A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

learn more… | top users | synonyms (2)

1
vote
1answer
48 views

is browser the only app that can set supercookies?

I'm trying to identify a if a website uses tracking cookies beyond ordinary cookies, that get deleted when I click "Delete cookies". The work plan is to run a clean virtual machine, use a software ...
6
votes
2answers
280 views

Why are certificate chains different in Firefox and Chrome?

I have a server with HTTPS, and I noticed a very strange behavior which I cannot understand. When I checked the chain in Firefox, there is this: But in Chrome I see this: So it's clear, that ...
4
votes
1answer
123 views

Risks of HTML/JavaScript window.opener security flaw?

I do not know if you are aware of this flaw, but here is a basic example: somepage.html (pointing to malicious.html): <!DOCTYPE html> <html> <head> <meta charset="utf-8"> ...
4
votes
3answers
241 views

why is thepiratebay.se listed as deceptive site in Chrome and other browsers

Why is thepiratebay.se listed as deceptive site in Chrome and other browsers? My Norton says nothing about fishing or malware. There is no doubt that some organisations doesn't like thepiratebay but ...
2
votes
3answers
68 views

Can freezing the browser be considered a security vulnerability?

If I can write a client script (a piece of JavaScript code) that can freeze the entire browser, a force quit/kill being mandatory, is that considered a security issue? If so, what's the type of this ...
4
votes
1answer
147 views

Can canvas fingerprinting be prevented?

How can canvas fingerprinting be prevented in web browsers? The site Panopticlick said I had a hash of WebGL fingerprint of 5 bits of entropy. I installed CanvasBlocker addon and tested again and it ...
2
votes
2answers
159 views

Suspicious Network Activity - is my system compromised?

When using Firefox to open a blank page, I have a weird network connection that shows under Network Activity in Resource Monitor (Windows 7). The address is: insiders-guide.pacedev.com. A screenshot:...
3
votes
2answers
153 views

Preventing Browser from BeEF Exploitation

BeEF is a great exploitation Browser based tool. But in some cases, unknowingly people get Hooked due to beef when it's hook.js is kept in Invisible Iframe of an HTML source. So How, can we detect ...
22
votes
3answers
4k views

Is it possible to transfer a virus through browser video?

I know that there is already a question related to viruses in videos, but the implication in the other question is that videos in question have been downloaded and played by media software on the ...
3
votes
1answer
59 views

What security implications does DNS prefetching have?

To improve performance, most browsers prefetch DNS records for linked resources in the background so that the browsers already knows where to send the request the instance you click the link. This is ...
4
votes
3answers
111 views

Could Google Chrome's lack of a download confirmation dialog be a security vulnerability?

Suppose the user is playing a game like flappy bird that requires constant tapping in the lower left area of the screen (where the downloaded file needs to be clicked). Then while the user is ...
0
votes
0answers
33 views

Can a virus execute without user interaction? [duplicate]

I have seen a lot of malware infection techniques where the user is infected by drive by downloads through browser vulnerabilities or social engineering. But is there a way that a virus could execute ...
2
votes
0answers
86 views

Configuring Chrome to handle ETags like Safari

ETags can be used for tracking, but I happened to notice that Safari handles them differently from Chrome (and Firefox). I believe it's non-standard because it doesn't work across domains. If we ...
2
votes
2answers
88 views

Protect against virus and malware attacks from website ads with iptables

Lots of websites spread malware by publishing advertisements that distribute malware. Even YouTube's ad network has been compromised in the past. Browser ad blockers and related plugins have there own ...
1
vote
1answer
61 views

Why do some websites tell you they use cookies? [closed]

I often visit websites that have a small box telling me that they use cookies. Most sites just store cookies and don't say anything. Is there a reason that some do and others don't? For example:
0
votes
2answers
245 views

How secure is “Browser in the Box”?

I'm wondering how secure is "browser in the box" from Sirrix? They said in their official website: In contrast to simple sandboxing methods provided by standard browsers "Browser in the Box" ...
3
votes
0answers
71 views

Secure a server on `localhost` such that only the authorized users can connect

Consider an application (such as an IPython notebook) that runs an HTTP server, and that (by design!) allows arbitrary code execution by authenticated users (this is the entire point of IPython, ...
2
votes
2answers
140 views

Why does Safari still support SSL 3?

