Tag Info

New answers tagged

1

GET and POST can both be vulnerable to CSRF unless the server puts a strong Anti-CSRF mechanism in place, the server cant rely on the browser to prevent cross-domain requests. As for PUT requests, there is a slight difference, theoretically it is vulnerable too, however, it requires the circumstances to be more conducive. Here is why: While GET and POST ...


1

This technique is often used when a website uses basic or windows authentication since there isn't a way to "log out". Instead of using cookies, the authentication mechanism is added as an Authorization header to every request sent to the website. For basic authentication it would be the username/password in a base64 encoded string and for windows ...


0

It's hard to know what the banks are thinking, but there's a real benefit to closing your browser after you've logged out of a bank or another sensitive site. Browsers aren't perfect, and are never going to be perfect. The browser memory space may contain sensitive information like usernames, passwords, tokens, account balances, etc. This SHOULD be ...


1

If you understand how CSRF mechanism works, you would easily conclude that the answer to your question is YES.


3

Yes, both GET and POST are vulnerable to CSRF. However, RFC 2616 states the GET and HEAD methods SHOULD NOT have the significance of taking an action other than retrieval. These methods ought to be considered "safe". Therefore, if a website has kept to the standard and only implements "unsafe" actions as POSTs, then here only POST requests are ...


1

The method; i.e. put, post, delete, request, get etc., of sending data is irrelevant. A CSRF (Cross Site Request Forgery) attack allows for un-trusted content to be injected and processed by the web server.


0

He needs only one page, right ? Fine then, you might want to save it somewhere, so he can access only that page. Assuming the data he is trying to get is static, and assuming it's only for data processing purposes he needs that access, wouldn't that be a solution to save it somewhere else to give him access only to that page ? Unless it's the secure ...


0

I have been suffering from this virus for last seven days, but in my android tablet. I have formatted my tablet three times in three days, but problem reoccurs just after installing the browser. It is correct that it alters your DNS server address. I have read a post somewhere in the xda forums that gave me hint about this: go to wifi settings and find the ...


3

There are two main types of issues that can occur with client-side execution: A malicious client can modify their client state and attempt to make the server accept that modified state as valid An unsuspecting user can be tricked into running code in their console by a malicious third-party, something caused Self XSS Malicious clients running ...


0

If your router is affected and you're facing different issues on your devices (android has no ads, computer does) may check/change your DNS settings on both devices and on the rooter. I think you android phone uses a different DNS server as your PC. Your PC propably uses your Router as DNS Server (e.g. 196.168.1.1) and your android uses a 3rd party DNS like ...


0

Javascript, and all other client side technologies, are inherently insecure. You can't keep people from cheating, only make it more difficult.


3

Yes it can be an issue but there are ways for applications to protect against it. Two sides to every internet application. In order to understand internet application security you have to understand the difference between the client and the server. Data which is generated by the client (the browser), must be sanitized and validated before being by the ...


3

This advice is often given for Single Sign On (SSO) solutions. This is for a collection of systems, where a user only logs in once. The authentication of the user is handled by a central system called the Identity Provider. After login, two sessions are established with the requested system and with the Identity Provider itself. When visiting a new system ...


27

After a bit of searching, it seems some banks are giving this advice following an attack on a bank that allowed users or malicious websites to reuse persistent cookies after a user had logged out, allegedly because other browser tabs were left open on the site in question and so the browser had not cleared the cookies yet. The reason such a vulnerability ...


0

This does not appear to be an OS/browser related issue. I would recommend you to read this http://www.quora.com/How-do-I-stop-AdsMatte-spam-popups-and-ads What it says: I believe all your default gateways is "192.168.1.1" Open this from your PC. If you can't open it, the the solution below must work: I believe you should know about it first(skip ...


8

You should close your web browser (to avoid private information disclosure) if... Someone might access the computer after you do The HTTP response (of the sensitive info) does not set the Cache-Control header properly For example, go to yourbank.com, and look at your account. Click logout. Click the back button. Do you see your account info? On some ...


