Questions tagged [browser-hijacking]
The browser-hijacking tag has no usage guidance.
71
questions
0
votes
1
answer
61
views
How can the Beef Tool be used? [closed]
Can the hijacked browser's history and saved information be viewed?
Is it possible to create a backdoor in the browser? In other words, can it be secretly redirected to any site or downloaded and ...
- 129k
0
votes
0
answers
76
views
What can be leaked using a browser extension where one of the extensions loads JavaScript from a remote site?
Can one remotely log my IP, browser history, and saved passwords?
I think the IP should be easily done if one of the extensions load a remote JavaScript to run in my browser. I'm not sure about other ...
- 129k
2
votes
1
answer
2k
views
Is it still possible to get a virus simply by visiting a website? [closed]
I know this is a duplicate question, but there aren't any recent updates on the answers given to this question(here and here) and after a few years, I'm sure browser security has improved drastically. ...
- 123
2
votes
1
answer
821
views
Windows Update installs yandex.ru browser hijacker
I recently created a Windows 10 installation stick via the official media creation tool. Presumably, there was no malware on my host system on which I created the stick. It's a pretty fresh install as ...
- 21
1
vote
3
answers
2k
views
Mistyped "google" and came to a suspicious page with a browser hijacker
I misspelt google as "googe" (very dumb, yes). It took me to a page that asked me to enter my birthdate. The URL was something along the lines of luj dott proasdf dott com
After going to ...
- 1
1
vote
0
answers
19
views
Cookie hijacking query [duplicate]
I am trying to understand cookies and the hijacking/mitigation methods. I have noticed that some websites are more secure than others.
For example, I have two browsers (Edge and Firefox). I have ...
- 111
0
votes
1
answer
719
views
What can happen when you click on a bad link? [duplicate]
I sleepily clicked on this bad link yesterday (DONT CLICK Unless you know what you're doing: https://6to.me/idsoni7kjv with a "?fbclid=" param - presumably identifying me)
I'm wondering how ...
- 2,267
1
vote
0
answers
275
views
Can a running SSH connection to a rootkit infected VPS be used to attack the remote client?
If a VPS running Debian 10 Xfce as a cloud desktop has been rootkit infected and there is an ongoing SSH connection with X2Go from a client to manage this server, is it possible for an attacker on the ...
CommunityBot
- 1
0
votes
1
answer
329
views
my ip address comes out from a different ISP/Country
I noticed suddenly something weird on my PC. I am currently in Italy, Google all of a sudden is displayed in Arabic, and my IP is from an ISP in Czech Republic, and it is obviously different from the ...
- 201k
4
votes
3
answers
3k
views
Is Firefox's new JavaScript support within PDF files a security concern?
Historically, we have learned that many security vulnerabilities and exploits have resulted from allowing document files to contain executable code, whether it be JavaScript, VBScript, another ...
- 21
1
vote
1
answer
337
views
Mitigating physical cookie theft
Threat model:
Malicious user gaining physical access to browser cookies (e.g., 3rd party repair guy copying cookies to his own device or something like that). Let's say legit user did not clear ...
- 2,968
0
votes
1
answer
213
views
Can visiting website infect computer? [duplicate]
I have heard online that simply visiting a website can infect a computer. I had an instance recently where someone I know sent me a link but misspelled it. The misspelled link lead to a malicious ...
- 38
1
vote
2
answers
226
views
Malware? Or a Browser Hijack by Google?
Today, clicking on links (via Chrome from my Google home page), I started seeing "https://beinternetawesome.withgoogle.com/en_us/" come up instead of the site I had attempted to load.
I'm ...
- 121
1
vote
1
answer
411
views
Browser custom protocol handlers
The possibility of running a shell command from an extension (NPAPI) has been phased out, but custom protocol handlers are still supported.
What is the practical difference if an extension can still ...
- 442
5
votes
2
answers
12k
views
Preventing Browser from BeEF Exploitation
BeEF is a great browser-based exploitation tool. But in some cases, people unknowingly get hooked due to beef when its hook.js is kept in an invisible iframe of an HTML source.
So how can we detect ...
- 129k
1
vote
1
answer
118
views
Able to access other user information using valid session
So, I'ma login to the website using my valid account. But there is Web API (GET) using "application/x-www-form-urlencoded" or "parameter" that we can access without login. Some page needs to login to ...
