A web browser is an application which uses http and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer, and management.

learn more… | top users | synonyms (2)

-6
votes
1answer
122 views

How to avoid DDoS Attack [closed]

I buy my train ticket from our railway local web site. When ticket open for sale on web site then web site original traffic remain 50 (Just an example). Our railway web site is attacked by DDoS for ...
6
votes
2answers
109 views

Information Transfer Between Browsers and Tabs

Is it possible for a webpage to detect or otherwise be aware of what other tabs in the same browser, or even other open webpages in other browsers are doing or transmitting? I am well aware of ...
3
votes
1answer
68 views

How can two clicks lead to better security in the context of, e.g., Twitter and Facebook share buttons?

The sharing section of Jedox's webpage has the Facebook, Twitter, Google+ and Linkedin share options in default inactive state. You need to first click it to activate and click again to get the share ...
1
vote
2answers
84 views

Is it considered a CSRF if it requires a unique identifier which is not a CSRF token - not tied to the user session?

Consider an end point such as below. Let's imagine that this endpoint updates an address of the signed in user, changing the zip code. The address to update is identified by the address ID ...
3
votes
1answer
298 views

How does firefox sync password recovery work?

According to Mozilla Sync-new-security-model, Firefox servers are not able to decrypt your sync data without your password. So I figured that, the browser generates a key from your password, encrypts ...
2
votes
1answer
80 views

What happens if a page with an invalid SSL cert responds with a 302 redirect to a page with a valid cert? Do you still get the warning?

Alice navigates to https://example.com. https://example.com delivers an invalid certificate. https://example.com 302 redirects to https://www.example.com https://www.example.com delivers a valid ...
0
votes
1answer
127 views

Open source alternatives to tamper data

I'm developing a browser(firefox) plug-in which essentially checks for malicious input. My current approach is to store all input fields sent in GET/POST requests, try to heuristically determine ...
0
votes
1answer
49 views

Add certificate authority to one browser only

For testing purposes, I'd like to add a "CA" to the list of trusted-CA's of one browser - and use it only for testing. I want to make sure that it won't get added to the computer's trusted CA list. ...
14
votes
3answers
8k views

Why is 'avast! Web/Mail Shield Root' listed as CA for google.com?

I just noticed something weird in my browser: the certificate for www.google.com has been issued by avast! Web/Mail Shield Root. Should I be worried? I am using avast! Antivirus so it's probably a ...
-2
votes
1answer
51 views

Tools or scripts to scrape browser credentials and data?

I'm exploiting machines in a network and I'm currently trying to scrape data to further my testing from the compromised machines. There's no SOE build so i've got a variety of different environments. ...
1
vote
1answer
120 views

How does a browser choose which certificate to use if my web server has multiple certificates?

I'm using Apache 2.4, with two certificates, one RSA signed by CACert, and one ECC self-signed. Neither of these certificates provide a path to a broswer-trusted root certificate. My question is ...
0
votes
2answers
105 views

Browser page “Not resolved” page hijacked by yandex [closed]

Any domain that cannot be resolved defaults to yandex right now, on any browser on my system. Helper objects or extensions are not installed. It turns out that the ISP (Turk Telekom) is employing ...
1
vote
1answer
83 views

Reflected file download Scenario

I'm making a Java-based web application that is intentionally vulnerable to Reflected File Download (RDF). White paper is here I read the requirements of reflected file download vulnerability as ...
8
votes
1answer
824 views

Browser password manager vs third party password manager

How usable and secure are 3rd-party password managers like Roboform, Lastpass, and 1password from the built-in Chrome and Mozilla password managers? What are the advantages of using 3rd-party password ...
4
votes
1answer
206 views

Regarding Windows password and Chromes Remember password Feature

Google Chrome browser helps in password management by prompting users to remember their passwords for the websites. These saved passwords can be accessed from the browsers "settings" menu, and to do ...
2
votes
1answer
104 views

While logged in to Google etc., can a malicious site discover my ID?

