]

There are lot of payment gateways (Worldpay, PayPal, ..) offering easy integration, when the plain webpage using URL redirection to the payment page. HTTPS (worldpay,paypal), where the user posts his ...
3
votes
1answer
719 views

Is Google Chrome Extension access to SSL certificate validation output possible?

I want to develop an extension which will stop an user from proceeding to any banking site (configurable by user) if a proxy like paros is seating in between sending fake certificate to user. My ...
0
votes
2answers
110 views

Restrict website access

I want website (A) to only work if a visitor came by clicking a link from a specific other website (B). Initially I thought of using the document.referrer from website A to check whether website B is ...
2
votes
1answer
49 views

What are some useful tags and payloads for HTML injection on CSP-protected sites?

I'm pen-testing a website that fixed most of its XSS vulnerabilities by just adding a Content Security Policy. There are still HTML injections in several places. I've tried to get a ...
5
votes
4answers
2k views

What is a good browser for web application pen testing? [closed]

I am getting started in testing web applications, and I am having trouble verifying vulnerabilities. It seems all modern browsers have protections against things like XSS. When something like Burp ...
2
votes
1answer
62 views

Secure Flash with Click to Play Plugins in the Enterprise

In the recent light of repeating critical Flash vulnerabilities there are recomendations to use browserplugins like click-to-play to prevent unnecessary flash content to automatically load with every ...
0
votes
1answer
66 views

Clarification on a website security

I am new to work on website handling and here are my questions. 1) How can I ensure that the pages accessing is secure enough for data transmission , sql injection and several other attacks. 2) How ...
0
votes
2answers
1k views

HTTPS icon red and crossed out - Chrome browser

I just would like to ask what actually means when HTTPS icon is red / crossed - out. Is this site is vulnerable to Man in the Middle Attack? Is it safe or not?
1
vote
3answers
119 views

Benefit to disabling TLS1.1 and TLS1.2?

In light of recent developments on SSL issues such as BEAST and POODLE, I decided to configure my browser to only allow TLS1.1 and higher. The trouble is, that I am finding a lot of websites which do ...
-1
votes
1answer
64 views

What are the heuristics for a malicious url? [closed]

I know that there is nothing like a safe website ,any website which is safe today could be hacked and its visitors could be served with latest malware. What I'm curious about is what checks can we ...
1
vote
1answer
265 views

Is opportunistic encryption support optional for HTTP/2?

I'm a little unclear on the subject of opportunistic encryption of the HTTP:// address scheme in HTTP/2. According to the bug report, it looks like it's kinda optional, and an afterthought: ...
5
votes
4answers
5k views

How to avoid leaving any local trace that I went to a website?

I want to visit a web site, but I want to ensure there is no trace left on my computer that I did so. How do I do that? This question is not concerned with anonymity or detection on the network ...
0
votes
0answers
29 views

Browser not blocking popups [migrated]

I have disable showing popups for all sites in my chrome browser. But when I visit http://www.hdfcbank.com/ and click Login , it show a pop up window. Why chrome is not blocking this? Are there some ...
2
votes
2answers
142 views

Steps after getting hit with malware or browser exploits on Xubuntu

Well, today I was browsing the internet and I suddenly got redirected to a chinese hosted malware site and firefox started going crazy. I checked the url on virustotal with my phone and it found other ...
24
votes
2answers
3k views

Does browser 'view-source' mode avoid scripting attacks?

Let's say there's a URL www.badjs.com which is untrusted and may contain bad scripts. Intuitively, a view-source navigation to that URL does not execute any scripts so it should be safe. It would at ...
11
votes
2answers
663 views

Why does rfc6797 say “An HSTS Host MUST NOT include the STS header field in HTTP responses over non-secure transport.”

Why does the RFC prohibit the server from sending HSTS to the client over HTTP? I can see that if a HTTP client responds to that unsecure HTTP response it might cause that site to be inaccessible ...
5
votes
1answer
98 views

How to add certificate pinning for a certain domain to my web browser?

There is HPKP (HTTP Public Key Pinning) which servers use to tell the client's web browser which certificates to trust (in the future) for the domain that is being contacted. Google's Chrome and ...
0
votes
0answers
16 views

What is the best way to manipulate the browser fingerprint? [migrated]

The test here worries me: http://panopticlick.eff.org/ and I'd like to know if there is a good way to manipulate the browser fingerprint?
0
votes
1answer
115 views

Is there any security benefit in stripping only `<script>` tags that contain code?

