A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

learn more… | top users | synonyms (2)

1
vote
2answers
389 views

Prevent a page from appearing in browser's history

I have inherited an ASP website where sensitive data was passed in the query string as part of the URL. Something like this: www.example.Com/Test?details=Username&moreDetails=blahblah If we ...
14
votes
1answer
164 views

Preventing a site from appearing in the 'Most Visited' or 'speed dial' section of a web browser

Are there any established ways of preventing a website from appearing as an icon on the 'Most Visited' / 'Speed dial' / start page of a web browser? One example of this is the tab that opens by ...
4
votes
2answers
501 views

Did XSS reach its end-of-life with the introduction of the HTTP X-XSS-Protection header?

With the introduction of the HTTP X-XSS-Protection header it seems to me that the vulnerability impact (read: amount of possibly affected users with modern browsers) is drastically reduced. Firstly, ...
0
votes
1answer
22 views

How can I determine the common cryptographic suites I need to enable on my browser for common websites?

How do I determine the common cryptographic suites I need to enable on my browsers (I use IE11, Firefox/Nightly 49, Chrome 51) running on Windows for common websites, for eg, www.google.com, www.w3....
7
votes
2answers
357 views

Can viruses access passwords that have been saved by a browser?

Say I use Chrome on a new computer to log in to a website, and I select the option to have the browser remember the password. Then I download a straight-up smorgasbord of viruses of every kind. Can ...
1
vote
1answer
32 views

Is Displaying Image on Profiles by URL is Security Implication?

I am Developing a Web Application Currently, in which users can Make a Profile and Fill out the User's information, In this i have also kept a Section for Profile Picture, in that i have used a logic ...
3
votes
2answers
68 views

Do the most used browsers have similar security?

I read that Pwn2Own stopped attacking Firefox, apparently because it didn't make "serious security improvements" since the last competition. Should I understand it as "Firefox is significantly more ...
5
votes
2answers
82 views

Passive fingerprinting of HTTPS client

Is it possible to passively fingerprint a HTTPS client, based solely on data visible to a network eavesdropper? In other words, consider a network monitoring box that can see all the packets (but ...
0
votes
0answers
29 views

Java Exploits - Not using the browser plugin

I'm looking for examples of Java exploits that do not leverage the Java browser plug-in/Browser applet to run. For example: Drive-by downloads that download a Java file that is run by the JRE but ...
0
votes
3answers
3k views

Is my WiFi and computer hacked?

Yesterday, I woke my computer up from sleep mode (it had been on all day while I was at work). And my browser was open to an email account that was not mine. Is it possible that someone hacked my ...
8
votes
2answers
107 views

Why do browsers send such detailed user agent strings?

Modern web browsers leak a ridiculous amount of information through the User-Agent header. The following is an example for Safari on iPad, from Wikipedia: Mozilla/5.0 (iPad; U; CPU OS 3_2_1 like Mac ...
5
votes
1answer
254 views

Is WebRTC still leaking my IP addresses in incognito or private browsing mode?

WebRTC can leak your private IP address, even though you are using a VPN, from what I learn here. Am I protected against this information leak affecting my privacy, when I'm using the incognito or ...
7
votes
1answer
1k views

How to make Firefox ignore the X-XSS-Protection response header?

I have two questions: How can I make Firefox ignore the X-XSS-Protection header? I have a website which sends an X-XSS-Protection: 1 header and I want my Firefox to ignore that header, because it ...
1
vote
1answer
52 views

Why do browsers not protect against scripts coming with images?

I understand that this is how it goes: Malformed Image --> Buffer Overrun --> Stack Over Flow --> Execute Malware Pushed On Stack And though I don't a huge amount about this, I know that I ...
0
votes
1answer
66 views

Is it safe to send the user's encrypted password back to them in the browser? Why?

I have planned to send the encrypted password from the application back to the user. I am currently using AES to encrypt user passwords. I want to send the user's encrypted password back to them in ...
4
votes
1answer
98 views

Risks of HTML/JavaScript window.opener security flaw?

