Tag Info

Hot answers tagged

23

eval() executes a string of characters as code. You use eval() precisely because the string contents are not known in advance, or even generated server-side; basically, you need eval() because the JavaScript itself will generate the string from data which is available only dynamically, in the client. Thus, eval() makes sense in situations where the ...


22

The hostname is transmitted in the clear. This is because HTTPS is a tunnel established after a connection to the server. The hostname is available for an eavesdropper to snoop in a number of ways: You will perform a DNS lookup and that is always in the clear; There is a TCP connection to the IP address returned by the DNS for google.com; In the case of ...


10

eval() is a possible vector for cross-site scripting. Under normal circumstances, an attacker attempting XSS might want to get script <script></script> tags past whatever encoding, filters or firewalls might be in place. If eval() is there operating on user input, it eliminates the need for script tags. Eval is present in many malicious scripts ...


7

Chrome: Open Chrome Type chrome://net-internals/#hsts in the address bar of chrome Query domain: if it appears as a result, it is HSTS enabled Firefox: Open file explorer Copy paste %APPDATA%\Mozilla\Firefox\Profiles\ in the address bar of file explorer (for Linux it is ~/.mozilla/firefox) Double click the folder you see (if you have multiple FF ...


5

It depends on who manages the OpenVPN server. A VPN allows you to connect your computer to a remote network in a secure way: the traffic between your computer and that network is encrypted. This protects you from the intermediate networks (including the local one, on which you plugged in your computer) from seeing your traffic (they see a stream of ...


4

I'm researching the extent to which TLS_FALLBACK_SCSV protects against Cipher Suite Downgrade attacks. I understand that the correct way to protect is to remove support for the insecure cipher suites. TLS_FALLBACK_SCSV is about protocol downgrades and not about cipher suites downgrades. Don't confuse this with Logjam where the the cipher suite gets ...


3

From point 1), if you live in those countries, with "spain...etc", if there anyway to check that the CA you are using (in firefox for example or other) is the proper company , for example google/gmail? and not the government one? You can check the certification path to find out which intermediary and root CAs signed the certificate that you are ...


3

There are no standard ways around, but there are ways around. What exactly you have to do to get around will depend on the browser and on the version. On this link you can find some examples to get around the protection in Google Chrome: http://blog.securitee.org/?p=37 The precondition on the examples at this blog post is that there are two GET parameters ...


3

XSS attacks are still possible now, for this you can go through OWASP's Top 10 Vulnerabilities Project 2013, which is still a top 3 vulnerability. But today modern browsers are very keen with XSS and Same-origin-policy eventhough your website has no protection to this attacks. In case of XSS every browsers are updated with XSS Filters in their newer ...


2

It is not standardized how a web browser saves the data it gets asked to store in localstorage. But it is very unlikely that it will be implemented in a way that it ends up as a valid executable file, and even when it would be, it is unlikely to be a file you or your operating system would ever execute. Security vulnerabilities in the implementation details ...


2

No. The dialog doesn't add these properties to certificates. It has nothing to do with the currently selected item – it merely adds them to the filter-by-property listbox at the top of the main window. (That's the one that says "Intended purpose: <all>".) (The more specific name is a "certificate purpose", and the technical name is extendedKeyUsage ...


2

In addition to the great points made here, I would like to clarify: what you are essentially dealing with any time you use eval() is having to answer the following questions: Is it worth securing? How thoroughly can I secure it and is that level acceptable? How confident can I be that it will stay secure over future evolutions of the codebase and ...


2

As explained by others, one can use eval to dynamically create code which makes it harder to understand the control flow of the program. But, I don't consider eval much more evil than all the other ways to generate code at run time, like document.write(...), object.innerHTML(...) and others. While these are mostly used to change the DOM of the program they ...


2

These are simply Subdomains created by the website owner. ww3 is often used to share load (ww1,ww2,ww3) on their servers. In you example it seems intel created www-ssl subdomain to separate normal http traffic and https traffic on subdomain level. If you want more information why somebody is doing this, just ask google or the website owner


2

@ThomasPornin address your first question. Your second question, then, is "how does one configure the protocol and cipher suite in the browser?" Firefox Protocol is configured by modifying the about:config variables security.tls.version.min and security.tls.version.max. You can set the min and max to: 0: SSL 3.0 is the minimum required / maximum ...


2

In SSL, the key exchange, symmetric encryption and MAC algorithm are all grouped together into a single aggregate notion called a cipher suite. In the initial handshake, the client sends: the highest protocol version that it supports; the list of cipher suites that it supports, in order of preference; other things which are not relevant here. Then the ...


1

Any time you include script from an external domain you are trusting that domain. e.g. if you site is example.com and you have the following code on your home page <script src="//example.edu/tracking_script.js"></script> then example.com is fully trusting example.edu not to do anything malicious inside tracking_script.js. example.edu will have ...


1

Both the client (browser) and the server support a set of cipher suites. The browser sends its list to the server, then the server picks from its (sorted) list something they both support. The 4 parameters don't get chosen independently. All 4 belong to one cipher suite. Which cipher suite your browser does support you can see here. Scroll down to "Cipher ...



Only top voted, non community-wiki answers of a minimum length are eligible