The tag has no usage guidance.

learn more… | top users | synonyms

2
votes
2answers
67 views

What could a malicious website do if you don't update Adobe Flash?

If you click on "Activate Adobe Flash" when Firefox warns that "this plugin is vulnerable and should be updated", you can still use Adobe Flash. What could a website do to you if the "plugin is ...
0
votes
0answers
49 views

Benefits/negatives of password-less authentication

I am facing the following dilemma: I have a client who has a very basic admin panel, he uses this once or twice a week and cannot do much, mainly update content and add products. Currently, the ...
3
votes
0answers
51 views

Is an application backend expected to potentially log sensitive customer data when in debug mode?

As I am working on a website that asks customers to enter data such as their name, address, phone number, obviously customer data that needs to be protected. I do my best to not log such data ...
1
vote
1answer
26 views

Securing Web Contact Forms Against Spams

I created a web contact from with the following restrictions: An IP can send only 1 query per 8 hours. A generic text based bootstrap captcha for the form (I know this can be replaced with ...
0
votes
1answer
29 views

What patterns or practices exist to protect users from site admins deleting the user's information?

Here's my situation: Say you run a service online that stores information that users of the service would want to keep for a long time. This information could be notes, files, etc. but it is ...
24
votes
5answers
3k views

How can I safely check whether an email link leads to a malicious website?

Over the last few weeks, I've gotten several spam emails from different friends that only contained links to different websites. I would like to click on those links and see what's on the website. ...
2
votes
1answer
82 views

Website link shows a code variable

A website I frequently visit is showing an error message. The usual Click 'here' link actually shows Click '$host_variable.xxxxxxName' to navigate to a certain page. Is it a security flaw? ...
1
vote
1answer
76 views

School website exposes root FS, where to report?

I was googling for some PCI device code and stumbled upon an indexed /sys file on a web server. Poking around a bit, it seems that the complete root filesystem is exposed trough /uploads/ls. So I can ...
5
votes
2answers
273 views

Website login using database credentials

Is it secure to login to a website by using database usernames, for each user? Is it a bad practice? What can be the issues? The idea is to create the users and permissions at database level. EDIT: ...
16
votes
2answers
3k views

Website security - should I hire a developer? [closed]

I'm going to create a new website with Joomla! 3. Potentially, this site will get me some money through ads but I'm a little worried about what could be done to attack it. I say a little because I'm ...
114
votes
2answers
9k views

I found unknown PHP code on my server. How do I de-obfuscate the code?

We've been getting a lot of noise regarding hacked PHP files here, and it's taking a lot of time to answer these questions. In many cases, they are off-topic. We've had a discussion about this on ...
1
vote
2answers
164 views

IMEI.info knows my phone before I put sim

Recently I brought a Moto G3 turbo phone, which I suspect is a factory reset by a seller from other customer, and dispatched to me. I search net for getting in if its factory reset, but non tricks ...
1
vote
2answers
106 views

I unknowingly visited a hacked site, what are my next steps?

I stumbled onto a hacked site a short while ago. Firefox blocked Flash from running, but are there any other vectors I should be concerned about? I'm pretty sure I had an account on the forum in ...
-1
votes
1answer
89 views

Does the page that links to my login page need to https?

So I realise the login ajax call must be https, and the page that ajax call is made from should also be https to prevent a man in the middle potentially changing the page and changing the form that ...
7
votes
2answers
111 views

Is PCI-DSS Compliance Required with PayPal Donate/Payment Buttons on Websites?

Reading about PCI-DSS 3 recently: Would like confirmation what I am interpreting here - you need PCI-DSS SAQ-A to have credit card associated payment or donation URL links on a merchant's website? ...
1
vote
2answers
75 views

Find unlisted web pages on a site? [duplicate]

If I have a website with an index.html page that was just a landing page with no other links, and I also have another html page hosted on the same domain that has no links to it, is there any way ...
3
votes
1answer
79 views

Could somebody explain how the ASDA site is vulnerable?