I do not know if you are aware of this flaw, but here is a basic example: somepage.html (pointing to malicious.html): <!DOCTYPE html> <html> <head> <meta charset="utf-8"> ...
1
vote
2answers
85 views

Can I trust browsers not to snoop into my activities?

Is there anything stopping web browsers from snooping into our activities? I don't mean web history or any of that generic stuff (Chrome already collects them, right?), but is it technically possible ...
10
votes
3answers
8k views

CSRF cookie vs session based tokens

I will generate a CSRF token and include it in a hidden form field. When receiving the request, I will check the form value against the value either stored in the user's session or in a cookie. Is it ...
0
votes
1answer
93 views

Is WebRTC safe for connecting random clients to each other?

I am trying to implement a chatroulette-sque app, and WebRTC seems to be the best choice as far implementing something that doesn't take a vast amount of server resources. My current scheme is to ...
-1
votes
1answer
75 views

What to do after exposure to a drive-by infection?

I clicked on a link that pretty clearly offered exposure to a drive-by infection. I won't post the link itself, but I got it from a link which is inside a reddit link (obviously the reddit website ...
1
vote
1answer
97 views

Standard for securing web server to client connections via HTTPS on the local area network

I am trying to set up some kind of secure client to web server connection that takes place entirely on local area networks, but I'm having trouble understanding what the recommended best practice is. ...
5
votes
3answers
53 views

When testing out security vulnerabilities on sites such as OWASP Projects, should we be in a secured/protected environment?

I was curious if there is any need to secure/protect ourselves when doing projects on sites like OWASP to learn about vulnerabilities or "Wargames/Challenges" such as what's posted in these links How ...
2
votes
1answer
65 views

What is vulnerable in this comprehensive browser setup to avoid fingerprinting/tracking?

What is vulnerable in this browser setup to avoid fingerprinting/tracking for general browsing that is still easy to use? The setup is as follows: Firefox on my personal machine with several ...
6
votes
3answers
2k views

Isn't HTTPS insecure over a hacked router? [duplicate]

I have heard that a hacker can become a proxy using the router your device is connected to and send his own public key to you instead of you getting the server's public key - which the browser will ...
1
vote
1answer
67 views

Browsers and SSLv3 End-of-Life

Is there a point in time at which browsers will refuse to connect to web servers that support SSLv3 in addition to TLS 1.0/1.1/1.2? Will they produce warnings? I assume the browser would be content ...
12
votes
4answers
9k views

Do I really need all these Certificate Authorities in my browser or in my keychain?

There are lots of strange looking Certificate Authorities in my keychain as well as Firefox. I am sure they are legitimate CAs (as they are the same on my Mac and PC and other computers I checked). ...
3
votes
1answer
53 views

How can a modern Windows/Linux system be compromised by a heap overflow in Chrome?

Wikipedia's article on Heap Overflow states: there are primarily three ways to protect against heap overflows. Several modern operating systems such as Windows and Linux provide some ...
2
votes
3answers
142 views

Is it possible for a virus to be downloaded unknowingly and run when a website is opened?

Usually, the only time I see viruses happen is when someone mistakenly runs an infected file. But could one also be infected by just visiting a website?
3
votes
2answers
92 views

Should I use websockets (ws) or secure websockets (wss) for my game?

I'm making a game and I'm using websockets for 99% of communication. The only http(s) is on initial page load and when logging in/registering. I'm a complete noob so correct me if I'm wrong, but SSL ...
7
votes
1answer
6k views

Is it safe to give an Oauth token to client side javascript so it can directly make requests to a server?

I currently have a simple backbone.js application served from my domain (example.com), which is provided an Oauth token. Specifically, I pass the Oauth token through my page template into the ...
5
votes
1answer
53 views

Why don't web templating frameworks HTML escape all data by default?

I recently discovered an XSS vulnerability in an application that uses JSP to render pages. The vulnerable code in the JSP was something like this: <td>${customer.notes}</td> It was ...
0
votes
2answers
94 views

Can I get malware just by navigating to a webpage? [duplicate]

Is going to a webpage a risk per se? If yes, how does work, and how can we defend ourselves from this? I have to constantly review websites and I get the links from job seekers (that is, I'd navigate ...
1
vote
1answer
93 views

Why does Chrome send four browsers in the user-agent header?