On a client's corporate network something is stripping all <script> elements that contain code, i.e. things like <script type="text/javascript">do_something();</script> will simply ...
11
votes
5answers
2k views

Is using “HTTPS everywhere” extension secure?

I would like to know if one should use 'HTTPS everywhere' extension? Is it secure to use it? Are there any better alternatives? HTTPS Everywhere is a Firefox and Chrome extension that encrypts ...
1
vote
1answer
119 views

Does the browser still stores the website you visited Private Browsing [incognito Firefox]?

As they clearly state in their website they mention that What does Private Browsing not save? Visited pages: No pages will be added to the list of sites in the History menu, the Library window's ...
8
votes
3answers
343 views

Do I have to harden IE if I'm only using Firefox?

Assume a Windows 7 system (probably whatever home version comes with the machine), with the latest OS patches, latest IE and latest Firefox. Also assume that the user uses only Firefox for browsing, ...
-1
votes
1answer
52 views

Custom TLS in Browser [duplicate]

We are developing a JSF web application that has a main requirement of using our own TLS implementation (custom algorithm suites). The clients will connect via a browser. Is there any way (customising ...
14
votes
3answers
10k views

Why is 'avast! Web/Mail Shield Root' listed as CA for google.com?

I just noticed something weird in my browser: the certificate for www.google.com has been issued by avast! Web/Mail Shield Root. Should I be worried? I am using avast! Antivirus so it's probably a ...
15
votes
6answers
6k views

Preventing information disclosure from browser back button/history?

I have sensitive data that will be hosted on a website, and I would like to prevent the data from being exposed in this scenario: The primary user logs off the application, but does not close the ...
0
votes
0answers
23 views

How JavaScript malware targets browsers? [duplicate]

What are the main components that JavaScript malware targets on the browsers ? Which aspects of browsers on which JavaScript takes advantage to exploit them ? And which techniques are used by ...
1
vote
1answer
84 views

using multiple Firefox profiles to increase security

I am wondering whether it would increase security in any significant way, if I would use two separate Firefox profiles, one for normal browsing and the other for private/secure websites, such as my ...
0
votes
2answers
145 views

Source code disclosure vulnerability

I am a bit confused about the discussion here about hiding javascript source code. Let's say if I browse to a url like this: http://www.example.com/site/somejs.js and then what I see is something like ...
0
votes
1answer
45 views

Can video feed be used to track location of an IP?

I dont know if it is possible but i read that while a user is viewing video, the location of user can be traced without sharing its knowledge to the user. Even when user has disabled the option to ...
2
votes
1answer
293 views

Can someone explain, in simple terms, how the FREAK attack on browsers works?

Is there a reason it only affects browsers on Windows machines and not Mac's or UNIX/LINUX environments? A lot of the wording on this site is particularly complicated and I don't understand fully what ...
1
vote
1answer
113 views

Cross Domain Javascript security [duplicate]

I used a web vulnerability scanner to scan my web site. It indicates several links with "Cross domain Java script source file inclusion." May I know how would an attacker exploit this type of ...
4
votes
2answers
2k views

How to prevent installation of Google Chrome extensions

You can prevent the installation of Google chrome extensions on a Desktop?
1
vote
1answer
633 views

Untrusted connection visiting https://www.opensource.apple.com/

Somebody on Stackoverflow posted some code from https://www.opensource.apple.com/ When I click this link in Firefox (36.0) it says "This Connection is Untrusted". But other people on that thread on ...
1
vote
1answer
549 views

How to detect if a site is using a JavaScript exploit?

Is there a way for me (non-expert in JavaScript) to detect JavaScript attacks from a website. I have done a lot of searching around and have not come up with a definitive answer. NoScript is a pain in ...
3
votes
1answer
65 views

Does a browser have to make multiple requests to verify an SSL certificate chain?

I've learned that SSL certificates can be chained, and the browser will use the issuer's public key to verify the issuer's signature. I have read this article, which has a very helpful diagram, but it ...
2
votes
4answers
152 views

How safe is SSL on an untrusted computer and network?

In situations where the consumer doesn't trust/control the workstation and the network, can consumer safely do potentially sensitive activities (like making a payment or transferring confidential ...
34
votes
8answers
5k views

Why do browsers default to http: and not https: for typed in URLs? [duplicate]

When I type example.com without any scheme into the browser bar and press Enter it is interpreted as HTTP://example.com, not HTTPS://example.com. Why? And where are the plans to fix this? (To be ...