A web browser is an application which uses http and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer, and management.

learn more… | top users | synonyms (2)

0
votes
1answer
60 views

Web site blocked by Windows defender and is marked as unsafe in IE

I posted this originally on Drupal Stack Exchange, and it was recommended that I try here for an answer. Here is the original question: Visiting my Drupal 7 site just now with IE 11, I get this ...
-1
votes
1answer
70 views

Can Chrome's Incognito mode be disabled? [on hold]

Is there a way to disable the use of anonymous navigation window (an Incognito window) in Google Chrome for a computer?
4
votes
1answer
51 views

How to prevent installation of Google Chrome extensions

You can prevent the installation of Google chrome extensions on a Desktop?
0
votes
0answers
12 views

autocomplete and cache in Firefox [migrated]

I am trying to understand if there is any difference between browser (in my case Firefox) cache and the place where 'autocomplete' data for an HTML form is stored in the browser. Unified storage for ...
0
votes
0answers
34 views

Website for testing malware software [on hold]

I want to test the correct operation of my anti-malware software. I am looking for a test or a malicious website for chrome like http://malware.wicar.org/ (but without java). Any idea?
1
vote
1answer
197 views

Can HSTS be defeated?

As I know HSTS is mainly implemented to mitigate famous sslstrip attack in which browser is forced to use ssl when connecting to particular site. And I think it also prevents user to proceed to site ...
5
votes
4answers
517 views

What is a good browser for web application pen testing? [closed]

I am getting started in testing web applications, and I am having trouble verifying vulnerabilities. It seems all modern browsers have protections against things like XSS. When something like Burp ...
2
votes
1answer
93 views

How does this website prevent directing away from it

I'm using the latest version of Firefox with Ghostery and Adblock plus installed. This website somehow prevents navigation away from it. How does it do this and how can it be protected against? I ...
54
votes
1answer
3k views

“Allow __ to be fullscreen?”

I have been asking myself for a while what's the purpose of that popup showing up in pretty much all the modern browsers upon entering the full-screen mode of a video or website. It appears to be a ...
1
vote
2answers
73 views

Are input fields that don’t have name=“” sent via the browser [closed]

Are input fields that don’t have name attributes susceptible to MITM attacks (w/o SSL) or any other attack? For example: <form action="" method="post"> <label ...
0
votes
2answers
94 views

Blocking access to social media on Windows

I would like to block websites like Facebook, YouTube and other social sites as part of my job and would need your advice on how to manage that. There are about 120 PCs in the building. Is something ...
15
votes
3answers
758 views

URL Shortening - How to verify if it is a non-malicious URL?

Again, I must mention that I have just started to learn about security. So, please bear with my newbie questions. If I receive a shortened URL from somewhere, say in an my-email or in a social media ...
0
votes
4answers
534 views

How can i protect myself from tor vulnerability on windows

Recently I came across an article regarding Tor. According to article there is speculation that the uncovered malware was used by a law enforcement agency to harvest the IP addresses of users ...
0
votes
0answers
34 views

What are empty requests in web server log?

In enginx access.log I have plenty of request logs like this: 1.2.3.4 - - [18/Aug/2014:12:09:33 +0200] "-" 400 0 "-" "-" As you see there is neither browser specification nor any target url. I am ...
2
votes
3answers
57 views

Flash cookie and man-in-the-middle

I am using the Scala Play web framework. In it, there is a PLAY_FLASH cookie used to flash messages to the user (it's a cookie so it will still work after several redirects). I put HTML in the cookie ...
0
votes
1answer
62 views

Firefox vs. Chrome extensions: Which are---ceteris paribus---more secure?