I am using Chrome in linux with Version 51.0.2704.63 (64-bit). I recorded a HTTP request of Chrome and here is part of the recording: User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (...
1
vote
2answers
79 views

Is Stegosploit a real concern with modern browsers?

http://stegosploit.info/ I looking into having users upload their images directly to AWS S3 to save on costs (rather than going through a traditional server and re-encoded with mozjpeg), but this ...
0
votes
1answer
102 views

Why does Safari still support SSL 3?

The "POODLE" attack was made public in October, 2014. Why does Safari still support SSL 3.0 after POODLE showed it to be insecure?
0
votes
2answers
103 views

Malware or viruses by browser redirects?

Recently was browsing and clicked on a link to the following address: (In code blocks so you cant accidently click it) http://paycheck-calculator.org/ Clicking on this quickly loaded 2-3 different ...
1
vote
1answer
118 views

Firefox security certificate issues: FUD or truth?

I was doing a little reading over at gHacks, and came across this comment attributed to Joey Spinosa regarding certificates in Firefox: These certificates are installed automatically by the ...
4
votes
1answer
47 views

Do Social Network Mobile Apps Track Your Browsing?

Facebook are known to track you even after you have logged out of your Facebook account. With mobile apps being given permission to access so much information on the devices, is it possible for ...
1
vote
2answers
96 views

XSS vectors in img src and background-image url

I'm a little confused about XSS vulnerabilities when serving img.src and background url. From what I understand, the only way to execute javascript in this case, is to use javascript protocol. Let's ...
2
votes
1answer
225 views

Encrypting data before sending to SaaS tool and decrypting on browser view

I'd like to send data to a SaaS tool, where the data is stored in the cloud. I'll use Google Analytics as an example, but it applies to any similar service. Google Analytics does not allow you to ...
2
votes
1answer
72 views

Differences between Burp request and Browser - Has different responses

So I was put on an engagement over the last week and I found a potential XSS when using Burp's intruder/repeater. However, the strange thing that I noticed was that the response in Burp is different ...
2
votes
2answers
784 views

How do I verify, parse and process the results of the HTML5 keygen tag?

I'm investigating the HTML5 attribute Keygen and discovered that it sends this data on a Form POST to the server. Here is an example POST: ...
5
votes
1answer
95 views

Is the native sandbox of Chrome and Firefox enough or would SELinux improve its security?

Chrome on Windows and Linux and Firefox on Windows are executed in a sandbox. On Linux, is the Chrome sandbox enough or would we gain security if we use SELinux to protect the Chrome execution? I ...
0
votes
1answer
61 views

Virus Warning after clicking on a Google search results link

When researching a high school project on the guillotine, my daughter googled: quillotine quotes One of the top results was: topfamousquotes.com/quotes-about-guillotine/ Apparently she ...
1
vote
1answer
65 views

XSS Page Cannot be Displayed

When I try XSS on various websites, such as inserting " onmouseover="alert(1) in a search box, I either get a message saying You don't have permission to access this page or This page cannot be ...
2
votes
5answers
76 views

Is it beneficial to run the browser from a different user account for personal devices?

On Linux, when launching the browser does it help security if I don't run it from my main user (not root, but still has my personal information in it) as follows: su FirefoxUserName -c 'firefox' ...
44
votes
5answers
11k views

How to fight browser fingerprinting?

https://panopticlick.eff.org/ , aka "How unique and trackable is your browser". For example it usually gives me a unique score. The biggest entropy values come from navigator.plugins and fonts via ...
5
votes
1answer
496 views

Regarding Windows password and Chrome's 'Remember password' Feature

Google Chrome browser helps in password management by prompting users to remember their passwords for the websites. These saved passwords can be accessed from the browsers "settings" menu, and to do ...
21
votes
4answers
12k views

Should sensitive data ever be passed in the query string?

Should sensitive data ever be passed via the query string as opposed to the postback? I realize that the query string will be encrypted, but are there other reasons to avoid passing data in the ...
4
votes
3answers
2k views

GET and POST request vulnerable to CSRF attack?

Are both GET and POST request vulnerable to CSRF? Should we use PUT instead?