The tag has no usage guidance.

learn more… | top users | synonyms

3
votes
3answers
105 views

How to transfer a database of usernames and passwords to a friend

Caveat: I basically know nothing about information security, so I apologize in advance. I'll try to keep the question as general as possible. I have a website X over which I have administrator ...
1
vote
2answers
71 views

Who do I inform when a website is compromised

I often receive phishing emails claiming to be big companies like PayPal. When I check the link I remove anything which could be used to confirm that it was me who clicked and open the link in a ...
4
votes
3answers
188 views

why is thepiratebay.se listed as deceptive site in Chrome and other browsers

Why is thepiratebay.se listed as deceptive site in Chrome and other browsers? My Norton says nothing about fishing or malware. There is no doubt that some organisations doesn't like thepiratebay but ...
2
votes
2answers
67 views

What could a malicious website do if you don't update Adobe Flash?

If you click on "Activate Adobe Flash" when Firefox warns that "this plugin is vulnerable and should be updated", you can still use Adobe Flash. What could a website do to you if the "plugin is ...
0
votes
0answers
52 views

Benefits/negatives of password-less authentication

I am facing the following dilemma: I have a client who has a very basic admin panel, he uses this once or twice a week and cannot do much, mainly update content and add products. Currently, the ...
3
votes
0answers
57 views

Is an application backend expected to potentially log sensitive customer data when in debug mode?

As I am working on a website that asks customers to enter data such as their name, address, phone number, obviously customer data that needs to be protected. I do my best to not log such data ...
1
vote
1answer
26 views

Securing Web Contact Forms Against Spams

I created a web contact from with the following restrictions: An IP can send only 1 query per 8 hours. A generic text based bootstrap captcha for the form (I know this can be replaced with ...
0
votes
1answer
29 views

What patterns or practices exist to protect users from site admins deleting the user's information?

Here's my situation: Say you run a service online that stores information that users of the service would want to keep for a long time. This information could be notes, files, etc. but it is ...
24
votes
5answers
3k views

How can I safely check whether an email link leads to a malicious website?

Over the last few weeks, I've gotten several spam emails from different friends that only contained links to different websites. I would like to click on those links and see what's on the website. ...
2
votes
1answer
84 views

Website link shows a code variable

A website I frequently visit is showing an error message. The usual Click 'here' link actually shows Click '$host_variable.xxxxxxName' to navigate to a certain page. Is it a security flaw? ...
1
vote
1answer
77 views

School website exposes root FS, where to report?

I was googling for some PCI device code and stumbled upon an indexed /sys file on a web server. Poking around a bit, it seems that the complete root filesystem is exposed trough /uploads/ls. So I can ...
5
votes
2answers
284 views

Website login using database credentials

Is it secure to login to a website by using database usernames, for each user? Is it a bad practice? What can be the issues? The idea is to create the users and permissions at database level. EDIT: ...
16
votes
2answers
3k views

Website security - should I hire a developer? [closed]

I'm going to create a new website with Joomla! 3. Potentially, this site will get me some money through ads but I'm a little worried about what could be done to attack it. I say a little because I'm ...
114
votes
2answers
9k views

I found unknown PHP code on my server. How do I de-obfuscate the code?

We've been getting a lot of noise regarding hacked PHP files here, and it's taking a lot of time to answer these questions. In many cases, they are off-topic. We've had a discussion about this on ...
1
vote
2answers
182 views

IMEI.info knows my phone before I put sim

Recently I brought a Moto G3 turbo phone, which I suspect is a factory reset by a seller from other customer, and dispatched to me. I search net for getting in if its factory reset, but non tricks ...
1
vote
2answers
112 views

I unknowingly visited a hacked site, what are my next steps?

I stumbled onto a hacked site a short while ago. Firefox blocked Flash from running, but are there any other vectors I should be concerned about? I'm pretty sure I had an account on the forum in ...
-1
votes
1answer
90 views

Does the page that links to my login page need to https?