The "POODLE" attack was made public in October, 2014. Why does Safari still support SSL 3.0 after POODLE showed it to be insecure?
0
votes
1answer
61 views

Alternative to Avast Safezone for banking

Apparently low level keyloggers etc can intercept typed details before Safezone keylogging protection kicks in. Would BD Safepay avoid this problem with its enforced virtual keyboard ? Or perhaps ...
2
votes
1answer
33 views

Security Protocols for a Blog [closed]

What are some security protocols that I should be aware of when starting and running a personal blog? I am steering away from WordPress and will another hosting service. The blog will mainly just be ...
0
votes
1answer
104 views

Is WebRTC safe for connecting random clients to each other?

I am trying to implement a chatroulette-sque app, and WebRTC seems to be the best choice as far implementing something that doesn't take a vast amount of server resources. My current scheme is to ...
-2
votes
1answer
81 views

Clicking a lot of website links in Google Maps, then sent through multiple URL redirects, and lastly to a page that made my laptop start beeping?

I was in Google maps clicking on all the website links listed in the side panel, looking at every website really fast. Note, they were all tattoo parlors. One of the links I clicked bounced me through ...
2
votes
2answers
185 views

Security feature: Preventing javascript from closing the window

The latest versions of most web browsers have implemented a feature to prevent javascript from closing current window or tab. Firefox window.close() method This method is only allowed to be ...
4
votes
2answers
261 views

How do I protect my passwords from WebBrowserPassView?

I just got shocked with what can be achieved with WebBrowserPassView. It basically shows every password I've saved in my browser (Chrome). I guess other users on my PC could get my passwords that ...
1
vote
0answers
49 views

Have there been any known “in the wild” exploits of any Google Chrome (Android) 40.0.2214.89 vulnerabilities?

https://www.cvedetails.com/vulnerability-list/vendor_id-1224/product_id-15031/version_id-179594/Google-Chrome-40.0.2214.89.html I looked for any news about them and couldn't find anything. Anyone ...
0
votes
2answers
123 views

Malware or viruses by browser redirects?

Recently was browsing and clicked on a link to the following address: (In code blocks so you cant accidently click it) http://paycheck-calculator.org/ Clicking on this quickly loaded 2-3 different ...
2
votes
1answer
92 views

Is JavaScript needed for browser code execution vulnerabilities?

Does JavaScript VM have to enabled in a vulnerable browser to exploit an arbitrary code execution bug? There is a number of bugs in borwsers that don't seem to involve JavaScript. For example, CVE-...
4
votes
2answers
253 views

Certificate Chain - intermediate and root certificate - installed required?

Recently I bought a SSL cert from comodo for my domain - orakoha.com After submitting the CSR etc, domain control verification etc, I am issued with a zip file containing 4 document which I believe ...
1
vote
1answer
53 views

Rightscorp Scaleable Copyright - How would they avoid making this a massive security risk?

I recently read an article about a new copyright protection system that RightsCorp America is trying to get ISPs to help implement. From the Article: “Single notices can be read and bypassed ...
3
votes
0answers
65 views

How safe is WebCryptoAPI these days?

The 1Password Tool (software) introduced the 1Password for Teams. Now I thought this is a great peace of Software. But now they can show Passwords in the Browser. They do say: We encrypt ...
2
votes
1answer
45 views

Malicious link? Apache?

I've got a link from spammer, the link is very strange, but after redirects I got the web page full of ads. Here is the link(doesn't require "http://"): /0xD805A9E4///RLI=590-UI=273411771-OI=6313-...
0
votes
0answers
38 views

Setting specific geoIP in Piratebrowser

I'm using Piratebrowser. In order to set a specific country's IP, I used the line ExitNodes {in} which is working. I'm getting an Indian IP in dnsleaktest, but my geolocation is getting a Japanese ...
21
votes
2answers
3k views

Can javascript execution from address bar cause any harm to client's machine?

