A web browser is an application which uses http and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer, and management.

learn more… | top users | synonyms (2)

0
votes
1answer
37 views

Give Someone Access to Secure Website?

I have someone I hired on Freelancing website working for me - so far he has worked for me for about two weeks and is doing a good job. In order for him to complete his work he will need access to ...
23
votes
3answers
1k views

Why do you need to close your browser window after logging out of a website?

Might be wrong, but believe the request to close the browser window after logging out is common, though it's completely unclear what the risks might be of failing to close a browser window (assuming ...
0
votes
4answers
347 views

Malware ad.adsmatte infection

My PC is infected with malware, whenever I open a webpage and click on it a new tab opens on "ad.adsmatte.com". I scanned my PC with Malwarebytes but was unable to resolve the problem. So I ...
2
votes
3answers
81 views

Can a browser JavaScript console ever be an issue?

I'm sure most of you are familiar with the JavaScript-based game Candy Box. As you probably know, one can cheat this game's candy system by sending commands to the console. For instance, if you ...
2
votes
0answers
24 views

Multiple browser instances through differents openvpn [migrated]

How can I config multiple instances of browser to connect through different VPN servers? I'm working in a Linux server and I need that every browser instance uses different VPN servers. Thanks in ...
94
votes
5answers
3k views

How can I protect myself from this kind of clipboard abuse?

Clipboard abuse from websites Many websites use JavaScript or CSS to stealthily insert or replace text in the user's clipboard whenever they copy information from the page. As far as I know this is ...
28
votes
4answers
5k views

How to fight browser fingerprinting?

https://panopticlick.eff.org/ , aka "How unique and trackable is your browser". For example it usually gives me a unique score. The biggest entropy values come from navigator.plugins and fonts via ...
1
vote
2answers
491 views

How do I verify, parse and process the results of the HTML5 keygen tag?

I'm investigating the HTML5 attribute Keygen and discovered that it sends this data on a Form POST to the server. Here is an example POST: ...
1
vote
0answers
31 views

What web browsers support ECC vs DSA vs RSA for SSL/TLS?

We are updating our wildcard certificate and see that we have the option to use both RSA or DSA with Symantec (for free), while Digicert offers 3 options for wildcards ECC, DSA and RSA. Is there a ...
3
votes
1answer
770 views

Is Google Chrome Extension access to SSL certificate validation output possible?

I want to develop an extension which will stop an user from proceeding to any banking site (configurable by user) if a proxy like paros is seating in between sending fake certificate to user. My ...
0
votes
0answers
25 views

Does this list every Chrome extension/addin that may leak privacy?

I am looking for a simple list of all extensions, preference, custom processes, and "flags" that may disclose a user's privacy or other details to a 3rd party. To that end, I discovered: ...
0
votes
2answers
126 views

Restrict website access

I want website (A) to only work if a visitor came by clicking a link from a specific other website (B). Initially I thought of using the document.referrer from website A to check whether website B is ...
1
vote
1answer
36 views

Does a TLS-connection to a proxy-server encrypt the destination url's?

If I use a browser through a proxy-server over a secure connection (i.e. the proxy is HTTPS) - does that mean that everything is encrypted, or just the page returned from the site? And who does the ...
2
votes
1answer
76 views

What are some useful tags and payloads for HTML injection on CSP-protected sites?

I'm pen-testing a website that fixed most of its XSS vulnerabilities by just adding a Content Security Policy. There are still HTML injections in several places. I've tried to get a ...
2
votes
1answer
72 views

Secure Flash with Click to Play Plugins in the Enterprise

In the recent light of repeating critical Flash vulnerabilities there are recomendations to use browserplugins like click-to-play to prevent unnecessary flash content to automatically load with every ...
-2
votes
1answer
96 views

Clarification on a website security [closed]

I am new to work on website handling and here are my questions. 1) How can I ensure that the pages accessing is secure enough for data transmission , sql injection and several other attacks. 2) How ...
5
votes
1answer
103 views

How do I securely embed an <img> tag using a user-given URL?

