A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

learn more… | top users | synonyms (2)

2
votes
3answers
35 views

Can freezing the browser be considered a security vulnerability?

If I can write a client script (a piece of JavaScript code) that can freeze the entire browser, a force quit/kill being mandatory, is that considered a security issue? If so, what's the type of this ...
5
votes
1answer
717 views

How make Firefox ignore X-XSS-Protection header from server?

I have two questions: 1)How can I make Firefox ignore X-XSS-Protection header? I have a website which sends X-XSS-Protection: 1 header and I want my Firefox to ignore that header, because it destroys ...
2
votes
2answers
122 views

Suspicious Network Activity - is my system compromised?

When using Firefox to open a blank page, I have a weird network connection that shows under Network Activity in Resource Monitor (Windows 7). The address is: insiders-guide.pacedev.com. A ...
3
votes
1answer
42 views

Can canvas fingerprinting be prevented?

How can canvas fingerprinting be prevented in web browsers? The site Panopticlick said I had a hash of WebGL fingerprint of 5 bits of entropy. I installed CanvasBlocker addon and tested again and it ...
3
votes
2answers
87 views

Preventing Browser from BeEF Exploitation

BeEF is a great exploitation Browser based tool. But in some cases, unknowingly people get Hooked due to beef when it's hook.js is kept in Invisible Iframe of an HTML source. So How, can we detect ...
22
votes
3answers
4k views

Is it possible to transfer a virus through browser video?

I know that there is already a question related to viruses in videos, but the implication in the other question is that videos in question have been downloaded and played by media software on the ...
2
votes
1answer
209 views

Encrypting data before sending to SaaS tool and decrypting on browser view

I'd like to send data to a SaaS tool, where the data is stored in the cloud. I'll use Google Analytics as an example, but it applies to any similar service. Google Analytics does not allow you to ...
0
votes
2answers
101 views

How secure is “Browser in the Box”?

I'm wondering how secure is "browser in the box" from Sirrix? They said in their official website: In contrast to simple sandboxing methods provided by standard browsers "Browser in the Box" ...
2
votes
1answer
53 views

Differences between Burp request and Browser - Has different responses

So I was put on an engagement over the last week and I found a potential XSS when using Burp's intruder/repeater. However, the strange thing that I noticed was that the response in Burp is different ...
38
votes
8answers
10k views

Why do browsers default to http: and not https: for typed in URLs? [duplicate]

When I type example.com without any scheme into the browser bar and press Enter it is interpreted as HTTP://example.com, not HTTPS://example.com. Why? And where are the plans to fix this? (To be ...
35
votes
10answers
11k views

Is anybody using client browser certificates?

Client browser certificates seem to be a nice way to protect sites from intruders - it is impossible to guess and should be harder to steal. Of course, they do not solve all the problems, but they add ...
3
votes
1answer
34 views

What security implications does DNS prefetching have?

To improve performance, most browsers prefetch DNS records for linked resources in the background so that the browsers already knows where to send the request the instance you click the link. This is ...
4
votes
3answers
90 views

Could Google Chrome's lack of a download confirmation dialog be a security vulnerability?

Suppose the user is playing a game like flappy bird that requires constant tapping in the lower left area of the screen (where the downloaded file needs to be clicked). Then while the user is ...
2
votes
2answers
1k views

How to hide real IP from browsers while using VPN?

You probably know that even when you use a VPN service, browsers like Chrome and Safari can still somehow provide your real location to Google Maps etc (if you give it a permission). My question is: ...
0
votes
0answers
30 views

Can a virus execute without user interaction? [duplicate]

I have seen a lot of malware infection techniques where the user is infected by drive by downloads through browser vulnerabilities or social engineering. But is there a way that a virus could execute ...
12
votes
4answers
8k views

How does BeEF work? (working understanding)

I have recently come across the BeEF- a browser exploitation tool. In most of the articles, it is said time and again that it is developed for research and pen test purposes! Has anyone worked with ...
2
votes
0answers
42 views

Configuring Chrome to handle ETags like Safari

ETags can be used for tracking, but I happened to notice that Safari handles them differently from Chrome (and Firefox). I believe it's non-standard because it doesn't work across domains. If we ...
2
votes
2answers
45 views

Protect against virus and malware attacks from website ads with iptables

Lots of websites spread malware by publishing advertisements that distribute malware. Even YouTube's ad network has been compromised in the past. Browser ad blockers and related plugins have there own ...
17
votes
4answers
11k views

Is WebGL a security concern?