If I visited a malicious site while being logged in to Google, Hotmail, Facebook, or Twitter in the same browser window, how hard is it for the site to discover my account IDs without my explicit ...
2
votes
1answer
551 views

Questions on reflected file download (RFD) attack

I read this article, and the whitepaper by security researcher Oren Hafif which mentions the following salient points: RFD, like many other Web attacks, begins by sending a malicious link to a ...
-4
votes
1answer
167 views

How does https check md5, sha-1 and sha-2 fingerprints?

When a https site shows multiple finger prints, i.e.: md5 and sha1, or sha256 and sha1, how does the browser check? is it both just the "strongest" or whatever is convenient? This question arose ...
1
vote
1answer
163 views

Browser gives access to root directory through “/” [closed]

If I put a '/' on my browser I have full access of my root directory. I have tried the same thing on another computer and it didn't work. So, I'm trying not to be paranoid but this is too strange. I ...
1
vote
1answer
120 views

Is it dangerous to allow clients to run JavaScript on a Server

On a webpage I have been working on, we can archive certain webpages for a user. The user can give an address and this webpage is than visited on the server and archived. Lately, I noticed that ...
5
votes
1answer
523 views

Google Chrome browser warning for goo.gl

I am getting the solid red screen Chrome browser malware warning for Google's own URL shortening website, goo.gl as well as other sites such as bit.ly and delicious.com when I try to navigate there ...
3
votes
2answers
55 views

Why browsers implement stricter policy for local files

I have a problem viewing HTML/JS/CSS files generated on disk. Specifically, several calls in javascript are blocked by Google Chrome. I googled and found an answer here: ...
-4
votes
3answers
215 views

Why doesn't Google Safe Browsing block the IP addresses of malicious websites?

If you visit a blocked domain name like www.thelotbet.cn from Google Chrome, Opera or Firefox, you will get a warning from Google Safe Browsing that this is a malicious website. But if you visit the ...
1
vote
0answers
101 views

Hidden TrueCrypt Container containing the Tor Browser Bundle

I'm considering using a hidden TrueCrypt container to keep a Tor browser bundle copy which could save bookmarks. In this case, would the TBB leave traces on the OS it started with? E.g. I use my ...
1
vote
2answers
262 views

Will Ad Block Plus block the ads that give someone Cryptowall 2.0?

Now I already know that making sure your browser plugins are either non-existent or up-to-date is one way of being on the safe side against ransomeware like Cryptowall 2.0; but since clicking ads are ...
9
votes
4answers
2k views

My ISP is injecting strange codes to every website I visit

Here's the code at the bottom of every page: <script type="text/javascript">if(self==top){var idc_glo_url = (location.protocol=="https:" ? "https://" : "http://");var idc_glo_r = ...
6
votes
3answers
4k views

Force a connection via SSL3 to detect POODLE vulnerability

I have been reading up on the POODLE vulnerability. From my understanding, and correct me if I am wrong, you need to allow connections to be made via SSLv3 on the server. The server I am currently ...
3
votes
3answers
353 views

How is the same origin policy causing my PoC to fail when I don't need to read return data?

I'm performing an authorized vulnerability analysis on a custom web service and have discovered a CSRF vulnerability. Due to there not being form tokens coupled with the service not checking for the ...
3
votes
2answers
103 views

How does a browser manage secure sessions and store session keys?

I am interested in how a browser manages secure sessions. As I understand it this is the scenario when logging into a google account: 1) Browser (B) and google Server (S) perform a handshake to ...
-1
votes
2answers
70 views

Which web browser supports a proxy in proxy configuration? [closed]

Normally you are forced to use a corporate proxy. This is necessary for the company to protect against the internet. But a side effect is, that the internet usage of every proxy user can be monitored ...
0
votes
2answers
78 views

Detect Different Machine using Browser [closed]

Some web apps like Facebook and Gmail detect the first time we try to login from a device. Assuming that a browser can't read machine name, and MAC ADDRESS. What kind of variables are they collecting ...
-4
votes
2answers
221 views

Is “HTTPS” ~100% secure? [duplicate]

Assuming that we have a "green bar connection" to a website, e.g.: Is an attacker still able to sniff our traffic? How secure is a user from man-in-the-middle attacks when he has established a ...
4
votes
4answers
1k views

Is it a security risk to use an unknown web browser?