CommunityBot
- 1
1
vote
0
answers
116
views
Safari frequently gets hijacked when visiting digg.com [closed]
About 6 months ago, every so often, when visiting digg.com, my browser (Safari) would get redirected to some malware site for updating Adobe Flash. This happened both on my iPhone (not jailbroken) and ...
- 111
2
votes
1
answer
385
views
Json hijacking does not work [duplicate]
I have patched my site to prevent JSON hijacking. During this process, I was interested to see if I could actually exploit this vulnerability.
So I created a foo.html, added a script tag which source ...
- 30.6k
0
votes
1
answer
198
views
Exploiting CORS and storing the response to server
I am trying to exploit misconfiguration CORS.
I have created and hosted a file in HTML and Javascript where if someone clicks the link there HTTP response containing cookies will reflect them on the ...
- 3,794
-1
votes
2
answers
883
views
Unable to inject cookies
As part of an exercise, I need to sniff cookies from a login page and inject them in the same login page. If the cookie injection is successful the user must be login without entering the user name ...
CommunityBot
- 1
-1
votes
1
answer
266
views
XSS - Suspicious email from Itunes - GF opened accidently
My GF received a random email from iTunes saying that she had started a new subscription, its a very convincing email until closer inspection. Anyway she clicked the link at the bottom to cancel it ...
CommunityBot
- 1
0
votes
1
answer
179
views
Is it possible to infer advanced cookie properties like expiration from Wireshark
I want to perform a cookie injection attack for demonstration purposes.
I could achieve this using Firefox Cookie-Editor extension. However, the attack can only succeed if I enter the cookie name, ...
- 201k
1
vote
1
answer
4k
views
How can I inject cookie from Wireshark into a browser sesson [duplicate]
For education and research purpose, I need to inject a cookie value into my browser to allow me login indirectly (without entering the user name and password).
I collected traffic during a login ...
- 529
12
votes
2
answers
15k
views
How does BeEF work and how can it be persistent?
BeEF - the browser exploitation framework. I think (thought) I had a basic working understanding of how it works. Recently, though, I was watching, this DEFCON talk, where a hacker used a man-in-the-...
- 19.1k
1
vote
1
answer
201
views
Work internet redirecting to Twitch?
When connecting my laptop with the work LAN, I noticed that certain websites get redirected always to a twitch channel.
I have changed the DNS configuration and used 8.8.8.8 and 8.8.4.4, but the ...
- 129k
1
vote
1
answer
453
views
Virtualized or Container (Remote) Based Browser Isolation is more secure?
There obvious costs differences between them but I am not sure from a security perspective which of them considered to be more secure.
- 201k
0
votes
1
answer
167
views
Will browser isolation solution protect our enterprise from Flash and JavaScript exploits and fileless malware?
Since we didn't see any pentest done to bypass on such solution, we don't really know if it worth purchasing such type of solution. Will this really protect us from Flash and JavaScript exploits, ...
- 201k
1
vote
0
answers
386
views
Redirection to a blank page after searching on Google with the search bar of Firefox
Today I tried to use the search bar in the top-right side of Firefox (ver 65.0 64-bit on Linux Mint 18.3 Sylvia 64-bit), and the search bar contains "search Google in Traditional Chinese".
When I use ...
0
votes
0
answers
97
views
Are there any security implications to leaving Firefox's advanced developer tools enabled?
Mozilla's Firefox web browser has two advanced developer tools settings that are disabled by default.
To enable them, open the Developer Tools settings, go to the section "Advanced Settings", and ...
- 3,144
0
votes
1
answer
123
views
Firefox switches charset encoding, brings up request to install extensin. Is this a "browser virus"?
I use Devuan ASCII (~= Debian Stretch) on my desktop, with Firefox and Chromium as my browsers. As I came back to my computer today after a few hours of non-use, and loaded a new browser frame, ...
- 449
11
votes
3
answers
13k
views
Session Hijacking through sessionId brute-forcing possible?
cookies usually contain a sessionId to keep track of a logged user.
What would prevent a malicious user to forge millions of requests with random sessionIds and send them to a server, hoping to ...
CommunityBot
- 1
2
votes
2
answers
6k
views
Can browser bypass hosts configuration file?
for example, assume I have edited the hosts file with the following line:
127.0.0.1 malicious-site.com
if I happen to have installed a browser developed by people who owns this malicious website.
...
- 281
2
votes
1
answer
772
views
Websites that fill back button history with questionable pages
Occasionally I see links like the following (don't visit this on your main computer) that I am redirected to on Google. The back button will either redirect back to the page, or some other ...