So I realise the login ajax call must be https, and the page that ajax call is made from should also be https to prevent a man in the middle potentially changing the page and changing the form that ...
7
votes
2answers
122 views

Is PCI-DSS Compliance Required with PayPal Donate/Payment Buttons on Websites?

Reading about PCI-DSS 3 recently: Would like confirmation what I am interpreting here - you need PCI-DSS SAQ-A to have credit card associated payment or donation URL links on a merchant's website? ...
1
vote
2answers
85 views

Find unlisted web pages on a site? [duplicate]

If I have a website with an index.html page that was just a landing page with no other links, and I also have another html page hosted on the same domain that has no links to it, is there any way ...
3
votes
1answer
82 views

Could somebody explain how the ASDA site is vulnerable?

I'm sure many of you will have seen the CSRF exploit highlighted by Paul Moore that ASDA have known about for two years (Paul's blog) I am trying to find an explanation as to WHY the website is ...
1
vote
1answer
75 views

Unauthorized access to a page - when or if you should return 401 HTTP status code

When a user requests a page that they don't have access to; should you return a 401 HTTP status code and a page to notify the user. In the past I have worked under the idea thats bad practice, as ...
0
votes
2answers
53 views

Are third party authentification provider included via iframe by default considered (in)secure?

Authentification provider X is used by many non-related websites like A, B and C as (sole) authentification provider. X therefor provides a framework for athentification which includes a login form ...
5
votes
1answer
300 views

The Peer-To-Peer Web

Good Morning Guys, I'm currently looking into the Project Maelstorm (BitTorrent Peer-To-Peer Web Browser Project), and a question popped up in mind. When on a P2P network, users share the file which ...
4
votes
2answers
86 views

Using identifiers in URLs to authenticate users

Someone I know is registered on a community website where they can exchange messages etc. Taking a look at the email notification they receive when something new has been posted, contains an image ...
0
votes
0answers
33 views

Where can I find a dataset of URLs of websites that diffuse malware? [duplicate]

In order to study some malware detection algorithms I am developping in my PhD, I would like to know where I could download a list of malware websites. Thank you
1
vote
0answers
43 views

Few sites are shown as Certificate is obsolete in Chrome(https is struck off). But they're marked as green in IE [duplicate]

For example, for few sites the 'https' part of website is when loaded through Chrome (installed in workplace) states that the connection is certified but it also states that the resources in the page ...
0
votes
3answers
108 views

Why are websites obviously run for nefarious reasons not taken offline asap?

Although the question has a much broader scope an example case is my posted question: Should I worry if I have tried to ssh into a 'fake' dyndns.org site? (with ssh keys) In summary the ...
2
votes
2answers
177 views

Are people trying to hack my website?

On my website I added a little function, that logs IP, client/browser information, path, and a time stamp. Today I checked my database, and I had a lot of weird requests. Here are a few of them: ...
1
vote
1answer
89 views

How to add a malicious file scanner to live server?

One of my WordPress websites recently got hacked, and I had to download the full website to my local PC and clean it. As soon as I downloaded the website, my antivirus software found the malicious ...
-1
votes
2answers
103 views

Is it dangerous to interrupt session on a web-site?

For example if I just close page or browser or anything else (without clicking "log out" on a site) - can this somehow endanger my account (info leaking or illegal access to an account) ?
0
votes
1answer
32 views

CDN information [closed]

If I have a website that is content based, and the web server accesses a CMS to determine what to display on the site for a particular page. This is not particularly fast and it requires computing ...
1
vote
2answers
82 views

Problems with the security certificate

On my phone when I try and access my regular websites, I get the error message " there are problems with the security certificate of this website". More often than not I still proceed onto the ...
0
votes
2answers
185 views

Malicious favicon icon?