1

I ran into this issue not too long ago. If you have done a clean OS install then it is likely that your Chrome settings have been tampered with, infected, auto-backed up, and restored once you log into Chrome again after the clean install. You can try and reset your Chrome settings. It actually took me hitting this more than once and manually inspecting my ...


0

The panopticlick site has "self defense" recommendations to avoid tracking. One of the recommendations is to use the torbutton. The torbrowser design docs have a good description of how they try to avoid browser fingerprinting and tracking. All of these approaches are trying to normalize your profile to look like as many other people as possible.


0

The keygen docs at Mozilla, and the keygen docs at w3 don't specify a return format after the POST. What should I return? The reason this information is not listed is because the KeyGen element sends an SPKAC to the server and once a CSR is generated and sent to the CA an x.509 signed client certificate is to be sent back to the client that ...


1

Todays used fingerprints mostly rely on generating as much entropy as possible by exploiting as much details of the browser as they can. Even subtle, but short term stable details, like the exact (hardware and driver version dependent) rendering on a canvas is exploited. The information gathered is most likely compressed by generating a long enough hash ...


5

The full URL (hostname and path) is only inside the HTTP protocol and is thus encrypted by the TLS layer. Also, any HTTP headers and payload of request and response are end-to-end encrypted. But, the hostname part of the URL is usually in the CONNECT request when using a non-transparent HTTP proxy, unless the client itself makes the DNS lookup. With a SOCKS ...


4

Avoiding attacks on your site You need to validate that the string you received is valid. Remember this principle: you must white-list acceptable strings rather than black-list unacceptable ones. Ensure that the string is a syntactically-correct and escaped URL. Escaping the whole URL avoids it containing " or > which could break your site's syntax. ...


1

Configure your browser to point to Burp's proxy details (e.g. 127.0.0.1:8080) and then configure Burp to use an upstream HTTP proxy for all target hosts (* as the destination): However, if the upstream proxy is SOCKS, not HTTP, you need to configure it underneath (under the SOCKS Proxy heading) instead. This causes everything to be fed through the proxy. ...


-1

If you don't use extensions change the name of the extension folder. ex: C:\Users\Username\AppData\Local\Google\Chrome\User Data\Default\Extensions change it to 0000extensions or what ever. seems to fix the problem, if you do not use extensions. Extensions can not be downloaded when the folder does not exist.


0

A crossed out https could mean that the certificate uses the dated "SHA-1" security which is not as secure as it was at its induction 20 years ago. Chrome is simply telling us that. IE and Firefox are not yet reporting sites that use "SHA-1" but will soon. To verify this is the problem, I suggest you open the website in one of the other browsers to see if ...


5

It's in the page source, nested in an HTML table cell as: <td width="194" height="34" class="poll_row_border" style="padding-left:4px;"><div align="right" class="tool_description"> "><ScRipT>alert(31337)</ScrIpT> </div></td> Interestingly, there are two sets of similar code that ...


-3

USB Tethered to wrist. (Overkill) Run an entire OS temporarily from a USB stick. When you want to log in, shut down comp, enter USB stick, load from it, log into your accounts, when done, log out, shutdown computer, unplug USB stick. No traces (that lead to credential parsing), easy to destroy, easy to hide... Safe? Adding a jumper module onto the USB ...


2

You should use the private directive. Note that content will remain available within the user's browser, even if the Expires header is set as this header does not necessarily force the browser to purge it after the date and time set so it does not meet your session time-out requirement. However, if this risk is acceptable then it may be suitable. You could ...


2

With enough traffic from your internal users, an attacker could map the internal networks of an organization. There might be very low value in this data, however, if DHCP expires IPs quickly, or if the internal network is predictable (or uninteresting) on its own. It would also require a lot of traffic from the network's users to be helpful.


3

If the majority of your traffic is personalized data then you should use HTTPS and rely primarily on browser caches. Make use of this cache by setting Expire header and ETag. Additionally, the Cache-Control: no-store advises browsers to not cache the data on a persistent storage, the data can only be cached on RAM. In effect, this is like session cache.



Top 50 recent answers are included