Questions tagged [browser-hijacking]
The browser-hijacking tag has no usage guidance.
55
questions
0
votes
1answer
29 views
Is it possible to infer advanced cookie properties like expiration from Wireshark
I want to perform a cookie injection attack for demonstration purposes.
I could achieve this using Firefox Cookie-Editor extension. However, the attack can only succeed if I enter the cookie name, ...
0
votes
0answers
25 views
Is multiple redirect query string request safe?
We have implemented our own single sign-on on our internal and external applications. The flowchart looks like this:
We are using https on both the App and the Single Sign-On, and we pass values ...
0
votes
2answers
226 views
Unable to inject cookies
As part of an exercise, I need to sniff cookies from a login page and inject them in the same login page. If the cookie injection is successful the user must be login without entering the user name ...
0
votes
1answer
155 views
How can I inject cookie from Wireshark into a browser sesson [duplicate]
For education and research purpose, I need to inject a cookie value into my browser to allow me login indirectly (without entering the user name and password).
I collected traffic during a login ...
1
vote
1answer
95 views
Work internet redirecting to Twitch?
When connecting my laptop with the work LAN, I noticed that certain websites get redirected always to a twitch channel.
I have changed the DNS configuration and used 8.8.8.8 and 8.8.4.4, but the ...
0
votes
1answer
60 views
Virtualized or Container (Remote) Based Browser Isolation is more secure?
There obvious costs differences between them but I am not sure from a security perspective which of them considered to be more secure.
0
votes
1answer
72 views
Will browser isolation solution protect our enterprise from Flash and JavaScript exploits and fileless malware?
Since we didn't see any pentest done to bypass on such solution, we don't really know if it worth purchasing such type of solution. Will this really protect us from Flash and JavaScript exploits, ...
1
vote
0answers
77 views
Redirection to a blank page after searching on Google with the search bar of Firefox
Today I tried to use the search bar in the top-right side of Firefox (ver 65.0 64-bit on Linux Mint 18.3 Sylvia 64-bit), and the search bar contains "search Google in Traditional Chinese".
When I use ...
0
votes
0answers
32 views
Are there any security implications to leaving Firefox's advanced developer tools enabled?
Mozilla's Firefox web browser has two advanced developer tools settings that are disabled by default.
To enable them, open the Developer Tools settings, go to the section "Advanced Settings", and ...
0
votes
1answer
30 views
Firefox switches charset encoding, brings up request to install extensin. Is this a “browser virus”?
I use Devuan ASCII (~= Debian Stretch) on my desktop, with Firefox and Chromium as my browsers. As I came back to my computer today after a few hours of non-use, and loaded a new browser frame, ...
1
vote
1answer
98 views
Websites that fill back button history with questionable pages
Occasionally I see links like the following (don't visit this on your main computer) that I am redirected to on Google. The back button will either redirect back to the page, or some other ...
2
votes
0answers
29 views
dll hijacking Related Questions
I read a about "dll hijacking" technology.
This usually occurs in the installation directory.(% Program Files%)
But, It is not possible to plant a DLL file in the "% Program Files%" path.
Because ...
1
vote
3answers
181 views
Why would fraudsters use old user-agents (old browsers versions)?
I would like to know why fraudsters would use old User-agents (with old browsers versions) to make conversions for PPL (Pay-Per-Lead) or PPS (Pay-Per-Sales) offers in affiliate marketing?
It seems ...
1
vote
1answer
121 views
Can an exploit in my browser read login passwords without logging in again?
When I log into my email account through a browser and open an email which exploits some vulnerability in my browser would it be possible for the attacker to take over my account? Passwords for full ...
8
votes
1answer
997 views
Can browser cookies be “physically” stolen?
Can someone with physical access to a target computer steal the web browser cookies in that and setup a rogue authenticated session later?
1
vote
1answer
117 views
User accessed Phishing link but didn't provide the credential but got hacked?
One of my colleagues received a phishing email in which he clicked on a link. The domain (www.phishing-link.biz) redirected to adfx.xxx.edu which does look like adfs authentication page.
Colleague ...
3
votes
1answer
56 views
XSS prevention by securing cookies locally
i was wondering if there was a way to prevent XSS by creating a safe layer within the storage of cookies in the browser locally? Or would there be any unique ways to protect against XSS. I know this ...