Given the fact that modern browsers these days prohibit JavaScript from having access to any resources on the client's machine, does JavaScript execution from the address bar pose any threat at all to ...
0
votes
2answers
103 views

Is it possible to hide malicious code within/behind an image? [closed]

Is it possible to hide malicious code either within an image, or behind it as it is displayed on a webpage and then if the user saves this image, they actually are downloading the malicious code? ...
1
vote
1answer
66 views

How to distinguish malware from system crash?

Recently, I browsed to a website, which appeared to consume all the computer's resources. Although the mouse cursor continued to move, the browser (and other applications) slowed down fast and soon ...
213
votes
5answers
14k views

Is the save button delay in a Firefox download dialog a security feature? What does it protect?

When I click to download a file through Firefox, a dialog window appears asking me whether I want to save the file somewhere or open it immediately once downloaded. The OK button in the dialog ...
2
votes
1answer
174 views

How to enable ECDHE in openjdk-1.8.0 in CentOS 6.7?

I have seen many posts that hinted ECDHE is available in the SunEC provider way back in openjdk-1.6.0. My environment: CentOS 6.7 with openjdk 1.8.0.71-1.b15.el6_7. No ECDHE. Made 2 changes in jre/...
3
votes
2answers
83 views

Internet browsing confidentiality [duplicate]

I wonder how easy or difficult it is to find out who I am, using information security's most advanced techniques. And what can I do that will not affect my browsing experience too much, as a lambda ...
0
votes
1answer
36 views

security in the browsers - broad questions [closed]

I'm working on security project in the browsing field but I am confused about some points. What does "security in browsers" mean? Is it all about secure connections or there are other aspects? How ...
3
votes
1answer
89 views

How can I test a domain that I don't own for unencrypted communication vulnerabilities?

I am suspecting a website of passing clear text login information and so far as I can tell the connection is unencrypted. Are there web-based tools to validate/test a website for basic security ...
-1
votes
1answer
63 views

Does this website contain a drive-by download? [closed]

Like others, I am not really sure if drive by downloads can actually happen. I was given a website with a bit.ly link today. I visited it and then immediately closed it. These are what I have done so ...
2
votes
3answers
147 views

Is it possible for a virus to be downloaded unknowingly and run when a website is opened?

Usually, the only time I see viruses happen is when someone mistakenly runs an infected file. But could one also be infected by just visiting a website?
0
votes
2answers
53 views

chrome invisible flash document

I have it so flash doesn't start on page load for security and performance. Lately I have been noticing That some pages will load with a flash document that takes up the full screen. I can see it as ...
-5
votes
1answer
61 views

Adblock browsing history security [closed]

A lot of people use adblock. From a security aspect, ad blocking would involve intercepting and parsing HTML contents and URL's. Hackers attacking adblock servers could gain access to that valuable ...
3
votes
2answers
79 views

How do I tell the difference between a fake “problem loading page” and a real one?

We know that due to numerous reasons, a browser will display a page like "Problem loading page" or "This page can’t be displayed." But there's one huge problem: browsers seem to show this error page ...
1
vote
0answers
78 views

Force Browser to not URL encode specific chars [duplicate]

I try to get a XSS to work but the problem is, that the XSS is only working within BURP because there I can send for example '>' as an not URL encoded String. As soon as I try it in the browser, it is ...
5
votes
4answers
79 views

Would an official <disablescripts> HTML (6?) element/wrapper combat XSS effectively?

Would it not be possible to use such a method to wrap areas where user input/output is expected (eg. comment boxes), so that even if a script is successfully injected through regex evasion, the script ...
1
vote
1answer
181 views

What does browser do when it queries xxx.example.com and it gets a certificate for yyy.example.com(top level domain is same)?

The question is actually about what level of validations browser does when it gets certificates of some other domains like case 1: Accessing abc.google.com and got def.google.com case 2: Accessing *....
2
votes
1answer
82 views

Differences between Burp request and Browser - Has different responses

So I was put on an engagement over the last week and I found a potential XSS when using Burp's intruder/repeater. However, the strange thing that I noticed was that the response in Burp is different ...
41
votes
5answers
5k views

What's the danger of having some random, out of my control, JavaScript code running on my pages?

My website pages reference some JavaScript code from a third-party CDN (analytics, etc). So I don't control what code is there - the third party may change those scripts at any moment and introduce ...