A web browser is an application which uses http and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer, and management.

learn more… | top users | synonyms (2)

1
vote
3answers
98 views

Are Modern Servers susceptible to HTTP Splitting Attacks

Note: I know how HTTP Splitting works. Note 2: I am not working in WebGoat. I am trying to make this on my own. I am trying to imitate the HTTP Splitting attack on my machine. For that I wrote this ...
3
votes
2answers
199 views

Pop-ups in Private Browsing?

The new Firefox private browsing mode allows for both non/private browsing windows at the same time. So if a website pops up a new window (which will be in non private mode) can it read stored data? ...
2
votes
2answers
231 views

When using private browsing can a website view data stored before private browsing was turned on?

If a browser has been used to visit a few sites and has active logins and then the user turns on private browsing, can the sites still access data such as cookies and cached files that were created ...
1
vote
0answers
77 views

Suggestions on how to capture network connections/traffic for determining browser/SSL versions?

I've started thinking about how to approach analyzing my network traffic for information relating to SSL and browser usage for my web server farm. I also suspect there are some shadow (legacy, ...
1
vote
1answer
81 views

Do any tracking networks or ad networks not use JavaScript and only track based on IP address? If yes, how can they be prevented?

Are there any websites that collectively track one computer based on its IP address alone? Browser extensions such as Ad block plus, Do Not Track Plus and Ghostery modify the client side script but is ...
3
votes
1answer
241 views

Can a site I browse in private browsing mode tell if I visited it in regular mode before?

I've noticed when updating a blog, that sometimes refreshing the page won't actually fetch it again, because it is still in the cache. Now, even when I open it in incognito in that same browser(say ...
-1
votes
1answer
95 views

Would PGP/GPG have been a better choice than SSL for browsers and http servers to encrypt traffic? [closed]

I was curious recently when I heard that SSL had supposedly been broken by a certain rogue government agency, why SSL was chosen in the first place. Could it be that PGP would have been a more secure ...
9
votes
2answers
230 views

Why do some certificates specifically identify a corporation and most don't?

Looking at a handful of websites that allow for/require HTTPS, I realized that the certificate for a few of them specifically identifies the owning corporation, but some (most) don't. What's the ...
0
votes
2answers
89 views

Is there any any security threat due to advertisements?

I was working on my localhost in my computer but I was connected to internet. Recently I downloaded a few music files and since then advertisements are getting popping into my browser through which I ...
6
votes
1answer
340 views

Browsers silently adding trusted root certificates in Windows

When accessing https://internetbanking.caixa.gov.br (site of a well known bank in Brazil), the server returns a certificate signed by "Autoridade Certificadora Raiz Brasileira" (Brazilian Root ...
14
votes
1answer
2k views

Site preventing user from closing tab/closing browser

I've come across the following website hxxp://politie.nl.id169787298-7128265115.e2418.com/ [Possible malware] Whenever I open it in Firefox it prevents me from closing it, I can't even close the ...
0
votes
1answer
539 views

Sending Client Certificate to Server

I have a simple question. Is a web browser sends client certificate to the web server on demand(means web server is configured for client authentication and demand the client certificate) or just ...
2
votes
1answer
116 views

I don't quite understand the principle of “use after free” and CVE-2010-1119

I am a rookie hacker studying android vulnerabilities. My partner and I are studying "CVE-2010-1119". Unfortunately there does not appear to be enough information online. Could anyone please help me ...
2
votes
1answer
1k views

Is it safe to give an Oauth token to client side javascript so it can directly make requests to a server?

I currently have a simple backbone.js application served from my domain (example.com), which is provided an Oauth token. Specifically, I pass the Oauth token through my page template into the ...
2
votes
1answer
85 views

Does Internet Explorer handle Extended Validation properly

I'm reading about Extended Validation (EV) certificates and have a few questions. From what I understand, EV allows domain owners to pay extra for a especially trusted certificate (that the browser ...
0
votes
2answers
147 views

Can Tor browser bundle be attacked like this?

