The tag has no usage guidance.

learn more… | top users | synonyms

2
votes
3answers
61 views

Site hack with email phishing scam [on hold]

We have a small business website that has been compromised. They are somehow getting customers order details and contacting them requesting their credit card details. We have had our web team and a ...
1
vote
2answers
53 views

How secure is CodeIgniter 3.x?

How secure is the CodeIgniter 3.x framework? I have read that people discourage usage of CodeIgniter because it is unsafe. The problem is: These posts are old and is mainly pointed to the 2.x versions ...
1
vote
0answers
39 views

Legality of scanning a site with SSLLabs SSL Server Test in order to find and report weaknesses [migrated]

I am wanting to scan a site (which I do not own) to see if they are vulnerable to anything like Heartbleed or the POODLE attack, not because I want to exploit any such vulnerabilities for malicious ...
5
votes
1answer
104 views

Are there cases where malicious scripts on websites breached the sandbox of a browser so that files on the user's computer could be accessed?

Whenever a hosted script on a website tries to access a file on a user's computer the sandbox prevents it, but has there been any documented case where this sandbox obstacle was somehow overcome by ...
2
votes
1answer
91 views

How to trace source of clickjacking attack within a website using developer tools?

When surfing a popular Wordpress website on my mobile, clicking on a link to an article within would sometimes open a new window to a malicious website or launch the Apps Store. I am interested to ...
2
votes
2answers
107 views

Are there any ways to defraud a fundraising site?

I have developed a many e-commerce stores for clients over the years; almost all of them selling physical products. Recently, one client in particular was repeatedly getting hit with fraudulent ...
2
votes
2answers
99 views

How does web site defacement monitoring actually work?

I wish to outsource a web site defacement monitoring services to a third party and am wondering how does this type of monitoring work? If my front page has a lot of dynamic components, eg image ...
-5
votes
2answers
83 views

How do i make a phone number authetication system for my website? [closed]

I really need to prevent users from create multiple accounts. So I was thinking about making a phone number authentication system. Where when a user signs up, a 4 digit code is sent to their phone, ...
1
vote
1answer
46 views

Should I show the security answer when the user goes back to edit the field?

So when a user signs up to create an account, they are required to select select questions and enter security answers. Once they do that, they can proceed forward to a review page that shows them the ...
0
votes
2answers
91 views

Faking IP address without being aware of returning response

I read different articles on the subject (Spoofing IP address), someone said: Spoofing an IP is usually better suited to "fire-an-forget" scenarios like DDoS. due to TCP two-way communication ...
0
votes
1answer
261 views

Defeating Browser Fingerprinting by spoofing the browser user agent and VPN

I don't want any website to identify me and to know what is my geographical location. As far as a website is concerned, I am always a new visitor who never visits it prior. If I leave the website, ...
1
vote
3answers
155 views

Can websites tell whether that I am visiting them using the same device?

Assuming that I am browsing a website ( say: Amazon.com) using Private/Incognito mode, and I clear my cookies, and have VPN turn on. Will the website still be able to identify that my device has been ...
0
votes
1answer
52 views

What is a good risk assessment for different types of online file references?

Personally I'm a big fan of hosting everything myself, just because of the privacy aspect. For that reason I try to use external files as least as possible. Nevertheless, I'm wondering if it is a ...
0
votes
2answers
90 views

Website using http and https

Is there any method to know whether a website is https only or uses http webpages as well?Can it be done without using browsers cache?
1
vote
1answer
335 views

Security of IFTTT

IFTTT looks like a powerful service but I'm also highly sceptical of its security. Could somebody give me a brief rundown of how you think it works and what the security implications are please? I've ...
0
votes
1answer
268 views

Is this a website hacking attempt, and if so, what is it trying to achieve?

I've recently seen a few strange requests made on our site, I'm wondering what they might be. Normally we get sql injection attempts like this: ...
37
votes
6answers
5k views

Is a website published in an obscure directory comparably secure to being placed behind a login? [duplicate]

Let's say I create a microsite for a client that contains confidential business information. We need to place this in a location the client can access, in order for them to approve for launch. If we ...
2
votes
1answer
64 views

What's the mechanism used to extract my user name on a website? [closed]

I was browsing this forum http://openelec.tv/forum/64-installation/40869-putting-openelec-onto-sd-card-using-usb-reader-from-a-mac-for-raspberry-pi ,and realised that they show my hostname and my ...
3
votes
1answer
60 views

Where to start , secure an AWS Ubuntu 14.04 [closed]

Ok so this is probably a basic question but I would like to expand my knowledge. I have created an AWS Ubuntu EC2 server. I am running software on the server that provides 2 services , firstly a ...
2
votes
3answers
153 views

How do anti-viruses identify malicious pages when JavaScript doesn't have access to the filesystem anyway?

