A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

learn more… | top users | synonyms (2)

4
votes
1answer
634 views

generating RSA keys through the browser

HTML5 has the element that sends an SPKAC to the server (as I understand it). But how do you do it in IE? One CA's websites gives me the following prompt: This Web site is attempting to perform a ...
7
votes
2answers
261 views

What security measures does Chrome have in place to sandbox different user accounts?

Google Chrome has a feature that allows different users to use Chrome on the same computer in a completely separate space. The support page is quite light on information. Is there information ...
1
vote
1answer
442 views

When a browser extension or user script pulls a JS file from Google's CDN, how does this compromise the user's privacy in terms of Google's reach? [duplicate]

The context from which my question has arisen is this user script which locally removes ads from Ixquick.com, which is an anonymizing 'proxy' search engine that gives the results from Google's index ...
-2
votes
2answers
236 views

What Digital Fingerprints Does a Browser Leave Behind?

I've been drilling down in granularity for this question: Besides IP addresses, how else could one be identified? and I'd like to focus upon the internet browser. What are the digital tracks an ...
11
votes
11answers
8k views

Besides IP addresses, how else could one be identified? [closed]

OP: I'm curious how else an actor seeking to identify someone online could accomplish this task besides just using an IP address. What methods would they employ? What knowledge must they have of the ...
-1
votes
1answer
307 views

How Facebook Determines User Browser Change? [duplicate]

I recently logged in to my Facebook from other PC and got notice. Please login from the PC you previously logged in. I want to know what information Facebook uses to determine this change? I changed ...
8
votes
1answer
2k views

What are the benefits and drawbacks of the HTML5 Keygen element?

As of January 2013, what are the potential benefits and drawbacks of the HTML5 Keygen element?
14
votes
2answers
1k views

Can a Firefox add-on or plug-in access the user's websites' saved passwords in decrypted mode?

Going deeper into the previous question on Firefox plugins and add-ons malware risks: Could a Firefox add-on potentially decode and capture the encrypted websites' passwords saved in the browser?
12
votes
2answers
643 views

What should I look for when auditing a Firefox extension / plugin?

I've been asked to do a security audit on a Firefox add-on developed by a third party. I am a web developer with a reasonable grasp of JavaScript but am not a browser security expert. What kinds of ...
12
votes
2answers
1k views

Any tool for scanning vulnerabilities in browser extensions?

I am scanning browser extensions of Chrome and Firefox for vulnerabilities. Is there any tool which would help me do this?
14
votes
3answers
2k views

What bad coding practices makes a browser extension vulnerable?

I'm trying to scan JavaScript files for vulnerabilities using JSHint. Specifically, I'm scanning the JavaScript files of browser extensions. To look for possible vulnerabilities I'm looking for bad ...
7
votes
1answer
574 views

How do I check the code of a Chrome extension to make sure it's not stealing my info?

I've been reading more and more about just how much access browser extensions can have to your data. This is a little unsettling, so I'm curious if there is a way to Vet these extensions and make sure ...
0
votes
1answer
579 views

How securely use Firefox Add-on to prevent steal data?

Some videos on YouTube demonstrate how a Firefox extension can collect login information used to login to websites such as Facebook. After installing this tool/malware as Firefox Add-on, I observed ...
1
vote
2answers
1k views

Are Google Chrome Extensions vulnerable?

I've just discovered this: You can create IFRAME pointing to "chrome-extension://" protocol You can access IFRAME content with jQuery Does this mean, I'm able to use badly written Chrome ...
24
votes
9answers
9k views

Is encryption in HTTPS done by the browser or by the system?

This may be a common sense question, but I am not able to find any documentation on this after searching on google for a long time When browser makes a HTTPs request, does it encrypt the data then ...
6
votes
3answers
1k views

In what way is a partially encrypted webpage insecure?

What are the potential vulnerabilities that might arise if a webpage is only partially encrypted. I can think of 2 possibilities: You can change the non-encrypted parts of the page (HTML, CSS, ...
1
vote
1answer
2k views

Possible to limit server connections to clients with a specific certificate?