I'm sure many of you will have seen the CSRF exploit highlighted by Paul Moore that ASDA have known about for two years (Paul's blog) I am trying to find an explanation as to WHY the website is ...
1
vote
1answer
64 views

Unauthorized access to a page - when or if you should return 401 HTTP status code

When a user requests a page that they don't have access to; should you return a 401 HTTP status code and a page to notify the user. In the past I have worked under the idea thats bad practice, as ...
0
votes
2answers
50 views

Are third party authentification provider included via iframe by default considered (in)secure?

Authentification provider X is used by many non-related websites like A, B and C as (sole) authentification provider. X therefor provides a framework for athentification which includes a login form ...
5
votes
1answer
300 views

The Peer-To-Peer Web

Good Morning Guys, I'm currently looking into the Project Maelstorm (BitTorrent Peer-To-Peer Web Browser Project), and a question popped up in mind. When on a P2P network, users share the file which ...
4
votes
2answers
84 views

Using identifiers in URLs to authenticate users

Someone I know is registered on a community website where they can exchange messages etc. Taking a look at the email notification they receive when something new has been posted, contains an image ...
0
votes
0answers
33 views

Where can I find a dataset of URLs of websites that diffuse malware? [duplicate]

In order to study some malware detection algorithms I am developping in my PhD, I would like to know where I could download a list of malware websites. Thank you
1
vote
0answers
41 views

Few sites are shown as Certificate is obsolete in Chrome(https is struck off). But they're marked as green in IE [duplicate]

For example, for few sites the 'https' part of website is when loaded through Chrome (installed in workplace) states that the connection is certified but it also states that the resources in the page ...
0
votes
3answers
105 views

Why are websites obviously run for nefarious reasons not taken offline asap?

Although the question has a much broader scope an example case is my posted question: Should I worry if I have tried to ssh into a 'fake' dyndns.org site? (with ssh keys) In summary the ...
2
votes
2answers
175 views

Are people trying to hack my website?

On my website I added a little function, that logs IP, client/browser information, path, and a time stamp. Today I checked my database, and I had a lot of weird requests. Here are a few of them: ...
1
vote
1answer
75 views

How to add a malicious file scanner to live server?

One of my WordPress websites recently got hacked, and I had to download the full website to my local PC and clean it. As soon as I downloaded the website, my antivirus software found the malicious ...
-1
votes
2answers
101 views

Is it dangerous to interrupt session on a web-site?

For example if I just close page or browser or anything else (without clicking "log out" on a site) - can this somehow endanger my account (info leaking or illegal access to an account) ?
0
votes
1answer
31 views

CDN information [closed]

If I have a website that is content based, and the web server accesses a CMS to determine what to display on the site for a particular page. This is not particularly fast and it requires computing ...
1
vote
2answers
81 views

Problems with the security certificate

On my phone when I try and access my regular websites, I get the error message " there are problems with the security certificate of this website". More often than not I still proceed onto the ...
0
votes
2answers
180 views

Malicious favicon icon?

Is it possible for a favicon icon to be malicious so that you get the virus by just looking at the icon in the search results of a search engine like DuckDuckGo that displays the favicon icons for all ...
0
votes
2answers
959 views

Browsing file/directory structure of a website

I want to know whether can we browse file/directory structure of any website. If yes, then how? If no, why can't we?
0
votes
2answers
87 views

Test registration form using brute force

I need to test if my website registration form can have problems with brute force attacks, because this form requires an invite code. Is there any tool for this kind of test?
2
votes
3answers
89 views

Site hack with email phishing scam [closed]

We have a small business website that has been compromised. They are somehow getting customers order details and contacting them requesting their credit card details. We have had our web team and a ...
1
vote
2answers
1k views

How secure is CodeIgniter 3.x?