Disclaimer : I am not very knowledgeable about the behaviour of anti-viruses (anti-viri?). I was wondering how they discern between malicious and non-malicious pages if all they can read is the HTML ...
0
votes
1answer
74 views

Website being probed from the Ukraine

I have a landing page setup for my business located at www.jdmxchange.com and have been getting some strange error logs from ELMAH. I apparently have users (or bots) in the Ukraine probing the hell ...
28
votes
2answers
3k views

I have registered a .com domain and received an e-mail from domainadmin.com

I have registered a .com domain and received an e-mail from domainadmin.com, it looks extremely like a phishing e-mail, but after a research I am ultimately confused whether this thing is legitimate ...
1
vote
1answer
158 views

Is it possible to redirect someone to a fake site without changing the hosts file?

Is it possible to redirect someone to a fake site without changing the hosts file? When I access a bank site, I receive a fake page. But my hosts file does not have any changes to do this. Is it ...
1
vote
0answers
135 views

rootkits subverting the windows kernel source code [closed]

I just purchased the book "rootkits: subverting the windows kernel" by Greg Hoglund and James Butler for a research project at work. However, this book constantly refers to the source code that can be ...
3
votes
3answers
625 views

External cross domain include script

One of my web application underwent a vulnerability assessment recently, and one of the findings is about cross domain include script. Our web app uses addthis_widget.js from AddThis to bookmark ...
0
votes
3answers
166 views

What is a good way to authenticate a user to websites and applications with a smart phone?

What would be a good way to authenticate a user to authenticate to websites and applications over a smart phone? By good, I mean that it is both secure, and user-friendly. Passwords don't seem to be ...
46
votes
5answers
10k views

Should I take over a compromised website from another hacker?

A website (www.blue*****art.com) is trying to attack my server using the Shellshock vulnerability. After doing an Nmap scan on the attacking IP address, I found many open ports. It looks like the ...
0
votes
1answer
86 views

My website got several unkown visits [closed]

sorry if this question do not fit here. I am at this moment making a website which is not finished at all. I found some analytics for the site and found something strange. I have 30 visits from ...
1
vote
0answers
42 views

Secure Third-Party User Forms [closed]

Hopefully this is the correct forum for this type of question. I work in a small not-for-profit in the UK. We wish to have a userform on our website that will allow customers to send information to ...
-4
votes
1answer
115 views

How to know from where the website is being operated? [closed]

I mean one can find their host server (from which the domain name is bought), but can we check who bought the domain and from where is that website is being hosted?
6
votes
1answer
328 views

Best Practices for Security Questions

When a website asks me to enter security questions in addition to a password what is best practice on my part? This often happens with banks and other institutions but I see it less with other ...
2
votes
1answer
97 views

What are good precautions to take before cleaning an infected website? [duplicate]

I have to work on infected websites once in a while, and I'm wondering if there are some good practices to keep my computer safe. I use my personal computer for work, so I'd like to take precautions. ...
-7
votes
2answers
360 views

I need to hack my website [closed]

I'm writing a simple web framework for a project of mine and need to ensure that the websites it produces are secure. In order to check this I thought I might as well just try and hack my own website ...
-3
votes
2answers
165 views

Do website owners know what keywords a visitor typed in google search to get to their site? [closed]

Does google give the info to website owners / administrators... is I guess how it would work?
5
votes
2answers
438 views

Website Defacing without hacking (google issue or trick?)

When I search in google for: "Impedance spectroscopy of MSDI (molecular semiconductor-doped insulator) ammonia sensors" The two first results are: "(molecular Semiconductor-doped ...
0
votes
4answers
304 views

If a large companies website's robots.txt file has no Disallow section, does this mean I am free to write code to crawl their website? [closed]

If a large companies website's robots.txt file has no Disallow section, does this mean I am free to write code to crawl their website? The website in question is basically a data warehouse for the ...
1
vote
1answer
230 views

Malicious JavaScript — Troj/JSRedir — Gumblar

I have a client with a website receiving AV warnings from Microsoft Security Essentials. A further investigation revealed that the site is blacklisted by Yandex.com, due to a report that the site ...
2
votes
1answer
132 views

How to handle legacy website account login credentials

I have a lot (>1000) of credentials for website logins in my Chrome's password safe. Some of them are quite old (> 10 years) and have weak (dictionary) passwords. Some of the accounts have low value ...
2
votes
1answer
222 views

Is it noticeable when you take a copy of a website?

Is it noticeable when you use a tool to take a copy of a website? - how likely are you to trigger logs and whatnot when you use tools like HTTrack? Is it actually illegal or 'bad' to do this? - alls ...
-2
votes
3answers
862 views

Company-issued laptop monitoring

just want to ask whether company IT can monitor the websites that I open using the company-issued laptop but on my personal wifi network? Offhand, I can see Symantec endpoint protection and Websense ...
1
vote
1answer
205 views

How to convert SSL Certificate for mobile app?

I am in the current process of renewing my SSL cert for my website. I also have a mobile app for my site. I want to use the same cert from my website in my mobile app. How can I do this? Thanks - I ...
0
votes
2answers
123 views

Where to find such URLs that attack their visitors? [closed]

Where can I find websites that perform drive-by dowload attacks ? I need such websites in order to test a software that prevents such attacks. I am in the testing phase but I do not see where I could ...
35
votes
5answers
5k views

Are there actions taken against websites that deliver malware?

There are serious tools and services such as Google Safe Browsing for malicious and phishing websites, and others fully dedicated to phishing websites such as Phishing.org. What is done against these ...