When using the Tor browser bundle, you load the check.torproject.org on start. It tells you when there is a security update to downloads, and let's you click a link to get it. The way for users to ...
0
votes
1answer
92 views

How to investigate this anomaly?

According to the IT managers, this problem is neither at the server nor at the client but is suspected to be somewhere inbetween e.g. some DNS server that has been infected. Do you recognize this ...
0
votes
1answer
583 views

How do Java applet exploits work? [closed]

Browsers store web pages in a local cache on the client's machine. How does a hostile Java applet exploit this information to gain more privileges than it is entitled to? My understanding is that a ...
1
vote
2answers
126 views

How to restrict access to unwanted sites?

I use Ubuntu 13.10. I tried to used OpenDNS to restrict some websites. Unfortunately, I couldn't do that. I use AirStream 1200 USB modem to access WiMax internet. OpenDNS setting didn't work for me at ...
1
vote
1answer
154 views

How to check whether a link is safe or not? [closed]

I've been working on a task to find threats in a social network called Skyrock. For which, I've managed to retrieve a significant amount of URLs by crawling various user profiles and parsing the data ...
15
votes
5answers
1k views

Security of an initial redirection from http://example.com to https://example.com

Suppose that http://example.com/<foo> systematically redirects to https://example.com/<foo>. I enter http://example.com in my browser's URL bar, and I see a page load and the URL bar now ...
3
votes
1answer
102 views

What's malicious about file links?

Why did Chrome and Firefox disallow file:/// links? I can imagine an iframe opening a local resource, but which resource is the scary one? They could have just disabled iframes to file:///? Ajax ...
0
votes
0answers
21 views

Error 150 (net::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN): The server's certificate appears to be a forgery [duplicate]

Can you tell me shortly how to fix this problem in Chrome? Error 150 (net::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN): The server's certificate appears to be a forgery
1
vote
1answer
1k views

Efficacy of Chrome incognito mode

I am curious about the true efficacy of the browser private mode. I did a bit of googling and stumbled upon the following page. ...
1
vote
1answer
119 views

Export ciphers prevalance

I would like to clarify the consequences of not supporting export ciphers. When I run a qualys ssl test on ebay.com, I notice that the following cipher suites are supported. ...
0
votes
2answers
151 views

Can you trust the URL shown when 'hovering' on a link? [duplicate]

When using a modern web browser, if you hover on a link, the browser will show you the link in a little display on the bottom left corner of the browser screen. Can I trust this? Can this display be ...
2
votes
3answers
161 views

Do on-demand SSL certificates exist?

A few days ago, I visited an SSL protected website. Since Safari complained about the SSL-certificate, I did a short inspection: The certificate was issued by GoDaddy in just the minute I ...
2
votes
1answer
297 views

Different SSL states as seen by Safari, Chrome and Firefox

Today, I visited some sites of the German DHL group. While Chrome and Safari complain about an invalid certificate of Firefox accepts it. Which one is right, which one is wrong? Which decision ...
78
votes
8answers
5k views

Do we need to logout of webapps?

A quick Google search doesn't reveal whether it is important to logout of webapps (online banking, Amazon, Facebook, etc.), or if I am safe just closing the tab or browser. I am sure I heard on some ...
0
votes
1answer
194 views

Does google use browser fingerprinting? [closed]

I'm wondering whether besides collecting the typical tracking information (IP + cookies) google has already implemented browser fingerprinting? I read sometime not long ago about it being a ...
0
votes
1answer
77 views

Browser Extension to show how your session is being shared

A while back I came across a browser extension (was available for Firefox and Chrome, maybe others) that showed you through a graphical 'node' interface how your browser session was shared with so ...
0
votes
1answer
367 views

Google Chrome - save usernames NOT passwords [closed]

I've scoured the settings page and googled this to no avail. I want Chrome to stop saving my passwords BUT keep saving usernames/email. Is that possible? All I seem to be able to do is disable ...
-1
votes
1answer
121 views

Reflected XSS Prevention plugin [closed]

Is there any plugin out there which prevent reflected XSS? Plugin could be either for firefox or chrome. Thanks.
0
votes
3answers
523 views

On a public wifi I just tried to access google over HTTPS and was forced on to HTTP, how?