Usually when I read about SSL and HTTP it says that the certificate is set up to authenticate that the host is who it says it is. Is it possible to configure the host to prevent it from processing ...
7
votes
3answers
5k views

SQL Injection How to inject Clean/Rest URLS

I have a question I'm hoping you could help me with? Unclean url's: http://example.com/index.php?page=foo http://example.com/products?category=2&pid=25 http://example.com/index.php?mod=profiles&...
3
votes
1answer
283 views

What servers or clients are immune to related-domain cookie attacks? (*.example.com)

In this question, I want to identify browsers, servers, or implementations that are immune from related domain cookie attacks (e.g. a.example.com vs b.example.com). Lacking any tangible solution, ...
4
votes
1answer
7k views

Can your Windows or Linux username be exposed to websites?

For example: Accessing a website with javascript enabled can expose information such as browser, fonts and local time. Can it, theoretically, expose your Windows or Linux username? Will saving a ...
2
votes
1answer
728 views

How Browsers prevents Malware and Phishing attacks

I want to know how phishing and malware protection features are implemented in modern browsers like Chrome, Firefox, IE etc. Are these features heuristic based, or do browsers maintain a list of ...
0
votes
3answers
119 views

Can my web accesses be known by individuals?

Someone, I think it was on Charlie Rose, said that anybody who wants to can currently discover what websites have been visited by some person of interest. That assertion was possibly made as a way of ...
3
votes
2answers
998 views

Where do I get started in terms of learning how to exploit Java and Flash vulnerabilities? or browser exploitation in general

Another Java 0day was discovered today which got me thinking how browser exploitation (remote execution on clients browser) works. I am unable to find any books or resources online about browser ...
3
votes
1answer
324 views

Secure information exchange between web applications using browser redirection

We're implementing a web application (US) that needs to exchange sensitive information with a third-party web application (THEM). The way we'd like it to work is that an end user clicks a hyperlink, ...
2
votes
2answers
234 views

Identify code being run on website

I do not normally deal with internet security problems but this one has got me interested. The issue is with a specific site, lets say example.com, and how it it visited. If the address is typed ...
2
votes
3answers
198 views

Website URL to point users to in order to “make a point” about security [closed]

It is 'common knowledge' that unpatched, older browsers and operating systems are dangerous, but when I tell people that they should not do their online banking in IE 6 on a pirated XP service pack 0, ...
4
votes
1answer
156 views

Security consequence of Javascript hole in an online chat?

For an online chat that allows basic HTML, what happens if they leave an open way for a potential hacker to execute javascript on everyone who is in the chat? What is the worst thing they could do?
12
votes
2answers
478 views

How do you visit a link without risking your computer?

I got a link from: http //61.19.247./~naowit/dustin.html (removed the last digits so you don't accidentally click it! (they were 192)), which was masked as a youtube.com link via email. Now I'm not ...
5
votes
1answer
235 views

Is this a security flaw in Firefox 18.0?

I had a couple of .mht files which opened in IE, a browser I never use. I renamed their extension to .HTML to run it in Firefox. When I opened the file in Firefox, Firefox created new tabs endlessly. ...
4
votes
1answer
499 views

How did my homepage get changed in IE?

I have rarely used IE in the past. I just use it to test how a website looks. Today all of a sudden when I went on to open IE, it opened with a homepage that wasn't set by me. It was an address of a ...
8
votes
2answers
2k views

Will disabling the Java add-on in IE protect you from Java exploits?

Concerning the recent Java vulnerability (Should I be disabling Java?), the most common advise seems to be to disable Java plug-ins in the browser. However, Heise Security suggests that, when it ...
4
votes
2answers
369 views

Security of viewing a website containing Java applets offline

I've been wondering whether viewing a website offline increases the security risk. The reason why I'm asking is that having been a short time java applet developer (for a small task) I've come to ...
3
votes
2answers
78 views

What precaustions should be taken when the file displayed by a webpage is specified by the GET value

My website shows some files based on the get value in the URL. For example http://www.mysit.com/navigate.php?d=firstpage.html The thing is navigate.php knows which folder to look in and it's not in ...
4
votes
2answers
3k views

Does Java applets reveal the real IP address, even when using proxy or vpn?

