A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

learn more… | top users | synonyms (2)

0
votes
3answers
119 views

Can my web accesses be known by individuals?

Someone, I think it was on Charlie Rose, said that anybody who wants to can currently discover what websites have been visited by some person of interest. That assertion was possibly made as a way of ...
5
votes
5answers
33k views

Using Private Browsing mode while connected to organization's network

At the workplace I use the organization's network for accessing internet (well that's the only option). I am not sure if the network administrators monitor what I browse, how frequently I access ...
2
votes
1answer
722 views

How Browsers prevents Malware and Phishing attacks

I want to know how phishing and malware protection features are implemented in modern browsers like Chrome, Firefox, IE etc. Are these features heuristic based, or do browsers maintain a list of ...
3
votes
1answer
320 views

Secure information exchange between web applications using browser redirection

We're implementing a web application (US) that needs to exchange sensitive information with a third-party web application (THEM). The way we'd like it to work is that an end user clicks a hyperlink, ...
5
votes
2answers
11k views

How is a website determining my location even via VPN? [duplicate]

I'm currently in China, and accessing the Internet via a VPN in the USA. When I access Google maps or other location-based web services, they all show my location as that of the VPN server. However, ...
2
votes
3answers
197 views

Website URL to point users to in order to “make a point” about security [closed]

It is 'common knowledge' that unpatched, older browsers and operating systems are dangerous, but when I tell people that they should not do their online banking in IE 6 on a pirated XP service pack 0, ...
4
votes
1answer
156 views

Security consequence of Javascript hole in an online chat?

For an online chat that allows basic HTML, what happens if they leave an open way for a potential hacker to execute javascript on everyone who is in the chat? What is the worst thing they could do?
4
votes
1answer
7k views

Can your Windows or Linux username be exposed to websites?

For example: Accessing a website with javascript enabled can expose information such as browser, fonts and local time. Can it, theoretically, expose your Windows or Linux username? Will saving a ...
5
votes
3answers
25k views

Can a website still detect my real MAC address even if I use different virtual machine each time I visit the website?

Suppose I use a proxy and a different virtual machine each time I visit a particular website, will a website still be able to detect my MAC address and/or uniquely identify me? Assume that the website ...
33
votes
5answers
6k views

IMG tag vulnerability

Is it safe to display images from arbitrary domains? I.e. let's say I have an image on my page: <img src="http://badguy.com/image.gif" /> What if image.gif will return some js attack vector, ...
2
votes
2answers
231 views

Identify code being run on website

I do not normally deal with internet security problems but this one has got me interested. The issue is with a specific site, lets say example.com, and how it it visited. If the address is typed ...
3
votes
2answers
78 views

What precaustions should be taken when the file displayed by a webpage is specified by the GET value

My website shows some files based on the get value in the URL. For example http://www.mysit.com/navigate.php?d=firstpage.html The thing is navigate.php knows which folder to look in and it's not in ...
4
votes
2answers
366 views

Security of viewing a website containing Java applets offline

I've been wondering whether viewing a website offline increases the security risk. The reason why I'm asking is that having been a short time java applet developer (for a small task) I've come to ...
3
votes
2answers
2k views

How can Bank of America tell that I'm logging in on a computer I haven't used with them before?

When you sign into Bank of America for the first time on a computer that you haven't used with them before, they detect this and force you to answer one of your security questions. I think I've seen ...
4
votes
1answer
166 views

Resources/materials for implementing secure web services?

I'm implementing a REST-style (note: it needs to be more pragmatic than canonical) web API and I would like to secure it. The language I'm using is rather fresh and doesn't have a lot of high quality ...
7
votes
3answers
4k views

Any browser that supports script-nonce?

I was trying to include script-nonce on my html file, but seems like none of the current browsers support it. Is anyone aware of any version of any browser that supports this functionality? I'm ...
5
votes
4answers
8k views

Is it safe to allow users multiple login at different browsers & computers?

