A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

learn more… | top users | synonyms (2)

6
votes
3answers
111 views

Passive fingerprinting of HTTPS client

Is it possible to passively fingerprint a HTTPS client, based solely on data visible to a network eavesdropper? In other words, consider a network monitoring box that can see all the packets (but ...
0
votes
0answers
13 views

Client side encryption over SSL

I need to handle hyper secure data collected from webforms on a site. I was thinking of using whole site SSL encryption with client side encryption of the forms data. Due to a higher than usual risk ...
2
votes
0answers
19 views

How does a website know my location? Checked with ipleaks and VPN seems to work correctly

Recently I have been using a VPN to watch a free web series available only in the US -- on a website called https://go90.com. Until a few days ago everything was running smoothly with just Hola VPN. ...
3
votes
2answers
52 views

How to trust root CA

When I download a browser such as Mozilla, it comes bundled with several root Certificates. How do I trust that these certificates are legitimate? How do I know that my download does not contain ...
3
votes
3answers
27 views

How does the same origin policy apply to two different windows of a browser?

One particular scenario I am interested in: If I a open one chrome browser window with --disable-web-security option, then SOP is disabled. Will this window be able to access data on websites opened ...
0
votes
0answers
38 views

I may have been compromised, now what?

How to trace and single out this Malware in Browser Extensions? Chrome/ Opera? I had installed the extension mentioned in the thread above. It contained Malware the redirected Java functions mainly. ...
1
vote
0answers
41 views

How secure is the native browser password autofill?

Safari, Chrome, Firefox, Edge, and IE all either have a suggest-password feature, or password archival feature. How secure are these passwords when stored on a computer? If replicated, how secure ...
0
votes
0answers
17 views

Risk from browser add-ons?, from external sources [duplicate]

Can a user agent switcher read my passwords? what if it is not mallicious but weak, could it be a faultline for others to hack me?
2
votes
1answer
54 views

Cross domain iframe security

How exploitable is a site listening to browser messages from anyone? I am working on a site where I have found some iframe issues. The case is that site A has an iframe of site B, and site A listens ...
2
votes
2answers
77 views

How to protect against clickjacking via pop-under windows?

Huang and Jackson described a method of clickjacking that does not rely on iframes, but on pop-under windows. Is this attack still relevant today, or is it prevented by pop-up blockers? Is there any ...
4
votes
1answer
122 views

Risks of HTML/JavaScript window.opener security flaw?

I do not know if you are aware of this flaw, but here is a basic example: somepage.html (pointing to malicious.html): <!DOCTYPE html> <html> <head> <meta charset="utf-8"> ...
0
votes
0answers
50 views

Comparison of security of PDFs on different platforms (web browser/adobe/android/iOS/mac) [closed]

There have been quite a few exploits of PDFs. Patches do claim to fix these exploits but what are the chances that PDFs are still widely used today as an exploit vector via zero-days? Of course, the ...
0
votes
1answer
104 views

Is WebRTC safe for connecting random clients to each other?

I am trying to implement a chatroulette-sque app, and WebRTC seems to be the best choice as far implementing something that doesn't take a vast amount of server resources. My current scheme is to ...
1
vote
1answer
119 views

Standard for securing web server to client connections via HTTPS on the local area network

I am trying to set up some kind of secure client to web server connection that takes place entirely on local area networks, but I'm having trouble understanding what the recommended best practice is. ...
-2
votes
1answer
44 views

is there any way to get the cookie from another tab or iframe's parent in browsers?

i was given a task to find a working way to bypass windows and android browsers same origin policy to be able to get the cookie of an open Tab in victim's browser (like Gmail or ... cookie). but as ...
0
votes
1answer
23 views

Beef conection timeout problem [closed]

I'm unable to get the connection back from the victim in beef framework when the victim clicks the beef exploitation link. Anyone know what I might be doing wrong?
5
votes
3answers
59 views

When testing out security vulnerabilities on sites such as OWASP Projects, should we be in a secured/protected environment?

I was curious if there is any need to secure/protect ourselves when doing projects on sites like OWASP to learn about vulnerabilities or "Wargames/Challenges" such as what's posted in these links How ...
0
votes
2answers
28 views

Why do SSL enabled sites don't reply back according to “hosts” file record?

