New answers tagged

0

What is the best filter against current xss in a browse? this can be useful.


1

I found a way to prevent the use of this API using javascript. Worked for me in chrome and firefox (Desktop version). (function(navi){ var nnav = new Proxy(navi,{ get:function(t,p){ if(p == "getBattery" || p == "battery"){ return void(0); } if(t[p] instanceof Function){ return t[p].bind(navi); ...


0

Background I was looking into the source code of Chromium to determine if there is any blacklisting or filter possibility for history entries. I have checked the following files which are responsible for the whole history handling: history.cc history.h history_data.cc history_data.h history_data_observer.h history_data_store.cc history_data_store.h ...


2

This is an interesting question why I was looking into the source code of Chromium too see how they do it. The Answer It is nearly impossible to implement a 100% reliable feature to prevent a screenshot that will be used in the most visited view. You have to hide the sensitive content right the moment the service is storing the data. Which might happen all ...


0

Actually, even if that header could solve the problem, the second part is a human factor: the hosters/developers/webmasters are about to use it, actually...


17

Did XSS reach its end-of-life with the introduction of the HTTP X-XSS-Protection header? No. X-XSS-Protection is only used to enable or disable the inbuilt filtering[*] - which is generally enabled by default anyways. So a more fitting question would be if XSS reached its end-of-life with browser filters. But again, the answer is no. XSS is still a ...


2

i tried many php scripts like http://attacker.com/omg.php and it doesn't runs the script on my domain .. The problem here would not be a server side vulnerability but more of a reflective XSS vulnerability that runs on the browser not on the server which is why the php file did not work. Taken from OWASP (see here): Reflected Cross-site Scripting (XSS)...


0

Yes. It's possible to fingerprint clients in this way. There are even some existing tools that implement this. However, it appears to not be very accurate. It might be able to recognize a major browser type (e.g., Firefox, Chrome, Safari), but it's unlikely to be able to accurately identify the version number, and any fingerprints obtained in this way ...


3

I know of two examples of differences in browser security: The SameSite cookie flag is a countermeasure against CSRF. Currently Chrome and Opera are the only browsers that support it. For an extreme example, there is Chromodo, a customized version of Chrome that disables some important security features. So it definitely matters which browser you are ...


-2

Opera was the most secure and Firefox the most unsecure since many years ago. Chrome is somewhere in-between. Although Opera also switched to the standardized GUI, it is still the most secure browser. So to answer your question, yes, there is big difference when it comes to security. But one thing you can to for all browsers is increase the security with ...


2

There are methods of stealing browser-saved passwords so you need to assume that your browser is always vulnerable. At a very minimum, you should set a browser master password and enable encryption to stored passwords. You can also look into using something like KeePass which allows you to store encrypted passwords where you choose (i.e. hard drives, ...


5

You should assume so no matter what* When your system gets compromised you must assume that it has compromised any accounts stored on the system. You should go about changing the passwords for any accounts used on that computer in any place. You have no control over the virus, and you have no control how programs store your data so you don't know if your ...


0

First it is important to understand the idea of user-agents were never intended for finger printing. But to get information about the browser, platform, rendering engine, and other device information to help developers. User-agents were first added to the HTTP standard in 1996. At the time browser standards were generally the wild west. Very rarely did two ...


2

You did answer your own question already: Is this something exploited through vulnerabilities ... Buffer Overrun Buffer overflows are not intended behaviour, but indeed exploitable vulnerabilities. Browsers vendors will fix B.O. when they find it => they do protect from it. The problem is, as with all vulnerabilities, someone has to recognize ...


6

User agent strings are maddly complicated for historical reasons. It is a long story, but the short version is that everybody wanted to look like someone else to circumwent servers restricting access to webpages based on browsers. Yes, that used to be a thing back in the days. And now we are stuck with this sad mess. The good news is that this means that ...


5

Short answer: This is extremely dangerous and must be avoided. There are a few things here that should be changed. First, user passwords must always be hashed. As I said in the comments, bcrypt is a common and appropriate hashing mechanism. Secondly, sending credentials back to a user leaves it open for abuse by an attacker - there is never a good reason ...


1

For most major browsers that are used in the tech community, the only thing stopping them from being evil is the fact that they rely on open source code, and are widely poked and prodded. Unfortunately, these browsers also include add-ons and extensions, which are less likely to be well-vetted and so even more likely to be causing insecurity. It is indeed ...


6

Is there anything stopping from web browsers snooping into our activities? Nope, not really. That's a bit like asking Is there anything stopping my keyboard from recording my keystrokes? In theory, we are interacting directly with the keyboard / web browser, which in turn talks to other components for us, and we are trusting that it is acting in our ...


0

Yes, you can perform some fingerprinting of SSL traffic. Although you may find fingerprinting a client hard as most of them will be using one of the common libraries such as openssl. So you may be able to fingerprint different versions of these libraries as opposed to curl vs firefox vs wget.


0

You might be able to identify known malware and exploit fragments with a malware scan. This might address your concerns quickly and easy. But if it was a more professional attack this might not be possible. If you assume your computer is compromised you might have to re-format the device and re-install the operating system. This action would be mandatory in ...


0

Although the projects on OWASP wargames list are fairly well-vetted and reliable, you're not wrong to be cautious. Using protection like Sandboxie (for Windows), or firejail, BitBox, Cuckoo when running something of unknown provenance is a good idea.