If I hypothetically wanted to allow users to use an avatar from an arbitrary URL like this: <img class="avatar" src="{user input}" /> There are many problems that I can think about: There ...
0
votes
1answer
29 views

configuring burp to use in proxy environment

my university internet connection runs behind proxy.its host name is 192.168.1.103 and port no is 3128.how to configure proxy in burp suite if i should enter above proxy setting in my firefox browser. ...
-1
votes
1answer
86 views

What to do if I suspect a website I visit and link to was compromised via an XSS?

EDIT: The script has been removed and apparently the vulnerability has been patched. My employer links to this resource: http://www.myplan.com/ I recently noticed a JavaScript alert was added into ...
1
vote
1answer
276 views

Is opportunistic encryption support optional for HTTP/2?

I'm a little unclear on the subject of opportunistic encryption of the HTTP:// address scheme in HTTP/2. According to the bug report, it looks like it's kinda optional, and an afterthought: ...
3
votes
3answers
3k views

How to prevent installation of Google Chrome extensions

You can prevent the installation of Google chrome extensions on a Desktop?
0
votes
3answers
5k views

HTTPS icon red and crossed out - Chrome browser

I just would like to ask what actually means when HTTPS icon is red / crossed - out. Is this site is vulnerable to Man in the Middle Attack? Is it safe or not?
76
votes
6answers
13k views

How much can I trust Tor?

How much can I depend on Tor for anonymity? Is it completely secure? My usage is limited to accessing Twitter and Wordpress. I am a political activist from India and I do not enjoy the freedom of ...
2
votes
1answer
145 views

Why is the HTTP Server header not used by most servers, but the User agent used by most browsers? [closed]

I've read that the Server header would disclose information, and that its use would be bad. The arguments made in that question also apply for the User agent header. So why is it still used, and not a ...
3
votes
5answers
868 views

If someone steals my laptop while I'm logged in, how can I protect my browser?

My question has its roots in an xkcd from this week: http://xkcd.com/1200/ Isn't this true and ironic? We place so much emphasis on browser security and OS security -- and rightly so -- yet if I ...
2
votes
2answers
75 views

Best practice for caching sensitive data

My server returns private data in the body of an HTTPS response. It's not passwords or credit cards, but it is user-generated text and images, which should not be accessed by others. The data for a ...
0
votes
1answer
33 views

In What Ways Can X-Foward-For Header Information Be Used In An Attack

By enabling X-Foward-For on our proxy, we would essentially be advertising our internal IP addresses externally. However, we use a private range. Everything goes through NAT. So, the best anyone would ...
2
votes
2answers
146 views

Steps after getting hit with malware or browser exploits on Xubuntu

Well, today I was browsing the internet and I suddenly got redirected to a chinese hosted malware site and firefox started going crazy. I checked the url on virustotal with my phone and it found other ...
5
votes
1answer
99 views

How can two clicks lead to better security in the context of, e.g., Twitter and Facebook share buttons?

The sharing section of Jedox's webpage has the Facebook, Twitter, Google+ and Linkedin share options in default inactive state. You need to first click it to activate and click again to get the share ...
0
votes
0answers
15 views

Does upgrading from IE8 to IE11 erase old IE8 stig settings? [migrated]

I hardened Internet Explorer 8 on a 2012 R2 Box according to latest IE8 Disa Stigs. A coworker accidentally installed IE11, realized his mistake and then rolled it back to IE8. Will the IE8 Disa ...
0
votes
1answer
103 views

Chromium Sandbox on Mac OSX: Is it enabled by default?

I have decided to finally replace the closed source and privately owned Google Chrome with the open-source Chromium on my Mac OSX 10.9.2 (Mavericks). I have read the differences between both here: ...
0
votes
1answer
245 views

Web site blocked by Windows defender and is marked as unsafe in IE

I posted this originally on Drupal Stack Exchange, and it was recommended that I try here for an answer. Here is the original question: Visiting my Drupal 7 site just now with IE 11, I get this ...
-4
votes
0answers
18 views

Server side script to check if browser is vulnarable to SSLv3 Poodle [migrated]

I want to implement a browser SSLv3 Poodle vulnerability test like https://zmap.io/sslv3/sslv3test.html on my web application. My idea is to put a routine in the application first page to tell to my ...
0
votes
1answer
31 views