We are currently developing a web application. The developers have allowed multiple login. e.g an user can log-in to multiple computers at the same time. They are quoting Gmail account as an example ...
-1
votes
2answers
2k views

How web browser can shutdown computer [closed]

I would like to deverlop one web application, enduser can configure shutdown computer when task has completed, i have search via internet but i have nothing to complete that. Web browser can ...
4
votes
1answer
215 views

How can browser select suggestions for my private searches?

I use a VPN service that provides a pool of IP addresses, I clean history/cookies/etc - all the browsing data before a session. Regardless, when I type in the search of one particular search engine, ...
3
votes
5answers
1k views

If someone steals my laptop while I'm logged in, how can I protect my browser?

My question has its roots in an xkcd from this week: http://xkcd.com/1200/ Isn't this true and ironic? We place so much emphasis on browser security and OS security -- and rightly so -- yet if I ...
1
vote
1answer
623 views

Using a Web Server to steal NTLM credentials

I am trying to design an attack vector against an organization in which the pen tester (myself), steals NTLM credentials through HTTP. I am thinking of these scenarios: 1- I set up a web server on my ...
-3
votes
1answer
206 views

What keeps Facebook information safe from botnets and infected computers?

I've read a few articles which suggest that somewhere around 30-50% of PC's are infected with malware. Supposing that means that hackers then have control of those computers to do as they please (root ...
6
votes
4answers
10k views

how can you inject malicious code into an innocent-looking URL?

I am learning about XSS attacks. Wikipedia says that in a non-persistent attack an attacker may provide an innocent-looking URL that "points to a trusted site but actually has an XSS vector." What ...
14
votes
3answers
2k views

What bad coding practices makes a browser extension vulnerable?

I'm trying to scan JavaScript files for vulnerabilities using JSHint. Specifically, I'm scanning the JavaScript files of browser extensions. To look for possible vulnerabilities I'm looking for bad ...
12
votes
2answers
407 views

Why do browsers allow public websites to attack intranet sites?

When I'm visiting a website on the public internet, the website can cause my browser to send requests to a local IP address (such as 10.0.0.1). This can be used to attack internal web sites, e.g., ...
12
votes
2answers
1k views

Any tool for scanning vulnerabilities in browser extensions?

I am scanning browser extensions of Chrome and Firefox for vulnerabilities. Is there any tool which would help me do this?
3
votes
7answers
732 views

Can one reliably show HTTPS status in browser (not just the lock in the URL bar)?

I'm almost certain this isn't possible, as it would probably be too exploitable, but I wanted to ask the community just in case. Is there a way to determine and display the state of HTTPS on a page (...
8
votes
3answers
1k views

Are secret URLs secure over HTTPS?

Imagine a service that makes sensitive information available under a secret URL via HTTPS only, without requiring any other authentication. In fact, these are already widespread. What level of ...
1
vote
1answer
230 views

Canvas and Firefox

I have received this notification on Tor Browser (Firefox). What is it?
1
vote
1answer
2k views

bypass a regex filtration to perform an xss attack

Does the regex [\w/$!.*-]+$ stop the injection of payloads like : "><script>alert(4)</script> " onload="alert(4)" ...
0
votes
1answer
182 views

undetectable virtualization apps to spoof web browsers [closed]

monitoring web pages for malicious iframes (root kits) without VM is not safe. when its possible to detect virtualization just by javascript, which software provide undetectable VMs ? QEMU is safe?
1
vote
1answer
1k views

What is the “about:blank” context for browser security and privacy?

This blog is describing a way to hide the referer header in various situations. Specifically he is referring to things that run in the about:blank context. What is the about:blank context? How does ...
1
vote
1answer
988 views

Browser cache, cookies, active logins and other data

This question is regarding common browsers, even though I may refer to Firefox settings. Not IE though, I wouldn't expect that to be in any way secure. I'm seeking to know how secure it is to let the ...
2
votes
1answer
772 views

Detecting Virtualization from web browser

is that possible active adversaries who injecting malicious iframes (root kits), without Flash, Java or any other plugin detect that we using virtualization by javascript or timing differentials and ...
0
votes
1answer
404 views

some questions about DOM based XSS [closed]

Is it possible to do a DOM based xss attack with window.location.protocol? How can we use dom based xss with document.title? How can we bypass the escape javascript function if it is used? thank you
1
vote
2answers
222 views

How do browsers know which cookie to get?