The more I read about TLS, the more I get convinced that the browser is the weakest link in the chain. I know that nobody agrees with me as there are no articles about that in Google, but it looks ...
2
votes
2answers
130 views

Steps after getting hit with malware or browser exploits on Xubuntu

Well, today I was browsing the internet and I suddenly got redirected to a chinese hosted malware site and firefox started going crazy. I checked the url on virustotal with my phone and it found other ...
5
votes
3answers
1k views

Can CSS file contain malware? [duplicate]

I know that javascript files can contain malware. However, I am not so sure about CSS files. They only affect how the page is displayed, right? I know that css files can be used for clickjacking but I ...
3
votes
1answer
53 views

Enabling Unsigned ActiveX

A third-party wants to provide a web app which they say only works if we enable unsigned ActiveX (unfortunately users are required to use IE). I understand what 'signing' is, as well as the basic ...
1
vote
1answer
77 views

using multiple Firefox profiles to increase security

I am wondering whether it would increase security in any significant way, if I would use two separate Firefox profiles, one for normal browsing and the other for private/secure websites, such as my ...
1
vote
2answers
122 views

Xubuntu guest session security

lately I've been using the guest session on my xubuntu install because I am lazy and I was wondering what the security implications can be on the rest of the system if there is a web browser exploit ...
2
votes
2answers
57 views

Question regarding browser windows when integrating with 3rd party payment software

I've been told that when integrating with a 3rd party payment gateway, the other website's window should not be opened in an iFrame or a separate window - that the current application window itself ...
34
votes
2answers
10k views

Why do browsers enforce the same-origin security policy on iframes?

I did a small test on Chrome (V37) today. I created a small page and loaded it to the browser: <!DOCTYPE html> <html> <head> <title>Untitled Document</title> ...
4
votes
1answer
174 views

How will SHA1 deprecation affect internal CA's?

I am hearing that the SHA1 Deprecation notices from MS/CHROME only apply to certs that are a part of a public trusted root program. This makes one believe that IE will have new logic built in to allow ...
0
votes
1answer
329 views

Reflected XSS script passing through URL how to make it work and what are the preconditions for it to work?

Trying to learn about security I set up the most simple website on my localhost consisting of one html page that a apache server serves. I first started trying and appending the JS script that would ...
33
votes
9answers
4k views

Why is it a security problem not to update one's browser?

Is it in general a security problem not to update your browser. Firefox constantly prompts me to update my browser, but how dangerous is it to not update? As part of this question, I would like to ...
2
votes
1answer
101 views

XSS: alert() not executed on different OS/computer

I've encountered a strange behavior while I was performing a security audit of a web application. Some user controlled inputs were displaying their values, unencoded, into the page that processed the ...
2
votes
1answer
57 views

Understanding cross origing requests from a web page

Reading up the XSS attacks on wiki I see that it says an injected script could send data/cookies to the attackers site. How is this achieved? Are there no checks/restrictions on cross origin requests ...
1
vote
2answers
143 views

Can my University see what Stack exchange account I am logged into?

I have to log into an account to use the university internet, so I imagine they can see all the sites I view, but can they see what account I am logged into, and can I do anything to hide this?
1
vote
1answer
105 views

Is it possible to compromise Bing to redirect user to a malware?

I just got a new laptop and the first thing I wanted was to install Chrome. I opened IE and searched for "google chrome" in Bing. The first result was an ad with the link pointing to ...
0
votes
2answers
44 views

what is the cons and pros of using webfiltering based on cloud security?

nowadays some vendors offering web filtering based on cloud security , where your web traffic will be forwarded to vendor cloud to be filtered and controlled at the vendor proxy , the vendor will ...
1
vote
1answer
81 views

BREACH attack and content length

I've been researching BREACH, and while I can understand how it might work if you have access to the the browser (to send crafted requests) and the wire (to capture compressed response length), I ...
2
votes
1answer
249 views

How effective is Opera Mini's encryption? Can it hide activity on a WiFi network?

I'm curious since I discovered the nature of how browsing works in Opera Mini. A URL request is sent to Opera's servers, they download the page then compress it to lower bandwidth. They use a file ...