1
vote
2answers
2k views
Can browser bypass hosts configuration file?
for example, assume I have edited the hosts file with the following line:
127.0.0.1 malicious-site.com
if I happen to have installed a browser developed by people who owns this malicious website.
...
0
votes
2answers
153 views
Website just installed something to tor browser without my permission
This is an assumption, but as i was connecting to a website I saw the alert 'so and so website wants to install something to tor browser' and there was the 'Allow' button. I was going to retreat but ...
0
votes
2answers
102 views
Browser HiJacking Defense?
Let's suppose I'm on the internet all day long. Let's suppose I listen to talk show radio programs over the internet using a media player, something like Win Amp. Am I protected from a browser ...
1
vote
1answer
107 views
Go.redirectro issue [closed]
I have a hijacker problem "Go.redirectro"
And it gave ma a horrible headache
I tried registry editor and take a file by file deep look at my drive and uh god it took me long time
Look i am a ...
-1
votes
1answer
197 views
XSS - Suspicious email from Itunes - GF opened accidently
My GF received a random email from iTunes saying that she had started a new subscription, its a very convincing email until closer inspection. Anyway she clicked the link at the bottom to cancel it ...
2
votes
1answer
337 views
BeEF - What are the Indicators of Compromise (IOC)
If a phishing email came through with a link to a website hosting BeEF (or another such framework) what would be the Indicators of Compromise for such an attack.
Additionally, if systems were ...
1
vote
2answers
354 views
Applicability/Purpose of Malicious .dll Injected Into Browsers
I am currently disassembling an instance of malware, of which, following a quick first pass, looks to be some augmented variant of ZueS. As I was quantitatively characterizing the targeting mechanics ...
1
vote
0answers
189 views
Browser custom protocol handlers
The possibility of running a shell command from an extension (NPAPI) has been phased out, but custom protocol handlers are still supported.
What is the practical difference if an extension can still ...
2
votes
1answer
66 views
Malicious script compromising browser extensions
In Firefox or Chrome,
is it possible for a web page script to compromise a user installed extension?
This might involve access to extension private data or obtain the same execution privileges as ...
1
vote
1answer
2k views
Is it safe to store passwords in a Browser? [closed]
We are used to store passwords in Browsers for online login accounts. Where and how those passwords are saved and I hope it is encrypted ?
Normally, the browser prompts for credentials (local) when ...
1
vote
1answer
78 views
Anonymity of session hijackers using dsploit [closed]
I was wondering about the possibility of finding out culprits who hijacked others' sessions and tried using google to find an answer several times, but I always failed.
Before I ask a question, let's ...
0
votes
1answer
319 views
Browser hijacked on Debian [closed]
Seems someone has setup something in my system. I have several ports on localhost sending outbound communications. When in Firefox I type web.whatsapp.com for whatsapp web, I get a browser re-direct.
...
0
votes
2answers
810 views
Is powershell being executed from within Javascript a security risk?
One of our clients called after getting hit by a popup and being asked to call a number. This scam tatic has been growing faster and faster in terms of calls that we get.
I was curious how they knew ...
0
votes
1answer
842 views
How to prevent serious browser hijackers like this? [closed]
I am using Chrome and experiencing serious hijackers problems.
After finish loading a website, the hijackers adds a full-screen transparent trap.
When I clicked on it, it pops a new tab containing ...
0
votes
2answers
508 views
Why do SSL enabled sites don't reply back according to “hosts” file record?
I was playing with the hosts file under my linux distro. Added an entry
192.168.3.121 www.facebook.com
in the /etc/hosts file. Created 2 servers which link to an index.html file at ports 80 ...
3
votes
1answer
3k views
Browser exploits based purely on HTML + CSS
In 2011, Eli Fox-Epstein demonstrated a Rule 110 machine in HTML + CSS3.
This led some to say that the combination of HTML + CSS3 is Turing complete.
Regardless of whether HTML + CSS3 is technically ...
4
votes
2answers
3k views
Preventing Browser from BeEF Exploitation
BeEF is a great exploitation Browser based tool. But in some cases, unknowingly people get Hooked due to beef when it's hook.js is kept in Invisible Iframe of an HTML source. So How, can we detect ...