As an 'extension' to earlier questions on this topic (for instance here and here), What makes Firefox extensions (appear) more secure than Chrome extensions? Do they just appear to be more secure, ...
0
votes
1answer
51 views

Browser and SSL support

According to http://en.wikipedia.org/wiki/Transport_Layer_Security#Web_browsers most browsers support SSL 3.0. And with my understanding (please correct me if I am wrong), when a browser just ...
0
votes
0answers
25 views

Preventing ad agencies and social media sites from tracking me across the web [migrated]

I want to disable common forms of third-party tracking on websites. I currently block third-party cookies and use browser extensions to prevent some intrusive behavior. Disconnect blocks most ...
5
votes
1answer
251 views

Is there any risk to enabling CORS with a wildcard on S3?

By default, Amazon S3 blocks cross-origin requests. However, it allows users the ability to set up per-bucket CORS policies. It offers fairly elaborate controls for which domains and methods the user ...
0
votes
2answers
56 views

How the address bar manage the XSS?

I was playing with OWASP Mutillidae II and in one page I've found one vulnerability. In the address bar I've wrote something like : ...
9
votes
1answer
468 views

XSS Technique - & JavaScript Include

I was looking through the OWASP XSS Filter Evasion Cheat Sheet, and there was one technique that was completely new to me: & JavaScript includes <BR SIZE="&{alert('XSS')}"> I ...
4
votes
2answers
6k views

DOM Based XSS attacks: what is the most dangerous example?

I knew that XSS attacks (“non-persistent” and “persistent”) can hijack user session, deface websites, conduct phishing attack, etc. However, I can't understand what is dangerous of DOM Based XSS if ...
1
vote
2answers
99 views

Creating an application in which all user content is encrypted

Does any one have references or sources on how to approach developing a web application in which the content is encrypted and unreadable for the developers or company owners; I'm referring to content ...
5
votes
3answers
4k views

Javascript Malware: How does it work, and how can it be mitigated?

I am wondering how malware gets served through Javascript. I've noticed a few illegitimate pop-ups while visiting some financial websites. I wonder how malware exploits work against the application ...
0
votes
0answers
20 views

How JavaScript malware targets browsers? [duplicate]

What are the main components that JavaScript malware targets on the browsers ? Which aspects of browsers on which JavaScript takes advantage to exploit them ? And which techniques are used by ...
26
votes
2answers
3k views

How can a webpage get the MAC address?

I was logged on to my router and filling out some information. I clicked a button and a field was automatically filled in with my computer's MAC address. How is this possible? Does it present a ...
8
votes
2answers
530 views

How are browsers able to find and construct an alternate trusted chain path?

We had a web server that had the wrong SSL certs installed yet the browser was able to find another trusted path to a root and supply the page properly over HTTPS. We also have proprietary software ...
24
votes
4answers
4k views

How secure are my passwords in the hands of Firefox using a Master Password?

I'm relying on Firefox to remember my passwords, using a Master Password of more than 25 characters. How secure is this set-up?
1
vote
1answer
55 views

Why is the HTTP Server header not used by most servers, but the User agent used by most browsers? [closed]

I've read that the Server header would disclose information, and that its use would be bad. The arguments made in that question also apply for the User agent header. So why is it still used, and not a ...
4
votes
2answers
1k views

Could a malicious JS file pointed on URL/URI attack the browser/computer?

I found some website blacklisted on Google. I mean when you try to visit them, you get something like shown on this picture: After a small search, I found that some of them have a malicious ...
3
votes
1answer
131 views

How can I avoid Canvas Fingerprinting?

Canvas Fingerprinting has been getting a lot of press these last few days. Here is a study I read on this topic: 1 and 2 What can I do to keep browsing anonymously and avoid this tracking method?
15
votes
1answer
4k views

Site preventing user from closing tab/closing browser

I've come across the following website hxxp://politie.nl.id169787298-7128265115.e2418.com/ [Possible malware] Whenever I open it in Firefox it prevents me from closing it, I can't even close the ...
2
votes
2answers
99 views

Get the browser history without using a browser

I would like to get the browsing history of a computer in my network (without running that web browser), is it possible?
1
vote
1answer
33 views

