Tag Info

Hot answers tagged

31

Yes, it is absolutely safe (in Google Chrome) to open an untrusted website in view-source mode. The key point to note here is that you should "open" the page in view-source mode, meaning you should not allow any rendering to happen by normally loading the webpage first and then viewing the source. An example in Google Chrome would be ...


20

While it is currently safe on Chrome you should not base your future checks on that. Things may change anytime and I have not seen the lack of rendering as being a specifically documented feature. If you want to look at the code, it is much better to download the page via a command-line tool (curl for instance) and analyze what was loaded and saved in a ...


6

Ran it throught Closure Compiler and here's what it looks like: http://jsfiddle.net/q520kg51/1/ At first glance, it doesn't communicate with any remote service or use any HTML5 API. Here's part of the compiled code (I cut out the repretitive stuff) var a = ""; function b(e) { c += e } var c = "", d = "", d = "e"; b("fu"); d += "v"; b("nc"); d ...


4

This has more to do with risk management. You do not have any contract with Facebook or Twitter. So you have a risk that they may change the contents of the JavaScript file without you knowing. This can be malicious or accidental, either way you have no control of this risk. So unless you get a contract with the external party which moves the liability to ...


3

As explained here: Script Surrogates replace a blocked script or complements existing scripts which would not work as expected because of NoScript. This means they provide just replacements for functionality some applications want to call, so that these function calls do not result in errors. These hooks only provide the minimal necessary ...


3

Assuming that you have already totally blocked access to the trackers then it doesn't matter to your privacy. However, it may matter to your usability of some web sites. The scripts are there to allow sites to work that otherwise rely on the scripts being blocked. If all your sites work, you don't need them.


3

It would have helped if you would have provided with the HTML code as well. However, i think the reason why it does not work is because the value of the hash anchor is not being utilized in the JavaScript. It would have been exploited as DOM based XSS if this value was being used in JavaScript somewhere. Here's is an example of code vulnerable to DOM based ...


3

Go to https://www.virustotal.com/ Put in the URL of the website you visited that gave you the JavaScript warning. It will search to see if that URL has malicious content. You will get results. Unless there is zero-day malware on that URL, the results will be correct.


2

So, the basic scenario you propose is to send credentials from a browser, to your web server. So, we're dealing with HTML and Javascript and associated assets in the browser, and the communication is over HTTP/HTTPS. These are the only components relevant to the specific function in question. And in fact, the fact that you're using JavaScript to send ...


2

With the added context to the 2011 Berkeley exam answer sheet passed in your comments section the answer is indeed false. They were looking for the Wikipedia definition of "Web Bug". http://en.wikipedia.org/wiki/Web_bug


1

Yes, essentially it is. It is not what it is, but how it was achieved, which is what the hype is about. It is a JavaScript injection attack on a global scale - both in terms of impact and in terms of the technological challenge to make it happen.


1

What the report shows is not the uniqueness of the attack vector, but the systemization of the attack vector as a part of a national defence strategy. GC is an in-path system, capable of not only injecting traffic but also directly suppressing traffic, acting as a full “man-in-the-middle” for targeted flows. ... In addition, in contrast to ...


1

As everyone has already answered, it's not possible to detect bots via browser fingerprinting alone. ShieldSquare, being bot detection company we spend most of the time with bots, I would say detection of bots is possible, along with JS device fingerprint few more things would be considered: User Behavior [You can analyse what the user is doing on the ...


1

They are not necessarily exclusive. They take advantage of different weaknesses. If you have the ability to do a "traditional" XSS through a reflected attack, then you likely wouldn't need to attempt a dom-based attack because you can inject any code you want before the page loads. In your examples, its not quite clear if you are differentiating the root ...


1

I observed that certain attacks could be both DOM-based and Reflected XSS No. What you list are the same payloads for both DOM based and reflected XSS (both attacks are often exploited in similar ways). But what happens underneath that is still either DOM based XSS or reflected XSS (well, or stored XSS). It's never both. The names for the different ...


1

The risks are more on the client end of things than your server side. What I mean by that is as a consumer I do not want my data going to your server for "processing" which then gets sent over to stripe/wepay. I dont know how you're transmitting the data or whether or not you're not storing it the way you say you are. Also from the consumer side of things if ...


1

Just like anti-virus identifies malware on your local machine - by checking for virus signatures. Although executable code cannot normally be ran through your web browser automatically, if there is a flaw in the browser or in a plugin such as Flash or Java, then the web page can exploit this to trigger a "drive by download". On example is this heap ...


1

Math.random() is not for crypto because it is not built for that: Returns a Number value with positive sign, greater than or equal to 0 but less than 1, chosen randomly or pseudo randomly with approximately uniform distribution over that range, using an implementation-dependent algorithm or strategy. This function takes no arguments. As far as prediction ...



Only top voted, non community-wiki answers of a minimum length are eligible