Is WebGL a potential security problem due to the low level access it provides? For example, a web page can attempt to compile and run any shader source it wants. It seems that security would ...
0
votes
1answer
50 views

Why do some websites tell you they use cookies? [closed]

I often visit websites that have a small box telling me that they use cookies. Most sites just store cookies and don't say anything. Is there a reason that some do and others don't? For example:
1
vote
1answer
61 views

Why does Safari still support SSL 3?

The "POODLE" attack was made public in October, 2014. Why does Safari still support SSL 3.0 after POODLE showed it to be insecure?
3
votes
0answers
56 views

Secure a server on `localhost` such that only the authorized users can connect

Consider an application (such as an IPython notebook) that runs an HTTP server, and that (by design!) allows arbitrary code execution by authenticated users (this is the entire point of IPython, ...
4
votes
2answers
174 views

How do I protect my passwords from WebBrowserPassView?

I just got shocked with what can be achieved with WebBrowserPassView. It basically shows every password I've saved in my browser (Chrome). I guess other users on my PC could get my passwords that ...
0
votes
1answer
31 views

Alternative to Avast Safezone for banking

Apparently low level keyloggers etc can intercept typed details before Safezone keylogging protection kicks in. Would BD Safepay avoid this problem with its enforced virtual keyboard ? Or perhaps ...
0
votes
1answer
54 views

Is WebRTC safe for connecting random clients to each other?

I am trying to implement a chatroulette-sque app, and WebRTC seems to be the best choice as far implementing something that doesn't take a vast amount of server resources. My current scheme is to ...
28
votes
3answers
119k views

How to determine if a browser is using an SSL or TLS connection?

I want to know whether my browser is using SSL or TLS connection if I see HTTPS. I want to know for IE, Firefox, Chrome and Safari. I want to know the protocol version.
6
votes
4answers
9k views

how can you inject malicious code into an innocent-looking URL?

I am learning about XSS attacks. Wikipedia says that in a non-persistent attack an attacker may provide an innocent-looking URL that "points to a trusted site but actually has an XSS vector." What ...
15
votes
5answers
2k views

What is the difference between http and https with a self-signed SSL certificate?

A colleague of mine has told me he doesn't see why there is a warning when visiting a HTTPS website with a self-signed certificate saying that the security may be compromised, but there is no warning ...
2
votes
1answer
28 views

Security Protocols for a Blog [closed]

What are some security protocols that I should be aware of when starting and running a personal blog? I am steering away from WordPress and will another hosting service. The blog will mainly just be ...
14
votes
4answers
2k views

Why do browsers warn about mixed content for images?

I'm dealing with a phpBB forum user who wants to set up SSL on their entire site to secure user credentials and "private" parts of the website. However, they want to preserve the traditional forum ...
-2
votes
1answer
76 views

Clicking a lot of website links in Google Maps, then sent through multiple URL redirects, and lastly to a page that made my laptop start beeping?

I was in Google maps clicking on all the website links listed in the side panel, looking at every website really fast. Note, they were all tattoo parlors. One of the links I clicked bounced me through ...
2
votes
2answers
67 views

Security feature: Preventing javascript from closing the window

The latest versions of most web browsers have implemented a feature to prevent javascript from closing current window or tab. Firefox window.close() method This method is only allowed to be ...
0
votes
2answers
1k views

Firefox vs. Chrome extensions: Which are---ceteris paribus---more secure?

As an 'extension' to earlier questions on this topic (for instance here and here), What makes Firefox extensions (appear) more secure than Chrome extensions? Do they just appear to be more secure, ...
1
vote
0answers
36 views

Have there been any known “in the wild” exploits of any Google Chrome (Android) 40.0.2214.89 vulnerabilities?

https://www.cvedetails.com/vulnerability-list/vendor_id-1224/product_id-15031/version_id-179594/Google-Chrome-40.0.2214.89.html I looked for any news about them and couldn't find anything. Anyone ...
94
votes
6answers
17k views

How much can I trust Tor?

