A web browser is an application which uses http and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer, and management.

learn more… | top users | synonyms (2)

4
votes
1answer
489 views

How dangerous is a virus introduced to a malicious website in chrome?

I am using Google's Chrome browser under Linux (Ubuntu) 64 bit for web browsing. If I a virus uses for example a leak in the flash player, the virus will get the privileges of the user who started ...
3
votes
2answers
3k views

How is it possible that a virus can infect the system if the browser is started with non-admin rights

If I open my web browser (for example firefox) in Windows 7 with activated UAC as normal user (non admin) a virus - which uses a security leak in my browser - will only gets privileges of the normal ...
2
votes
3answers
495 views

How hard it would be to infect a system with malware through a portable web browser

If I use a portable web browser on a USB device like Google Chrome Portable how hard it would be to get infected by a malware/virus in the system to which the USB device is connected? Google Chrome ...
1
vote
2answers
889 views

HTTP Response Splitting

Is this apart of a HTTP Response Splitting attack ? Here below is some code that gets put into a web browser after clearing the url while on the website javascript: var xhr = new XMLHttpRequest(); ...
1
vote
2answers
284 views

Is a browser with disabled scripts and disabled java enough against malware

Is a browser like Firefox with disabled scripts (for example via a plugin like no-script) and disabled java enough to be protected against dryve-by-malware from the internet. Of course this does not ...
0
votes
1answer
614 views

Hardening Web Browsers - Detailed Guidance

Is there any specific and complete guidance on what is needed to harden a web browser given the number of attack vectors possible, particularly given that browsers allow so many varied plugins? All I ...
8
votes
2answers
2k views

Will disabling the Java add-on in IE protect you from Java exploits?

Concerning the recent Java vulnerability (Should I be disabling Java?), the most common advise seems to be to disable Java plug-ins in the browser. However, Heise Security suggests that, when it ...
5
votes
1answer
220 views

Is this a security flaw in Firefox 18.0?

I had a couple of .mht files which opened in IE, a browser I never use. I renamed their extension to .HTML to run it in Firefox. When I opened the file in Firefox, Firefox created new tabs endlessly. ...
7
votes
1answer
2k views

What are the benefits and drawbacks of the HTML5 Keygen element?

As of January 2013, what are the potential benefits and drawbacks of the HTML5 Keygen element?
3
votes
3answers
8k views

Browser security - Firefox + NoScript is better than Google Chrome?

I saw that NoScript + Firefox combination blocks all "dynamic content" (especially those spammy ads). I really like that. It reduces the chances of being exploited. But, chrome only asks me to allow ...
6
votes
5answers
24k views

Playing with Referrer Header

There are 2 sites: http://www.site1.com http://www.site2.com http://www.site1.com contains link to http://www.site2.com as <a href="http://www.site2.com/">link<a/> When user clicks ...
3
votes
2answers
615 views

Where do I get started in terms of learning how to exploit Java and Flash vulnerabilities? or browser exploitation in general

Another Java 0day was discovered today which got me thinking how browser exploitation (remote execution on clients browser) works. I am unable to find any books or resources online about browser ...
10
votes
4answers
8k views

Security measures against packet sniffing

I work in a environment where packet sniffing can be easily done . I was worried about my confidential data . Please suggest how is it done and precaution which i can take at client level.
7
votes
1answer
476 views

How safe is “trust this computer” option for websites?

Many sites have a "trust this computer" option that allows one to bypass some security measures (ex.: with Google's 2-step authentication enabled, one does not need to enter the phone's code if the ...
1
vote
1answer
128 views

How can I use many LiveIDs (or Microsoft Accounts) at the same time? [closed]

I use several sites under a different "LiveID" / Microsoft Account and need to use the following under different identities Windows Azure Management Portal Outlook.com MSDN Forums / Technet ...
2
votes
1answer
3k views

IE on Windows 2012 doesn't show certificate or lock icon despite using HTTPS

Can anyone explain why IE on Windows 2012 doesn't show the lock icon despite using HTTPS when visiting the following site? https://www.microsoft.com/en-us/default.aspx I am able to see the lock ...
5
votes
1answer
2k views

What OID Issuance Policies are appropriate for SmartCard and Browser Certificates?

