Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [plugins]

The tag has no usage guidance.

1
vote
2answers
63 views

Can plugins for text editors and IDEs be malicious?

I'm always a little cautious about plugins I install for text editors or browsers, but can they be dangerous and cause the text editor or browser to behave in a malicious way? For example, can a ...
0
votes
0answers
27 views

ettercap packet modification

I am trying to figure out how to write a plugin in ettercap which modifies the payload of a packet. I have a vm with a simply python socket server and a simply python client on the ettercap machine. ...
1
vote
1answer
155 views

Haunted Google Account?

Not to be dramatic but at my level of inexperience, the title is what I'm left with. Hoping smarter people can point me in the right direction, so here goes... A google account used in a school ...
1
vote
1answer
151 views

Why request and response calls in my burp suite python plugin come in such random order?

So I am trying to write this burp plugin using jython and python for burp suite. Now in the processHttpMessage body, I found before a proper execution of the entire method takes place for one request ...
2
votes
1answer
72 views

How can I programatically keep track of number of certificate warnings in browser?

I want to keep a count of how many certificate warnings have been made in the browser over a period of several weeks. I also want to keep track of whether the user ignored these warnings and just ...
9
votes
2answers
2k views

How trustful are KeePass plugins?

KeePass is great, I love it but after several years using it, sometimes I wish to install a plugin but I don't because I'm scared of what this plugin can really do without my consent. The ...
3
votes
1answer
861 views

Metasploit. Is always replacing domain names with resolved ips on RHOST/RHOSTS?

There is a website which I want to audit. That site must have a concrete Virtualhost configuration because if you access to it using the domain name the website is shown, but if you use the ip address ...
66
votes
8answers
17k views

Why use HTTPS Everywhere when we have HSTS supported browsers?

I know that the browser's default protocol to access any site is http:// when https:// is explicitly not mentioned, but even then if we browse to a website say www.facebook.com, the response header ...
2
votes
1answer
177 views

Plugins to increase security of Chrome? [closed]

What plugins are there for Chrome, that would increase security while browsing the web? For Firefox I have used NoScript, Flashblock, and AdBlock Plus, are there equivalents to these plugins for ...
2
votes
4answers
73 views

Plugin / extension security practices

What kind of common security practices do software developers apply when allowing extensions or plugins to be added to their software, like e.g. Firefox, Photoshop and GIMP do? It can be either on ...
5
votes
1answer
654 views

Are inactive vulnerable Wordpress plugins still unsafe?

When you install a plugin in WordPress you can choose to activate or deactivate it. Let's say you have a plugin of which the latest version is vulnerable to XSS for example and you're waiting for a ...
6
votes
1answer
1k views

Detecting disabled Chrome plugins using JavaScript

My cable was on the fritz this weekend and I had to visit a friend to watch HBO online. Something weird happened that has been bothering me. I have disabled the Flash plugin on Chrome, since all ...
1
vote
1answer
474 views

Making an encrypted SMS app (Android) [closed]

From my limited googling I've noticed that a lot of the mainstream encrypted messaging apps all are either (or a combination of!) closed-source, run through an uncontrolled third-party server, use a ...
2
votes
2answers
150 views

What could a malicious website do if you don't update Adobe Flash?

If you click on "Activate Adobe Flash" when Firefox warns that "this plugin is vulnerable and should be updated", you can still use Adobe Flash. What could a website do to you if the "plugin is ...
1
vote
0answers
278 views

How Skype Click to Call plugin is used to send spam?

My friend had Skype Click to Call plugin installed within browser on Mac OSX. And his Skype account started to send some automatic spam messages linking to lose weight websites (via goo.gl) without ...
-1
votes
2answers
54 views

How secure are ActiveX based security plug-ins?

Sometimes I have to use web sites that use ActiveX security plug-ins. The websites say that these plug-ins 1. secure the authenticity of printable certificates 2. secure overall data sent back and ...
40
votes
3answers
21k views

Is Ghostery safe to use?