I tried writing a script that would display the contents of a cookie set by another website but it didn't work. <?php echo 'Website cookie is '.$_COOKIE['locale']; ?> But I get an undefined ...
1
vote
1answer
121 views

Java applet authenticity problem

I implemented an applet in java to authenticate users at my website by the usage of MIFARE cards and everything is working good. However I am concerned about the applet's authenticity, in other words, ...
4
votes
1answer
627 views

generating RSA keys through the browser

HTML5 has the element that sends an SPKAC to the server (as I understand it). But how do you do it in IE? One CA's websites gives me the following prompt: This Web site is attempting to perform a ...
5
votes
1answer
16k views

How does DHE-RSA-AES256-SHA compare to RC4 as the Cipher for SSL?

I read a lot of issue [1] currently stating that RC4 is broken and is at risk. I just checked my web server (nginx) and it is using the default settings, which is DHE-RSA-AES256-SHA How does this ...
4
votes
3answers
2k views

JInitiator is obsolete and I should reject it on grounds of security, right?

I'm getting a lot of flack and resistance from developers for not allowing a large (200+ users) roll-out of Oracle's JInitiator (http://www.oracle.com/technetwork/testcontent/jinit-084453.html) as ...
8
votes
1answer
889 views

Device fingerprinting & Mass Computer Surveillance

Device fingerprinting is one of the biggest privacy problems as explained because people think cleaning cookies, using proxy servers or blocking domains can protect them (when blacklisted trackers ...
2
votes
5answers
7k views

Does the padlock on my browser really indicate a reasonable assurance against eavesdropping?

I know that there have been broken or weak SSL implementations. Do browsers actually have decent standards for what they'll accept and display "the padlock"? Furthermore, are there any practical ...
9
votes
2answers
626 views

RC4 bias protection with padding in TLS

On the answer to my previous question about RC4 vulnerabilities in TLS, Thomas Pornin gave a great answer, in which he said: One way to "fix" RC4, which has been suggested many times, is to drop ...
0
votes
2answers
353 views

Where are the private keys stored in Persona/Browser ID?

I'm trying to understand where the private keys are stored in the Persona system, and how they are protected. Can anyone elaborate on where the crypto material is created, stored, and what is ...
12
votes
2answers
638 views

What should I look for when auditing a Firefox extension / plugin?

I've been asked to do a security audit on a Firefox add-on developed by a third party. I am a web developer with a reasonable grasp of JavaScript but am not a browser security expert. What kinds of ...
7
votes
2answers
9k views

DOM Based XSS attacks: what is the most dangerous example?

I knew that XSS attacks (“non-persistent” and “persistent”) can hijack user session, deface websites, conduct phishing attack, etc. However, I can't understand what is dangerous of DOM Based XSS if ...
2
votes
1answer
131 views

Return AWS signature over HTTP

I am performing multipart upload to S3 straight from the browser, i.e. bypassing my back-end. My JS code sends a hand-shake request to S3 (a POST), then uploads the file in chunks of 5MB (a PUT for ...
6
votes
3answers
2k views

Is there any way I can block (or conditionally approve of) iFrames on the client side?

Given that iFrames are used in many common exploits, I'd like to conditionally disable iFrames except for sites that require it such as GMail, or MasterCard SecureCode. I also suspect the <object&...
3
votes
4answers
1k views

FireFox's restore previous session restores logins authenticated by server's sessions

In a website I'm building when I login, close FireFox, open FireFox and try to go to the website again I must login again (as expected) BUT if I select "Restore Previous Session" I am logged in again. ...
7
votes
2answers
516 views

How to keep using Java 6 securely, despite its unpatch vulnerabilities

Given that Java 6 is now deprecated by Oracle and there recently has been notification of a 0day (that will exist forever now that Oracle is not patching JRE6), what can we do to prevent drive-by ...