I'm investigating issuance policies for SMIME and Browser certificates with different levels of assurance. For the purposes of S/MIME and Browser certificates, should I even use an assurance policy? ...
15
votes
3answers
1k views

URL Shortening - How to verify if it is a non-malicious URL?

Again, I must mention that I have just started to learn about security. So, please bear with my newbie questions. If I receive a shortened URL from somewhere, say in an my-email or in a social media ...
1
vote
2answers
515 views

How do I verify, parse and process the results of the HTML5 keygen tag?

I'm investigating the HTML5 attribute Keygen and discovered that it sends this data on a Form POST to the server. Here is an example POST: ...
3
votes
3answers
637 views

How can I protect my browser from being compromised?

In enterprise environments, I have found great benefit to use binary white-listing, web security gateway and end-point AV to help protect the end-user/system. Unfortunately, I still see the browsers ...
0
votes
1answer
170 views

Can IE be made to imitate the behavior of Chrome's KeyGen element?

Is there any way I can repurpose existing ActiveX controls or functionality to get IE to work with the KeyGen element? Assistance getting Safari to work with this optional HTML5 spec would be ...
2
votes
3answers
2k views

Do client certificates provide protection against MITM?

I'm looking for a way to protect clients from a MITM attack without using a VPN, and ToR. My thought is that client certificates might do the job, but I'm not entirely sure since not too much server ...
7
votes
3answers
2k views

Are Web Views in android secure?

"Web Views" are views that display some online content, usually a webpage within an android app. Implemented "Web Views" usually don't seem to have any kind of status bar or an address bar to confirm ...
10
votes
1answer
790 views

How can I embed iframe securely without restricting its functionality?

I'd want to embed an iframe from untrusted site into web application. Iframe: should be able to run Javascript and browser plugins (Flash, etc.) should not be able to access my web application ...
8
votes
3answers
207 views

Preventing user supplied javascript from posting to external server

I am writing an internal tool that will support plugins written by other developers. Ideally, these plugins would have a Javascript component to allow people to make widgets. Some of the pages these ...
3
votes
0answers
69 views

Is the use of JavaScript for cryptography ever appropriate in the browser? [duplicate]

Possible Duplicate: How secure is aSSL (javascript)? Does it effectively mimic SSL? After some searching around, I realized we don't have an easily visible canonical question about this on ...
3
votes
1answer
359 views

How can I use certificates to secure my webservices? What is available to javascript?

I have a few web services that are accessed over public wifi connections and I think it would be a good idea to issue certificates to encrypt data, prevent MITM, and invalid impersonation (beyond what ...
-5
votes
2answers
281 views

What technologies are recommended for E-banking? [closed]

If a Linux user need use his bank account from Internet, then what technologies and procedures should use? Is better to use the Guest Account (if exist) of the OS, or an Administrator Account? What ...
7
votes
1answer
890 views

Have any viruses leveraging the GPU been discovered in the wild? What is the mitigation?

This news article from 2010 discusses how a GPU can be used by a virus to avoid detection by common anti-malware/anti-virus software. The idea is to obfuscate the virus payload and leverage the GPU's ...
5
votes
3answers
327 views

Are there guidelines for application design of HIPAA compliant browser applications?

This is a different twist - I'm pushing dispatch information to first responders, such as fire, police, and EMS. But they all could, potentially, include medical information and PII together. My goal ...
2
votes
1answer
101 views

Possible to redact information in the clipboard, or to auto-redact when it hits a webpage?

Sometimes when I paste information to a website I realize after I post the information that I inadvertently included an IP address, username, email address, or other information I'd like to consider ...
6
votes
1answer
1k views

Same-origin policy for file: URLs in Android browser?