I've heard about Ghostery, a browser extension/plugin that blocks web trackers. But according to this link it sells our data. Are add-ons and plugins open source in Firefox? Is there another ...
16
votes
3answers
2k views

How secure is “Firefox Hello”? [closed]

The new "Firefox Hello" feature promises easy and safe video conversation. It is not nescessary to create an account, you simply share a link with your partner to start the conversation. The ...
11
votes
1answer
879 views

Virus attached or included in VST(i) Plugin

VST Plugins are DLL files available to be put into a folder in the Music Tool which then can use this as a plugin. Does VST have a mechanism not to execute malicious code inside the dll file? Can I ...
2
votes
1answer
1k views

Open source alternatives to tamper data

I'm developing a browser(firefox) plug-in which essentially checks for malicious input. My current approach is to store all input fields sent in GET/POST requests, try to heuristically determine ...
0
votes
2answers
447 views

Will Ad Block Plus block the ads that give someone Cryptowall 2.0?

Now I already know that making sure your browser plugins are either non-existent or up-to-date is one way of being on the safe side against ransomeware like Cryptowall 2.0; but since clicking ads are ...
1
vote
1answer
1k views

Is drive-by-download possible with NoScript?

I am using and getting my friends to use NoScript, and the argument I usually have to use to convince them is "It prevent website to infect you without you downloading something (by yourself)". But ...
0
votes
1answer
651 views

Ubuntu 12.04 server attacked using Wordpress vulnerability (plugin?) [duplicate]

Env Rackspace cloud server Wordpress 3.9.1 Ubuntu 12.04 Linux web.mydomain.com 3.2.0-67-virtual #101-Ubuntu SMP Tue Jul 15 17:58:37 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux History These may ...
1
vote
0answers
45 views

Question about the Perspectives add-on, is this dangerous?

When I visited Google and Facebook, and then clicked on the Perspectives add-on button to check the certificate information, I saw this:     What does this mean? Shouldn't it have ...
-3
votes
1answer
281 views

w3af plugin development example [closed]

I'm new to w3af, and I would like to build my own plugin. I have searched on w3af web and googled it for some examples but no luck... Can anyone give me an example how to start building plugins or ...
18
votes
3answers
2k views

What security risks does Firefox 19's built-in PDF reader (pdf.js) bring?

Firefox 19 ships with pdf.js as the default PDF reader. One of the main stated goals is to reduce the exposure of users to the often vulnerable Adobe PDF reader/plugin. So what new risks does pdf.js ...
8
votes
2answers
3k views

Will disabling the Java add-on in IE protect you from Java exploits?

Concerning the recent Java vulnerability (Should I be disabling Java?), the most common advise seems to be to disable Java plug-ins in the browser. However, Heise Security suggests that, when it ...
0
votes
1answer
428 views

Nessus doesn't find self-written plugins [closed]

I'm trying to write a nessus plugin. So I took an existing plugin (10056), and only added the line display("hello world"); in the appropriate section and altered the script_id to a non-existing one. ...
0
votes
2answers
322 views

What is Greasemonkey/Userscripts and how does it relate to IT Security?

I came across http://userscripts.org/ and learned that it is popular among web-users to install something called "Greasemonkey" to allow client side scripts to run. What are the benefits of ...
3
votes
2answers
5k views

Can Tamper Data (the plugin) modify multipart requests?

I'm doing some testing on my web app with Tamper Data. I've had success with Tamper Data in the past for normal HTTP post requests, but in this particular case I want to modify a post request that ...
4
votes
2answers
471 views

security and the well constructed Qt plugin

"All you'd have to do is build a plugin and you could completely pwn the software." I'm building an application using plugins. I think all you have to do is build a plugin and copy it into the ...
19
votes
2answers
3k views

Why do Chrome extensions need access to 'all my data' and 'browsing activity'?

Often I install simple add-ons for Google Chrome. However, they almost all need what appears to me as excessive access to my data. For instance, I install an extension that allows me to click on any ...
4
votes
4answers
619 views

Is silverlight and Java running on the web browser capable of saving “state” into the user's local machines?

I am aware that even after we have cleared our cache and cookies, websites can still save files/information into our computer using Flash (Flash ever cookies), I was wondering does other plugins like ...