How much can I depend on Tor for anonymity? Is it completely secure? My usage is limited to accessing Twitter and Wordpress. I am a political activist from India and I do not enjoy the freedom of ...
0
votes
2answers
57 views

Malware or viruses by browser redirects?

Recently was browsing and clicked on a link to the following address: (In code blocks so you cant accidently click it) http://paycheck-calculator.org/ Clicking on this quickly loaded 2-3 different ...
2
votes
1answer
62 views

Is JavaScript needed for browser code execution vulnerabilities?

Does JavaScript VM have to enabled in a vulnerable browser to exploit an arbitrary code execution bug? There is a number of bugs in borwsers that don't seem to involve JavaScript. For example, ...
25
votes
3answers
3k views

NoScript: How to determine which sites/scripts to whitelist?

NoScript is a great plug-in, both for security and for ad blocking. However, I've found it's not always easy to figure out what scripts need to be permitted on certain pages, to be able to use the ...
0
votes
2answers
251 views

What is Greasemonkey/Userscripts and how does it relate to IT Security?

I came across http://userscripts.org/ and learned that it is popular among web-users to install something called "Greasemonkey" to allow client side scripts to run. What are the benefits of ...
10
votes
1answer
11k views

Does Google Chrome protect against cross site scripting (XSS)?

In Firefox I've been using the NoScript extension to protect myself from certain kinds of malware attacks. NoScript is well known as a very powerful extension for Firefox and introduced protection ...
4
votes
3answers
662 views

Are there any addons that disable only some functionality of scripts?

Tor comes bundled with NoScript. Correct me if I'm wrong but that's because client sided scripts can determine the originating IP address regardless of who the traffic is passed through. But NoScript ...
2
votes
2answers
327 views

Is a browser with disabled scripts and disabled java enough against malware

Is a browser like Firefox with disabled scripts (for example via a plugin like no-script) and disabled Java enough to be protected against drive-by-malware from the internet. Of course this does not ...
15
votes
2answers
552 views

Alternatives to HTML's deprecated <keygen> for client certs?

The keygen tag is used to make browsers generate private keys and POST the resulting CSR to the server, which can then issue a certificate. It's now been deprecated, for rather stupid reasons but ...
-2
votes
1answer
2k views

How to recognize if someone using password Reminder Script [closed]

I have been trying to know what these so called Gmail hacking scripts actually does (just studying for some knowledge purpose) and one of such scripts is this, which seems beyond my knowledge: ...
25
votes
2answers
3k views

Does browser 'view-source' mode avoid scripting attacks?

Let's say there's a URL www.badjs.com which is untrusted and may contain bad scripts. Intuitively, a view-source navigation to that URL does not execute any scripts so it should be safe. It would at ...
0
votes
2answers
86 views

Is it possible to hide malicious code within/behind an image? [closed]

Is it possible to hide malicious code either within an image, or behind it as it is displayed on a webpage and then if the user saves this image, they actually are downloading the malicious code? ...
4
votes
2answers
99 views

Certificate Chain - intermediate and root certificate - installed required?

Recently I bought a SSL cert from comodo for my domain - orakoha.com After submitting the CSR etc, domain control verification etc, I am issued with a zip file containing 4 document which I believe ...
1
vote
1answer
49 views

Rightscorp Scaleable Copyright - How would they avoid making this a massive security risk?

I recently read an article about a new copyright protection system that RightsCorp America is trying to get ISPs to help implement. From the Article: “Single notices can be read and bypassed ...
3
votes
0answers
54 views

How safe is WebCryptoAPI these days?

The 1Password Tool (software) introduced the 1Password for Teams. Now I thought this is a great peace of Software. But now they can show Passwords in the Browser. They do say: We encrypt ...
2
votes
1answer
39 views

Malicious link? Apache?

I've got a link from spammer, the link is very strange, but after redirects I got the web page full of ads. Here is the link(doesn't require "http://"): ...