When you load a file:// URL in an Android WebView or in the Android browser, what does it treat as the origin? What can the Javascript on that page access? Can it access other files in the same ...
2
votes
3answers
418 views

How prevent Javascript from obtaining my location

I usually use a proxy server to browse anonymously. Now I realize that it is possible to find the location of a user using the Geolocation API. How to anonymously browse without disabling Javascript?
3
votes
3answers
4k views

cookies “secure” flag

How does cookies "secure" attr work to determines whether cookie itself should be included? e.g. [HTTP(unencrypted) connection] 1. user has no cookie yet and tries to log in; 2. user logs in ...
0
votes
3answers
137 views

Does AV software protect web applications (Twitter, Facebook, etc) from attacks? (CSRF, etc)

Is it correct to say that AV software focuses on downloaded executables and locally malicious activity, and it doesn't actively scan HTTP/S content for web based attacks such as CSRF, XSS, phishing ...
4
votes
1answer
479 views

Updated version of Browser Security Handbook

Google's Browser Security Handbook is a brilliant resource for web application security, and in particular, for understanding how browsers behave. It discusses many issues, and contains tables ...
8
votes
4answers
1k views

Preventing insecure webapp on subdomain compromise security of main webapp

I want your help on getting more concrete information on a type of vulnerability that I remember vaguely. I vaguely remember hearing about a year ago that if you set up a webapp on a subdomain, and ...
4
votes
4answers
1k views

What XSS attacks doesn't “Reflective XSS Protection” defeat?

Its been quite a while since I have played with cross site scripting vulnerabilities but today I came across a website today that was crying out to be tested for a basic XSS vulnerability. So ...
2
votes
1answer
2k views

Is autocomplete=“off” compatible with all modern browsers?

There are a lot of answers on the subject (including some on StackOverflow), but none of them have recent or updated answers: I can't seem to find any documentation indicating which browsers support ...
9
votes
2answers
670 views

User-specific Subdomains : JavaScript security

If I provide a public-facing website for users on my website at their own subdomain (e.g. bob.myapp.com) under their own control, can I allow them to execute arbitrary JavaScript without putting my ...
30
votes
4answers
6k views

How to fight browser fingerprinting?

https://panopticlick.eff.org/ , aka "How unique and trackable is your browser". For example it usually gives me a unique score. The biggest entropy values come from navigator.plugins and fonts via ...
1
vote
1answer
187 views

Is truecrypt a good choice to work with file that are generated and manipulated via browser

i'd like to know if Truecrypt is a reliable software for filesystem encryption, at the level of pgp as security level, and if it suitable to work with files that are generate via web browser, so ...
3
votes
3answers
1k views

What are methods for preventing browser hooking / drive-by downloads?

This question may be a bit too broad and open ended, however I'm hoping to get some good advice on this. With the advent of BeEF and more and more of the computers in networks being infected just by ...
5
votes
1answer
958 views

When and Why does Chrome display malware detection warning?

Google Chrome contains malware detection feature. When user visits some site, browser may display warning that site contains malware. What does it mean that site contains malware? Does it mean that ...
4
votes
1answer
862 views

How to disable caching of form data?

A web page accepts user name and password data within an HTTP POST request. This POST request actually shows up as an entry in the browsers history. After user logout from the application and ...
4
votes
1answer
344 views

Need help on understanding obfuscated code in CVE-2012-4969 exploit

As you may know this vulnerability was found a while ago in the wild and the exploit is available too, btw I'm having problem on understanding the obfuscated code. Is it necessary to use obfuscation ...
1
vote
2answers
460 views

Can I encrypt the packets that are sent to my router?

Is there a way to encrypt HTTP traffic to avoid man-in-the-middle attacks? I use Google Chrome.
4
votes
1answer
461 views

How did my homepage get changed in IE?

I have rarely used IE in the past. I just use it to test how a website looks. Today all of a sudden when I went on to open IE, it opened with a homepage that wasn't set by me. It was an address of a ...
3
votes
1answer
422 views

Can JavaScript defeat source port randomization?

Can malicious JavaScript defeat source-port randomization in browsers? I am reading a research paper which seems to claim that the answer is yes: many browsers seem to always assign a random ...
9
votes
4answers
5k views

How does BeEF work? (working understanding)

I have recently come across the BeEF- a browser exploitation tool. In most of the articles, it is said time and again that it is developed for research and pen test purposes! Has anyone worked with ...