Sharing sensitive information across servers on visits from the same browser

I have this scenario: Webserver domain A. Generates sensitive information when a request from a browser is received but this information is not disclosed to the browser. Webserver domain B. ...
4
votes
3answers
90 views

Same Origin Policy - XHR response

I know that Same Origin Policy (SOP) prevents a page/script from one origin to read response from another origin, but it does not prevents the page/script from making a XMLHttpRequest (XHR) request to ...
3
votes
1answer
55 views

Bing bar without admin rights

I know viruses uses exploits to gain admin rights to install software. My question is here at work, we have people end up with the Bing Bar installed from time to time on their machines. It is listed ...
1
vote
0answers
81 views

Consequences of disabling SSL2 and SSL3 on our webserver [migrated]

Our system is quite old and as a result gets an F grade for SSL from Qualsys SSL because the server supports SSL2 and SSl3. We have now identified all the browsers people are using. The oldest is ...
3
votes
4answers
122 views

Do search engines give searcher's IP address to sites that come up in search? [closed]

Ok so for example, I search "stackexchange" and a bunch of pages come up in the search result - of course most of them from this very site, and many other ones talking about stackexchange. Would this ...
2
votes
1answer
51 views

Click to play plugins vs. AdBlock?

Reading through articles like Faked Flash-based ads... I'm wondering what is a better way to keep yourself safe from malvertising. Many people suggest setting your browser's plugin settings to "Click ...
2
votes
2answers
94 views

Foolproof way to hide your IP when browsing [closed]

is there a fool proof-ish way to hide your IP from websites you visit? I heard even if you use VPN, there can be 'leaks'? And one step more secure is Anonymizer or Tor? Can they have 'leaks', too? ...
2
votes
0answers
61 views

How to get directly to text versions of Google cached pages [closed]

http://navigators.com/cached.html According to the bottom of that site, it seems the easiest way to view websites without giving them your IP is: "Edit the heck out" of google URLs like this: ...
2
votes
1answer
42 views

Does visiting cached pages disclose my IP address to site admin? [closed]

I know it discloses my IP to Google, but is my IP also disclosed to the owner of the site of which Google made cached pages that I'm looking at? And how about anything I do within the cached page - ...
16
votes
4answers
6k views

Should sensitive data ever be passed in the query string?

Should sensitive data ever be passed via the query string as opposed to the postback? I realize that the query string will be encrypted, but are there other reasons to avoid passing data in the ...
3
votes
2answers
110 views

Payment form from http is secure? [closed]

There are lot of payment gateways (Worldpay, PayPal, ..) offering easy integration, when the plain webpage using URL redirection to the payment page. HTTPS (worldpay,paypal), where the user posts his ...
5
votes
4answers
2k views

What is a good browser for web application pen testing? [closed]

I am getting started in testing web applications, and I am having trouble verifying vulnerabilities. It seems all modern browsers have protections against things like XSS. When something like Burp ...
1
vote
3answers
220 views

Benefit to disabling TLS1.1 and TLS1.2?

In light of recent developments on SSL issues such as BEAST and POODLE, I decided to configure my browser to only allow TLS1.1 and higher. The trouble is, that I am finding a lot of websites which do ...
-1
votes
1answer
67 views

What are the heuristics for a malicious url? [closed]

I know that there is nothing like a safe website ,any website which is safe today could be hacked and its visitors could be served with latest malware. What I'm curious about is what checks can we ...
5
votes
4answers
5k views

How to avoid leaving any local trace that I went to a website?

I want to visit a web site, but I want to ensure there is no trace left on my computer that I did so. How do I do that? This question is not concerned with anonymity or detection on the network ...
24
votes
2answers
3k views

Does browser 'view-source' mode avoid scripting attacks?

Let's say there's a URL www.badjs.com which is untrusted and may contain bad scripts. Intuitively, a view-source navigation to that URL does not execute any scripts so it should be safe. It would at ...
12
votes
2answers
674 views

Why does rfc6797 say “An HSTS Host MUST NOT include the STS header field in HTTP responses over non-secure transport.”

Why does the RFC prohibit the server from sending HSTS to the client over HTTP? I can see that if a HTTP client responds to that unsecure HTTP response it might cause that site to be inaccessible ...