4

Given that you're attempting to defend against a Google "all-seeing-eye" attack, (and not the NSA), this is a good start. I've added a couple suggestions below. Your search engine activity will be trackable through the generation of unique links. Consider using a privacy-oriented search engine, like DuckDuckGo. You have their word they aren't trying to ...


3

Browsers will use the highest supported protocol negotiated between it and the server, even if SSLv3 is enabled. Newer browsers have SSL disabled, so will not be vulnerable to downgrade attacks. Also see here TLS/SSL support history of web browsers.


4

The way certificates work is that a certificate is sent by the web site to your computer. Your browser reads the certificate, looking for the identity of the "signing certificate." It then validates the signature of the downloaded certificate was created by the signing certificate. If the signing certificate is signed by itself, it is called a trusted ...


15

Browsers do not accept verification from just any third party; if they did the whole exercise would indeed be pointless. In order to be accepted as valid, the certificate presented by the website must be digitally signed by a trusted certificate authority. The default list of trusted certificate authorities, which you can see in Chrome by going to Settings-&...


2

You are correct on your first statement. Unless s/he is a trusted CA, your browser will still bitch that the cert is not trusted. And you'll know you're being MiTM'd. For the second paragraph, you're reaching a bit.The hacker would have to compromise DNS for ALL CAs and have a way to validate the bogus certs. Highly unlikely.


1

Here, the vulnerability does not talk about some program running on your machine. The problem is data being overwritten at the wrong place. You can find the details of the vulnerability here: http://blog.talosintel.com/2016/06/pdfium.html#more As mentioned in the webpage: If in the above call to opj_calloc, which is a calloc wrapper, numcomps value ...


4

(tl;dr at bottom) Encryption is essentially free at this point, even on dial-up connections. Almost every major language has it built-in, or has a library for it, etc. The advantage of not using TLS/SSL is a very small fraction of a second start-up time, a very negligible reduction in CPU usage (a small fraction of a percent), and about 4kb of bandwidth ...


2

You should use secure WebSockets protocol in your product. Given (extremely little) information you provided about the details of your game*. Only general answer is possible to the question**: What is the worst thing that could happen if I don't enable wss? If you design and build a system disregarding common security precautions: at best nothing ...


5

Are there any frameworks that work this way? Sure. Twig or Django would be two examples. The inverse of this is clearly a far more secure default, ie. all dynamic data is escaped, unless you specifically tell the framework not to. Yes, this is a lot more secure. Is there something I'm missing? The one downside is that XSS is context-sensitive....


3

Since browsers and plugins like flash are not bug-free there is a non-zero risk that you can be attacked with malware just by visiting a web site or that your credentials gets stolen. These can be silent attacks (drive-by-downloads, cross-site-scripting, CSRF...) or social attacks (downloads of fake software updates, scareware, fake login,...). You will find ...


1

Going to web-pages can be dangerous. The most immediate danger is getting your browser hooked. These hooks act as anchors in your browser and allow the attacker to have some basic control over your browser. This can lead to further exploitation and, if the attacker plays it right, can end in you getting owned. If disabling JavaScript entirely isn't an ...


0

When in doubt, setup some security. Hackers are always looking for the next big exploit. And there are millions of them in the world working all hours of the night on many, many different systems.


0

It seems like you answered your own question. It would be very prudent of you to take steps to protect yourself from threats. You can never be too careful.


5

Presumably you mean the following four: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.63 Safari/537.36 most Web browsers use a User-Agent string value as follows: Mozilla/[version] ([system and browser information]) [platform] ([platform details]) [extensions]. Mozilla is a byproduct of browser wars. ...


1

There are two parts on http://stegosploit.info/ The first one is about hosting the javascript exploit in an image file loaded through canvas. As such, it's not really interesting since in order to be exploited, the attacker would already need to be able to insert javascript into the webpage. The second part involves also including the html into the image ...


1

To answer the question: The website admin must be in on the exploit. The encoding technique is there to obfuscate the actual exploit scripts, thus flying under the radar from current detection methods. It still requires HTML/Javascript to be on the webpage in order to decode and run the exploit. That is to say, if I had encoded an exploit into ...


-1

Absolutely. Apps employ ad networks which are shared among different websites that share the same ad network (AdClick as an example). The ad network installs cookie on the system which gets shared between websites you visit and share the same ad network. That is, your unique cookie gets tossed around, which helps track your movement across the web.


9

You better ignore that commenter entirely. Joey Spinosa is either royally confused or is trolling. There are many totally inaccurate statements in his comments; mainly from conflating Server Certificate with Certificate Authority Certificate. Claim 1: downloading files ... install these certificates of authority. Browsers never silently install a ...


1

Yes, it is a problem, maybe even a big problem, but "XSS" probably isn't the right term. What could possibly go wrong? remote code execution using svg, especially older browsers off-site images leak your user's IP address (aka lat/lon), userAgent, and net performance malicious images themselves been vectors, lots of 0days in the past A special or even ...


1

No, in modern browsers no XSS is possible via the style or src attribute of an <img> tag. So neither of these would execute the JS code in any up-to-date browser: <img src="javascript:alert(1)"> <img src="x.jpg" style=background-image:url('javascript:alert(2)')"> Support for Javascript in CSS attributes has long been abandoned. You can ...



Top 50 recent answers are included