Can a Java applet reveal the original client IP address, when browsing through a proxy or a VPN? Why?
4
votes
1answer
166 views

Resources/materials for implementing secure web services?

I'm implementing a REST-style (note: it needs to be more pragmatic than canonical) web API and I would like to secure it. The language I'm using is rather fresh and doesn't have a lot of high quality ...
3
votes
1answer
590 views

Apple Developer Account Hacked?

I just did a fresh install of Snow Leopard on a newly-formatted hard drive. Logged into the iPhone Developer Page with Google Chrome (latest build) here: http://developer.apple.com/iphone/index....
5
votes
4answers
8k views

Is it safe to allow users multiple login at different browsers & computers?

We are currently developing a web application. The developers have allowed multiple login. e.g an user can log-in to multiple computers at the same time. They are quoting Gmail account as an example ...
-1
votes
2answers
2k views

How web browser can shutdown computer [closed]

I would like to deverlop one web application, enduser can configure shutdown computer when task has completed, i have search via internet but i have nothing to complete that. Web browser can ...
4
votes
1answer
217 views

How can browser select suggestions for my private searches?

I use a VPN service that provides a pool of IP addresses, I clean history/cookies/etc - all the browsing data before a session. Regardless, when I type in the search of one particular search engine, ...
1
vote
1answer
635 views

Using a Web Server to steal NTLM credentials

I am trying to design an attack vector against an organization in which the pen tester (myself), steals NTLM credentials through HTTP. I am thinking of these scenarios: 1- I set up a web server on my ...
-3
votes
1answer
209 views

What keeps Facebook information safe from botnets and infected computers?

I've read a few articles which suggest that somewhere around 30-50% of PC's are infected with malware. Supposing that means that hackers then have control of those computers to do as they please (root ...
12
votes
2answers
408 views

Why do browsers allow public websites to attack intranet sites?

When I'm visiting a website on the public internet, the website can cause my browser to send requests to a local IP address (such as 10.0.0.1). This can be used to attack internal web sites, e.g., ...
8
votes
3answers
1k views

Are secret URLs secure over HTTPS?

Imagine a service that makes sensitive information available under a secret URL via HTTPS only, without requiring any other authentication. In fact, these are already widespread. What level of ...
12
votes
7answers
1k views

How to browse the Internet safely?

What is the best way to browse the Internet safely? By safely I mean: anonymously having encrypted communication Extra bonus for: being able to do it with little or no performance impact cheaply ...
1
vote
1answer
230 views

Canvas and Firefox

I have received this notification on Tor Browser (Firefox). What is it?
1
vote
1answer
1k views

What is the “about:blank” context for browser security and privacy?

This blog is describing a way to hide the referer header in various situations. Specifically he is referring to things that run in the about:blank context. What is the about:blank context? How does ...
1
vote
1answer
2k views

bypass a regex filtration to perform an xss attack

Does the regex [\w/$!.*-]+$ stop the injection of payloads like : "><script>alert(4)</script> " onload="alert(4)" ...
0
votes
1answer
186 views

undetectable virtualization apps to spoof web browsers [closed]

monitoring web pages for malicious iframes (root kits) without VM is not safe. when its possible to detect virtualization just by javascript, which software provide undetectable VMs ? QEMU is safe?
5
votes
4answers
15k views

Security issues using iframes

We are looking to move to iframes due to technical challenges. By moving to iframes it will be easier to manage the technical issues. But we are not totally sure of security implications of iframes. ...
0
votes
1answer
410 views

some questions about DOM based XSS [closed]

Is it possible to do a DOM based xss attack with window.location.protocol? How can we use dom based xss with document.title? How can we bypass the escape javascript function if it is used? thank you