I was playing with the hosts file under my linux distro. Added an entry 192.168.3.121 www.facebook.com in the /etc/hosts file. Created 2 servers which link to an index.html file at ports 80 ...
4
votes
2answers
2k views

Can cookies reveal my email address?

When I visit livescore.com, ten seconds later I receive marketing emails from gambling companies. If I don't visit this site, I don't receive these emails. Similar things happen when I visit Twitter ...
1
vote
1answer
35 views

How can I add my website to preload entries set of well-known browsers like Firefox or Chrome?

I have a website like https://www.example.com. I need to force all users visiting my site to use HTTPS connections. I thought about HSTS but I don't know how to add my site to the preload entries of ...
7
votes
2answers
438 views

Can viruses access passwords that have been saved by a browser?

Say I use Chrome on a new computer to log in to a website, and I select the option to have the browser remember the password. Then I download a straight-up smorgasbord of viruses of every kind. Can ...
0
votes
2answers
294 views

Chrome/ Opera continue to save & autofill passwords after installing LastPass? Good or bad? Enable/ Disable?

I started to use LastPass a few months ago and imported passwords from my browsers. Apparently, Google Chrome and Opera (based on Chromium) still pop-up the option to store passwords in my browser ...
5
votes
1answer
267 views

Is WebRTC still leaking my IP addresses in incognito or private browsing mode?

WebRTC can leak your private IP address, even though you are using a VPN, from what I learn here. Am I protected against this information leak affecting my privacy, when I'm using the incognito or ...
8
votes
3answers
608 views

How secure is HTTPS with weak ciphersuites?

Today I came across the website https://mtgox.com/, which claimed to be secure because of the Verisign certificate. I checked the certificate out of curiosity (it's the first thing they claim, let's ...
2
votes
1answer
171 views

How to enable ECDHE in openjdk-1.8.0 in CentOS 6.7?

I have seen many posts that hinted ECDHE is available in the SunEC provider way back in openjdk-1.6.0. My environment: CentOS 6.7 with openjdk 1.8.0.71-1.b15.el6_7. No ECDHE. Made 2 changes in jre/...
2
votes
4answers
1k views

Chrome Frame is an example of how browsers “merge together”. How can I unmerge all of them?

Chrome Frame is an add in that integrates with IE and Firefox. Firefox has a similar component, and I hear that the .NET runtime finds its way into all the other browsers. Additional integration ...
2
votes
2answers
138 views

Why does Safari still support SSL 3?

The "POODLE" attack was made public in October, 2014. Why does Safari still support SSL 3.0 after POODLE showed it to be insecure?
2
votes
1answer
241 views

Encrypting data before sending to SaaS tool and decrypting on browser view

I'd like to send data to a SaaS tool, where the data is stored in the cloud. I'll use Google Analytics as an example, but it applies to any similar service. Google Analytics does not allow you to ...
-1
votes
0answers
38 views

Browser change the IP addesses of the POST requests

On my work PC i have web server working on localhost for development purpose, i use vhosts to access the projects - example: mycompany.dev -> 127.0.0.1 In this project there is a protection against ...
3
votes
1answer
96 views

How secure is HTML5 web storage (sessionStorage and localStorage)?

As part of a Google Chrome extension that I'm building at the moment, I'm thinking of using either sessionStorage or localStorage to store some important user data. The extension's functionality ...
0
votes
0answers
37 views

Setting specific geoIP in Piratebrowser

I'm using Piratebrowser. In order to set a specific country's IP, I used the line ExitNodes {in} which is working. I'm getting an Indian IP in dnsleaktest, but my geolocation is getting a Japanese ...
8
votes
1answer
858 views

Child iFrame hash verification of parent iFrame content

Consider the following scenario: Alice wishes to browse Victor's website while on the job at Initech. Victor's website is hosted on an alternative domain name system to which Initech's DNS does not ...
8
votes
3answers
2k views

If I never want cross origin requests to be accepted, can I just ignore CORS?

The CORS spec states that if a request method and headers are not simple then a preflight HTTP OPTIONS request is sent to see if the request is allowed by the server. My server does not respond with ...
3
votes
2answers
92 views

Does displaying images on profiles by URL have security implications?