Preventing tracking in browsers by setting HOME directory

Following worked on Ubuntu 12.04 using chromium and firefox browsers. I ran following command on terminal for both firefox and chromium browser HOME=/tmp/tmpdir firefox Both browsers promptly ...
2
votes
1answer
46 views

Browser - what gets saved to the disk

We run scraping jobs on behalf of users. We use webkit-gtk as browser to do the scraping. Each job is executed as a separate process So as not to mix user data we have isolated following data per ...
1
vote
1answer
83 views

How to post comments on websites without being traced back

Just trying to get some general sense about the security on internet now-a-days. There are so many websites I go and comment on different things. If some comments are political and they don't like, I ...
0
votes
2answers
82 views

Want to build a password manager using OpenPGP.js

I'm kind of tired of the password managers that are available around... I need one that's open source, that works on OSX, that lets me store .pem files and that I can trust. As I haven't found one, I ...
122
votes
9answers
24k views

Is Adblock (Plus) a security risk?

My email-provider's website (http://www.gmx.de) recently started linking to the (German) site http://www.browsersicherheit.info/ which basically claims that due to its capabilities to modify a site's ...
28
votes
3answers
8k views

Why is the same origin policy so important?

I can't really fully understand what same origin domain means. I know it means that when getting a resource from another domain (say a JS file) it will run from the context of the domain that serves ...
0
votes
1answer
65 views

How can a browser hijacking attack change the browser's default homepage?

Some attacks on web browsers consist simply of advertising, so the default homepage of the browser is changed (which is just a small aspect of browser-hijacking). My question: is installing ...
0
votes
1answer
44 views

are webmalware able to hijack browsers?

Are webmalwares capbale of performing browser hijacking attacks ? Has there been any famous webmalware that functioned this way ?
1
vote
1answer
103 views

Why do sandboxing environments not rely on antivirus programs?

Since years ago, miscreants use JavaScript to craft web malware attacks such as drive-by download attack that is used for example to install the famous CoolWebSearch virus. There are static methods ...
0
votes
1answer
62 views

Is installing malicious add-ons via drive-by attacks the only way to add new toolbars to browsers?

Some attacks on web browsers consist in installing new toolbars on the browser of the user (which is just a small aspect of browser-hijacking. My question: is installing (malicious) add-ons (via ...
1
vote
1answer
37 views

What are the webmalware effects on Windows XP?

I am redirecting URLs to a virtual machine (Windows operating system) to check if there is malware on the website i want to visit (JavaScript attacks, drive-by download attacks, infected pictures/PDF ...
1
vote
1answer
52 views

Is it safe to call an untrusted service with jquery.ajax and dataType 'jsonp'

From what I understand, the JSON-P technique generates a script tag into the DOM of an HTML page to get across the single-origin restrictions imposed on the XMLHttpRequest JavaScript API for AJAX ...
3
votes
1answer
143 views

How is YouTube able to identify anonymous users?

A few days ago I was searching YouTube and I noticed an "outlier" video poped up in the suggestions list. This video had nothing to do with the topic being searched, but instead it was based on a ...
0
votes
2answers
105 views

How much I can depend on TOR to protect my identity, especially from outlook.com

guys I am using Tor browser from some time, few weeks maybe and I am still trying to determine the level of anonymity that the browser gives. I am using the browser to advertise a service that I am ...
2
votes
2answers
908 views

How can Bank of America tell that I'm logging in on a computer I haven't used with them before?

When you sign into Bank of America for the first time on a computer that you haven't used with them before, they detect this and force you to answer one of your security questions. I think I've seen ...
3
votes
1answer
82 views

How browser detects Phishing Pages?

I want to know how browsers detect phishing pages.And also what methodology browsers use to detect phishing pages?
0
votes
0answers
57 views

Google Chrome Crash Report Analysis

I am new to the field of crash analysis. I recently, by accident, happened to crash Google Chrome. I do not know the reason as to why the crash really happened. I'd like to know it in depth though. ...