Hot answers tagged

4

The user can modify and delete anything stored in their browser. Any malware installed in the user's system with the user's privilege can also do so. The system administrator can also modify and delete anything stored in any user's browser. Any malware with the administrator's privilege can do the same. Another non privileged user in the same system ...


4

The error message indicates that the server expected a HTTP request but got a HTTPS request: \x16\x03\x01\ is the start of an TLS record. This probably means that your server configuration is wrong, i.e. that the server expects HTTP on port 443 and not HTTPS.


3

You are basically correct with a couple bits of complexity. First, it is still possible that both wget or your text editor might have a vulnerability that the page could be designed to try and exploit. This is unlikely, and the malware author would have to predict that you would use this process and plant an ambush. Unlikely, but it still means that your ...


2

The risk isn't that a script such as http://attacker.com/omg.php runs on your domain, it is that a user manages to break out of the <div style='background-image: url("http://example.com/image.jpg")'></div> context where the URL is written to the page. Note the code has been corrected from your question (single quotes used for HTML attribute ...


2

The --disable-web-security option applies to the entire Chrome application, not to a particular window. If you enable this option when starting Chrome, then any site you visit can access data from sites you visited earlier. For example if I was looking at my Online Banking account, and then closed that tab and navigated to a malicious site, that malicious ...


1

Change user agent in Tor Browser to mobile device. Open browser, type: about:config find general.useragent.override and replace it with mobile user agent, an example: Mozilla/5.0 (Linux; ; ) AppleWebKit/ (KHTML, like Gecko) Chrome/ Mobile Safari/ To see effect, try to visit any site:


1

You are confusing CORS with SOP. CORS enables Cross Origin Resource Sharing(unless authorized by the receiver), while SOP Ensures the Data is being accessed by the Same origin that created it. So by CORS you can't access other Tab's/Frame's data, unless you can execute JavaScript there. More on CORS & SOP. There is no way you can cross SOP, unless you'...


1

All major browsers (Chrome, Firefox, Opera, Safari, IE 11 and Edge) use a HSTS preload list of Chromium. You can check the eligibility and register the website to be included in the HSTS preload list on the https://hstspreload.appspot.com page. As of today, the requirements are: Have a valid certificate. Redirect from HTTP to HTTPS on the same ...


1

I use Tab Mix Plus plugin in Firefox and configure it to turn all pop-up/new window into tabs. This also prevents Javascript from bringing tabs into the foreground/background. You can additionally configure it to disallow scripts from changing window size and position, so accurate placement is impossible. A similar plugin may exist for other browsers.


1

Lee Brotherston spoke at DerbyCon 2015 on Stealthier Attacks and Smarter Defending with TLS Fingerprinting -- slides -- video. He also released code to go along with the talk -- https://github.com/LeeBrotherston/tls-fingerprinting/tree/master/fingerprintls The below is taken from his website -- http://blog.squarelemon.com/tls-fingerprinting/ Transport ...


1

BTW, there are also plenty of software libraries which would need scrutiny if someone is into that sorta thing. There's a pretty neat tool called TryTLS (shameless self promo) that is used to check whether a specific library checks TLS certificates properly.



Only top voted, non community-wiki answers of a minimum length are eligible