I'm on a coffee shop wifi. I just typed https://google.com in to my browser and noticed that I got redirected to http://google.com. I tried other google domains (google.ie) and these work fine, so ...
1
vote
1answer
224 views

Force browser to use higher security connection

How can I force my Chrome broswer (or even Firefox) to always use a higher security encryption?, for example 256bit (or more) encryption when using https. I guess it should be some flag to force the ...
0
votes
2answers
289 views

Is it illegal to use Fake User-agents? [closed]

Is it illegal to impersonate user-agents when you are crawling a website? If so, what and how a legal action can be taken against the faking requester? Is this law applies only for crawlers or a user ...
13
votes
4answers
700 views

Entering passwords at public computers

Sometimes it happens that I have to access my email or some other web service from public machines. Are there any options to make it secure or at least reduce risks to acceptable levels? I am most ...
1
vote
2answers
204 views

How long should a browser session last?

I have two online accounts from different banks, one bank expires my session faster than the other, it's quite annoying. I was wondering how long (or short) should a session be for it to be ...
7
votes
1answer
185 views

Are there any reasons why browsers should block mixed passive content by default?

Most browsers block "active" content that's being loaded over HTTP on HTTPS pages. This includes stuff like javascript which can be modified with an MITM and compromise the security of the entire ...
2
votes
1answer
75 views

Does it have sense to fuzz a ASCII file format with mutators that mess with Unicode or String Case?

I'm trying to fuzz an ASCII file format. Specifically, I'm defining some HTML5/HTML structures to be used as definition file for a smart fuzzer to fuzz web browsers. This smart fuzzer allows to ...
1
vote
2answers
85 views

Securely render SVG

How can I securely render SVG documents in a media sharing application? I think the same-origin policy might help a bit if I host the SVG documents on a separate domain and render them inside an ...
2
votes
1answer
80 views

Windows: Any method to enforce user confirmation before the browser opens a URL requested by an external desktop app?

A robust outgoing firewall will protect against desktop applications directly connecting to the internet without your permission. However, as the browser is a generally authorized application for ...
8
votes
4answers
531 views

I've encountered JavaScript attack code - how do I search for information on the exploit's specifics?

So, I clicked on a reasonably-looking LinkedIn invite, not thinking about hovering overing the link first, since usually the e-mail client warns me about such things. Once I realized I landed on an ...
3
votes
2answers
238 views

Do any web browsers create cached copies of local HTML files?

Suppose that we create a sensitive file as a HTML document, and then view that file with a web browser such as Firefox, or other. Is it possible that the file is treated as if it were a document ...
5
votes
1answer
484 views

Child iFrame hash verification of parent iFrame content

Consider the following scenario: Alice wishes to browse Victor's website while on the job at Initech. Victor's website is hosted on an alternative domain name system to which Initech's DNS does not ...
-1
votes
1answer
383 views

Is Opera spying on its users when traffic conpression is enabled?

Correct me if I misunderstand the following quoted paragraphs, but basically to compress something it must be decrypted first. This seems to be the claim of the article but I don't see this as true. ...
30
votes
8answers
1k views

Is the Web browser status bar always trustable?

If I bring the mouse pointer to a link, but not click on it, I can see in the left/bottom corner that it displays the URL of it. Q: Could this URL (in the left/bottom) be different from the one that ...
4
votes
1answer
140 views

Is there any risk to enabling CORS with a wildcard on S3?

By default, Amazon S3 blocks cross-origin requests. However, it allows users the ability to set up per-bucket CORS policies. It offers fairly elaborate controls for which domains and methods the user ...
1
vote
1answer
334 views

How to detect if a site is using a javascript exploit?

Is there a way for me (non-expert in javascript) to detect javascript attacks from a website. I have done alot of searching around and have not come up with a definitive answer. NoScript is a pain in ...
1
vote
5answers
1k views

How can I know that the CA certificates in my computer have not been spoofed?

As far as I know, the browser contains the certificates of several CA. When I access http://gmail.com, the site says it is Gmail, it exposes a certificate signed by one of the CA I have in my ...