Is it possible for a favicon icon to be malicious so that you get the virus by just looking at the icon in the search results of a search engine like DuckDuckGo that displays the favicon icons for all ...
0
votes
2answers
1k views

Browsing file/directory structure of a website

I want to know whether can we browse file/directory structure of any website. If yes, then how? If no, why can't we?
0
votes
2answers
87 views

Test registration form using brute force

I need to test if my website registration form can have problems with brute force attacks, because this form requires an invite code. Is there any tool for this kind of test?
2
votes
3answers
95 views

Site hack with email phishing scam [closed]

We have a small business website that has been compromised. They are somehow getting customers order details and contacting them requesting their credit card details. We have had our web team and a ...
1
vote
2answers
1k views

How secure is CodeIgniter 3.x?

How secure is the CodeIgniter 3.x framework? I have read that people discourage usage of CodeIgniter because it is unsafe. The problem is: These posts are old and is mainly pointed to the 2.x versions ...
5
votes
1answer
153 views

Are there cases where malicious scripts on websites breached the sandbox of a browser so that files on the user's computer could be accessed?

Whenever a hosted script on a website tries to access a file on a user's computer the sandbox prevents it, but has there been any documented case where this sandbox obstacle was somehow overcome by ...
4
votes
2answers
298 views

How to trace source of clickjacking attack within a website using developer tools?

When surfing a popular Wordpress website on my mobile, clicking on a link to an article within would sometimes open a new window to a malicious website or launch the Apps Store. I am interested to ...
2
votes
2answers
127 views

Are there any ways to defraud a fundraising site?

I have developed a many e-commerce stores for clients over the years; almost all of them selling physical products. Recently, one client in particular was repeatedly getting hit with fraudulent ...
2
votes
2answers
209 views

How does web site defacement monitoring actually work?

I wish to outsource a web site defacement monitoring services to a third party and am wondering how does this type of monitoring work? If my front page has a lot of dynamic components, eg image ...
-5
votes
2answers
170 views

How do i make a phone number authetication system for my website? [closed]

I really need to prevent users from create multiple accounts. So I was thinking about making a phone number authentication system. Where when a user signs up, a 4 digit code is sent to their phone, ...
1
vote
1answer
57 views

Should I show the security answer when the user goes back to edit the field?

So when a user signs up to create an account, they are required to select select questions and enter security answers. Once they do that, they can proceed forward to a review page that shows them the ...
0
votes
2answers
144 views

Faking IP address without being aware of returning response

I read different articles on the subject (Spoofing IP address), someone said: Spoofing an IP is usually better suited to "fire-an-forget" scenarios like DDoS. due to TCP two-way communication ...
0
votes
1answer
1k views

Defeating Browser Fingerprinting by spoofing the browser user agent and VPN

I don't want any website to identify me and to know what is my geographical location. As far as a website is concerned, I am always a new visitor who never visits it prior. If I leave the website, ...
1
vote
3answers
853 views

Can websites tell whether that I am visiting them using the same device?

Assuming that I am browsing a website ( say: Amazon.com) using Private/Incognito mode, and I clear my cookies, and have VPN turn on. Will the website still be able to identify that my device has been ...
0
votes
1answer
65 views

What is a good risk assessment for different types of online file references?

Personally I'm a big fan of hosting everything myself, just because of the privacy aspect. For that reason I try to use external files as least as possible. Nevertheless, I'm wondering if it is a ...
0
votes
1answer
136 views

Website using http and https

Is there any method to know whether a website is https only or uses http webpages as well?Can it be done without using browsers cache?
8
votes
1answer
2k views

Security of IFTTT

IFTTT looks like a powerful service but I'm also highly sceptical of its security. Could somebody give me a brief rundown of how you think it works and what the security implications are please? I've ...
0
votes
1answer
549 views

Is this a website hacking attempt, and if so, what is it trying to achieve?

I've recently seen a few strange requests made on our site, I'm wondering what they might be. Normally we get sql injection attempts like this: ...