How secure is the CodeIgniter 3.x framework? I have read that people discourage usage of CodeIgniter because it is unsafe. The problem is: These posts are old and is mainly pointed to the 2.x versions ...
5
votes
1answer
150 views

Are there cases where malicious scripts on websites breached the sandbox of a browser so that files on the user's computer could be accessed?

Whenever a hosted script on a website tries to access a file on a user's computer the sandbox prevents it, but has there been any documented case where this sandbox obstacle was somehow overcome by ...
4
votes
2answers
283 views

How to trace source of clickjacking attack within a website using developer tools?

When surfing a popular Wordpress website on my mobile, clicking on a link to an article within would sometimes open a new window to a malicious website or launch the Apps Store. I am interested to ...
2
votes
2answers
127 views

Are there any ways to defraud a fundraising site?

I have developed a many e-commerce stores for clients over the years; almost all of them selling physical products. Recently, one client in particular was repeatedly getting hit with fraudulent ...
2
votes
2answers
195 views

How does web site defacement monitoring actually work?

I wish to outsource a web site defacement monitoring services to a third party and am wondering how does this type of monitoring work? If my front page has a lot of dynamic components, eg image ...
-5
votes
2answers
163 views

How do i make a phone number authetication system for my website? [closed]

I really need to prevent users from create multiple accounts. So I was thinking about making a phone number authentication system. Where when a user signs up, a 4 digit code is sent to their phone, ...
1
vote
1answer
56 views

Should I show the security answer when the user goes back to edit the field?

So when a user signs up to create an account, they are required to select select questions and enter security answers. Once they do that, they can proceed forward to a review page that shows them the ...
0
votes
2answers
139 views

Faking IP address without being aware of returning response

I read different articles on the subject (Spoofing IP address), someone said: Spoofing an IP is usually better suited to "fire-an-forget" scenarios like DDoS. due to TCP two-way communication ...
0
votes
1answer
1k views

Defeating Browser Fingerprinting by spoofing the browser user agent and VPN

I don't want any website to identify me and to know what is my geographical location. As far as a website is concerned, I am always a new visitor who never visits it prior. If I leave the website, ...
1
vote
3answers
784 views

Can websites tell whether that I am visiting them using the same device?

Assuming that I am browsing a website ( say: Amazon.com) using Private/Incognito mode, and I clear my cookies, and have VPN turn on. Will the website still be able to identify that my device has been ...
0
votes
1answer
64 views

What is a good risk assessment for different types of online file references?

Personally I'm a big fan of hosting everything myself, just because of the privacy aspect. For that reason I try to use external files as least as possible. Nevertheless, I'm wondering if it is a ...
0
votes
1answer
131 views

Website using http and https

Is there any method to know whether a website is https only or uses http webpages as well?Can it be done without using browsers cache?
8
votes
1answer
2k views

Security of IFTTT

IFTTT looks like a powerful service but I'm also highly sceptical of its security. Could somebody give me a brief rundown of how you think it works and what the security implications are please? I've ...
0
votes
1answer
525 views

Is this a website hacking attempt, and if so, what is it trying to achieve?

I've recently seen a few strange requests made on our site, I'm wondering what they might be. Normally we get sql injection attempts like this: ...
39
votes
6answers
5k views

Is a website published in an obscure directory comparably secure to being placed behind a login? [duplicate]

Let's say I create a microsite for a client that contains confidential business information. We need to place this in a location the client can access, in order for them to approve for launch. If we ...
2
votes
1answer
73 views

What's the mechanism used to extract my user name on a website? [closed]

I was browsing this forum http://openelec.tv/forum/64-installation/40869-putting-openelec-onto-sd-card-using-usb-reader-from-a-mac-for-raspberry-pi ,and realised that they show my hostname and my ...
3
votes
1answer
125 views

Where to start , secure an AWS Ubuntu 14.04 [closed]

Ok so this is probably a basic question but I would like to expand my knowledge. I have created an AWS Ubuntu EC2 server. I am running software on the server that provides 2 services , firstly a ...