1
vote
2answers
379 views
Is there a way to sniff a “mousejack” attack?
I'm sure a lot of you are aware about the vulnerability in unencrypted wireless mouses. If not, here's a website reporting on the vulnerability: https://www.mousejack.com/
It sounds like the best way ...
2
votes
1answer
407 views
Is JavaScript needed for browser code execution vulnerabilities?
Does JavaScript VM have to enabled in a vulnerable browser to exploit an arbitrary code execution bug?
There is a number of bugs in borwsers that don't seem to involve JavaScript. For example, CVE-...
2
votes
1answer
611 views
Why browser hijacker changes the homepage to yahoo [closed]
I have seen many browser hijacker like istartsurf, ask.com which changes the victim's search engine to yahoo. Why many(almost all) browser hijacker changes the search engines to yahoo. Is there any ...
7
votes
3answers
1k views
Why can't cookie hijacking be prevented by associating cookies with IPs? [duplicate]
I just started reading about cookies and all the ways I can get them wrong and allow cookies to be hijacked which allows attackers to do things like impersonate a logged in user.
I don't understand ...
0
votes
1answer
94 views
Security concerns about Web browser [closed]
It seems that its like a black point in my mind that I think about browser when I research information security. Its clear that its the browser applies security rules while we navigate websites. In ...
12
votes
2answers
9k views
How does BeEF work and how can it be persistent?
BeEF - the browser exploitation framework. I think (thought) I had a basic working understanding of how it works. Recently, though, I was watching, this DEFCON talk, where a hacker used a man-in-the-...
1
vote
2answers
63 views
About browsers injectors (Sonic Train)
I know that viruses use some ways to inject some ADs in the browsers web pages like :
1-Inject an extension
2-Inject some codes to the browser process
3-With a proxy server
4-Install an injected ...
1
vote
1answer
89 views
Protecting users with browser extension. Is it possible, if the machine is already infected?
Assume a trojan acquired admin privilege on a Windows 7 machine.
How easy is it for the trojan to replace/hijack/modify a browser extension without user knowing it? Is it possible?
I am thinking of ...
1
vote
1answer
185 views
How do I track IPs my computer is accessing?
Month or two my Mac OS machine in ~5% cases goes aviasales.ru instead of imgur.com links that I click. The history in newly opened tab has only the current Aviasales URL, and the link I click looks ...
10
votes
0answers
2k views
How to isolate persistent pop-up browser hijack [closed]
There's a persistent browser pop-up affecting Mozilla Firefox which has evaded a number of security pre-cautions and attempts to find a remove it. It's gone on for at least 3 months.
The pesky pop-up ...
10
votes
3answers
6k views
Session Hijacking through sessionId brute-forcing possible?
cookies usually contain a sessionId to keep track of a logged user.
What would prevent a malicious user to forge millions of requests with random sessionIds and send them to a server, hoping to ...
3
votes
2answers
940 views
Website infected with unwanted “redirections”, apparently via javascript code
I'm working on a clients website, and I realize they've been compromised. Early today there was a major problem with a php eval(base64_decode issue. That was cleaned up via Andy Stratton clean.php ...
0
votes
1answer
4k views
Interpreting anti-hacker-alliance analysis [closed]
One of security tools available for web browsing is (http://anti-hacker-alliance.com)
Please find below two readings:
a) Reading for IP 205.x.x.x that state among other-things "you are using proxy ...
0
votes
1answer
205 views
Can HTTPS be compromised by first contact?
Let's say I am behind my PC and want to go to any secured website (HTTPS).
I have the direct IP address so any possible hack on DNS level is not possible (because I am not using it ;) ).
The packet ...
-1
votes
1answer
265 views
Why do “Unsecure connection” warnings in modern browsers don’t work against SSL Strip? [duplicate]
Why do “Unsecure connection” warnings in modern browsers don’t work against SSL
Strip?
0
votes
2answers
218 views
Browser page “Not resolved” page hijacked by yandex [closed]
Any domain that cannot be resolved defaults to yandex right now, on any browser on my system.
Helper objects or extensions are not installed.
It turns out that the ISP (Turk Telekom) is employing ...