- 3,534
2
votes
0
answers
105
views
dll hijacking Related Questions
I read a about "dll hijacking" technology.
This usually occurs in the installation directory.(% Program Files%)
But, It is not possible to plant a DLL file in the "% Program Files%" path.
Because ...
- 21
1
vote
3
answers
512
views
Why would fraudsters use old user-agents (old browsers versions)?
I would like to know why fraudsters would use old User-agents (with old browsers versions) to make conversions for PPL (Pay-Per-Lead) or PPS (Pay-Per-Sales) offers in affiliate marketing?
It seems ...
- 6,328
1
vote
1
answer
191
views
Can an exploit in my browser read login passwords without logging in again?
When I log into my email account through a browser and open an email which exploits some vulnerability in my browser would it be possible for the attacker to take over my account? Passwords for full ...
- 1,528
10
votes
1
answer
2k
views
Can browser cookies be "physically" stolen?
Can someone with physical access to a target computer steal the web browser cookies in that and setup a rogue authenticated session later?
- 66.7k
1
vote
1
answer
321
views
User accessed Phishing link but didn't provide the credential but got hacked?
One of my colleagues received a phishing email in which he clicked on a link. The domain (www.phishing-link.biz) redirected to adfx.xxx.edu which does look like adfs authentication page.
Colleague ...
- 7,976
1
vote
2
answers
484
views
Applicability/Purpose of Malicious .dll Injected Into Browsers
I am currently disassembling an instance of malware, of which, following a quick first pass, looks to be some augmented variant of ZueS. As I was quantitatively characterizing the targeting mechanics ...
CommunityBot
- 1
3
votes
1
answer
123
views
XSS prevention by securing cookies locally
i was wondering if there was a way to prevent XSS by creating a safe layer within the storage of cookies in the browser locally? Or would there be any unique ways to protect against XSS. I know this ...
- 5,817
0
votes
2
answers
319
views
Website just installed something to tor browser without my permission
This is an assumption, but as i was connecting to a website I saw the alert 'so and so website wants to install something to tor browser' and there was the 'Allow' button. I was going to retreat but ...
CommunityBot
- 1
0
votes
2
answers
190
views
Browser HiJacking Defense?
Let's suppose I'm on the internet all day long. Let's suppose I listen to talk show radio programs over the internet using a media player, something like Win Amp. Am I protected from a browser ...
- 177
1
vote
1
answer
168
views
Go.redirectro issue [closed]
I have a hijacker problem "Go.redirectro"
And it gave ma a horrible headache
I tried registry editor and take a file by file deep look at my drive and uh god it took me long time
Look i am a ...
- 643
2
votes
1
answer
740
views
BeEF - What are the Indicators of Compromise (IOC)
If a phishing email came through with a link to a website hosting BeEF (or another such framework) what would be the Indicators of Compromise for such an attack.
Additionally, if systems were ...
- 3,322
2
votes
1
answer
144
views
Malicious script compromising browser extensions
In Firefox or Chrome,
is it possible for a web page script to compromise a user installed extension?
This might involve access to extension private data or obtain the same execution privileges as ...
- 44.8k
0
votes
1
answer
2k
views
Is it safe to store passwords in a Browser? [closed]
We are used to store passwords in Browsers for online login accounts. Where and how those passwords are saved and I hope it is encrypted ?
Normally, the browser prompts for credentials (local) when ...
- 1,297
1
vote
1
answer
151
views
Anonymity of session hijackers using dsploit [closed]
I was wondering about the possibility of finding out culprits who hijacked others' sessions and tried using google to find an answer several times, but I always failed.
Before I ask a question, let's ...
- 129k
0
votes
1
answer
505
views
Browser hijacked on Debian [closed]
Seems someone has setup something in my system. I have several ports on localhost sending outbound communications. When in Firefox I type web.whatsapp.com for whatsapp web, I get a browser re-direct.
...
- 44.8k
0
votes
2
answers
2k
views
Is powershell being executed from within Javascript a security risk?
One of our clients called after getting hit by a popup and being asked to call a number. This scam tatic has been growing faster and faster in terms of calls that we get.
I was curious how they knew ...
CommunityBot
- 1
0
votes
1
answer
927
views
How to prevent serious browser hijackers like this? [closed]
I am using Chrome and experiencing serious hijackers problems.
After finish loading a website, the hijackers adds a full-screen transparent trap.
When I clicked on it, it pops a new tab containing ...
- 103