I am Developing a Web Application Currently, in which users can Make a Profile and Fill out the User's information, In this i have also kept a Section for Profile Picture, in that i have used a logic ...
7
votes
2answers
628 views

Did XSS reach its end-of-life with the introduction of the HTTP X-XSS-Protection header?

With the introduction of the HTTP X-XSS-Protection header it seems to me that the vulnerability impact (read: amount of possibly affected users with modern browsers) is drastically reduced. Firstly, ...
11
votes
2answers
197 views

Disable HTML5 battery features

HTML5 has a feature set relating to client battery status. It has been described as a privacy hole, as it can be used to track and identify web users. Research suggests the features can be used even ...
1
vote
2answers
399 views

Prevent a page from appearing in browser's history

I have inherited an ASP website where sensitive data was passed in the query string as part of the URL. Something like this: www.example.Com/Test?details=Username&moreDetails=blahblah If we ...
15
votes
1answer
184 views

Preventing a site from appearing in the 'Most Visited' or 'speed dial' section of a web browser

Are there any established ways of preventing a website from appearing as an icon on the 'Most Visited' / 'Speed dial' / start page of a web browser? One example of this is the tab that opens by ...
0
votes
1answer
23 views

How can I determine the common cryptographic suites I need to enable on my browser for common websites?

How do I determine the common cryptographic suites I need to enable on my browsers (I use IE11, Firefox/Nightly 49, Chrome 51) running on Windows for common websites, for eg, www.google.com, www.w3....
3
votes
2answers
91 views

Do the most used browsers have similar security?

I read that Pwn2Own stopped attacking Firefox, apparently because it didn't make "serious security improvements" since the last competition. Should I understand it as "Firefox is significantly more ...
0
votes
0answers
35 views

Java Exploits - Not using the browser plugin

I'm looking for examples of Java exploits that do not leverage the Java browser plug-in/Browser applet to run. For example: Drive-by downloads that download a Java file that is run by the JRE but ...
0
votes
3answers
3k views

Is my WiFi and computer hacked?

Yesterday, I woke my computer up from sleep mode (it had been on all day while I was at work). And my browser was open to an email account that was not mine. Is it possible that someone hacked my ...
8
votes
2answers
121 views

Why do browsers send such detailed user agent strings?

Modern web browsers leak a ridiculous amount of information through the User-Agent header. The following is an example for Safari on iPad, from Wikipedia: Mozilla/5.0 (iPad; U; CPU OS 3_2_1 like Mac ...
7
votes
1answer
2k views

How to make Firefox ignore the X-XSS-Protection response header?

I have two questions: How can I make Firefox ignore the X-XSS-Protection header? I have a website which sends an X-XSS-Protection: 1 header and I want my Firefox to ignore that header, because it ...
1
vote
1answer
59 views

Why do browsers not protect against scripts coming with images?

I understand that this is how it goes: Malformed Image --> Buffer Overrun --> Stack Over Flow --> Execute Malware Pushed On Stack And though I don't a huge amount about this, I know that I ...
0
votes
1answer
70 views

Is it safe to send the user's encrypted password back to them in the browser? Why?

I have planned to send the encrypted password from the application back to the user. I am currently using AES to encrypt user passwords. I want to send the user's encrypted password back to them in ...
1
vote
2answers
97 views

Can I trust browsers not to snoop into my activities?

Is there anything stopping web browsers from snooping into our activities? I don't mean web history or any of that generic stuff (Chrome already collects them, right?), but is it technically possible ...
10
votes
3answers
8k views

CSRF cookie vs session based tokens

I will generate a CSRF token and include it in a hidden form field. When receiving the request, I will check the form value against the value either stored in the user's session or in a cookie. Is it ...
-1
votes
1answer
77 views

What to do after exposure to a drive-by infection?

I clicked on a link that pretty clearly offered exposure to a drive-by infection. I won't post the link itself, but I got it from a link which is inside a reddit link (obviously the reddit website ...
2
votes
1answer
87 views

What is vulnerable in this comprehensive browser setup to avoid fingerprinting/tracking?

What is vulnerable in this browser setup to avoid fingerprinting/tracking for general browsing that is still easy to use? The setup is as follows: Firefox on my personal machine with several ...