Questions tagged [web-browser]

A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

Filter by
Sorted by
Tagged with
1 vote
1 answer
30 views

How does microsoftonline.com know which device I am on, and whether it is a registered device?

Most of the webprogramming and IT security I know is from ten years ago. I'm far from being a pro, so please keep my ignorance in mind when answering. Back then, browsers sometimes sent details about ...
0 votes
1 answer
18 views

Difference between the telegram (win1) desktop app and web interface when it is "managed by your organization"?

Sometime ago I was told by our cyber department that Telegram desktop app is not "safe" as it allows silent installation of programs (first I heard about it, and they could not back it by ...
0 votes
1 answer
45 views

Can websites, through cookies or other usual means, access PDFs opened in browser?

Can websites through the use of cookies or other usual means, see the content in a PDF (saved and opened locally or opened from the web) that is also opened in the browser at the same time, or in the ...
0 votes
0 answers
9 views

How to view TLS version and certificate of a website in Samsung Internet Browser [migrated]

Used to be able to click the padlock on the left side of url box and get the info from the popup screen. In newer versions there's still a padlock and a popup but can't access any TLS or cert info ...
  • 25
0 votes
1 answer
43 views

Logging secrets in the user agent (browser)

There are sound reasons not to put any secrets, PII or other sensitive information into the logs on the server side (see OWASP ASVS V7). But should the same rule apply on the client side? Is there a ...
0 votes
1 answer
61 views

How dangerous is it to visit a website?

I visited theannoyingsite (not hyperlinked because it is a nightmare) It tells you to press space for three seconds, and then it unleashes hell upon your senses. Loud noises, bouncing windows, ...
0 votes
0 answers
10 views

Are there any risks to pasting arbitrary Javascript code in web browser console and running it? [duplicate]

Due to failing IT infrastructure in Sweden, clever developers have provided ways of cheating the system to book train tickets (which is tremendously underdimensioned and failing due to high demand). ...
0 votes
0 answers
37 views

How to ensure safety while visiting malicious links in a VM? [duplicate]

Just wanted to ask how dangerous would it be to visit malicious links in a VM? The reason why I want to do this is to test out a tool I wrote that identifies malicious links from a database and ...
0 votes
1 answer
42 views

What techniques can web server use against user and how to prevent it?

As we surf the web and visit various sites there is a chance to visit malicious web site. I wish to know what methods can malicious web server use against it's visitor, and what can we do about it, ...
1 vote
1 answer
65 views

Website fingerprinting based on packet traces

Given a set of traces coming from different websites, where each trace is a packet. Assume we only know the time of arrival, size and direction of each packet. How do we go about fingerprinting these ...
1 vote
2 answers
119 views

Are browser extensions inherently unsafe?

If we're doing sensitive things in the browser, like logging into cryptocurrency exchanges, is it too risky to have any browser extensions, for fear that there's a virus or something in them?
18 votes
2 answers
4k views

Why doesn't a TLS certificate with a domain name mask that doesn't match the site name trigger a warning in the browser?

I visited stackoverflow.com and found in Chrome that its certificate is valid and has Common Name (CN) *.stackexchange.com. After that I checked a fingerprint for stackexchange.com and it matched ...
1 vote
1 answer
85 views

How to determine what process accessed the web browser

I received a CrowdStrike Alert where a particular user was using Chrome and the process was connected to the web browser but the user does not know what he did to connect to the malicious IP address ...
  • 11
0 votes
2 answers
109 views

Offline downloading: Can the website owner know that I’ve saved the page as webarchive while I’m not connected to the internet?

I noticed I can save a webpage as .webarchive file from my iPhone Safari while I’m offline. Basically what I did was to open the website, log in, go to the specific page, then when it’s finished ...
  • 3
1 vote
3 answers
130 views

Why don't applications suggest passwords themselves?

Imagine a web app that, on the login page, has a password field which does not allow user input, but just displays a client-only generated password that is reasonably strong, with a button to re-...
  • 227
-1 votes
1 answer
109 views

How much secure are modern browsers?

Modern web browsers like Firefox, Chrome and Chromium based browsers are getting new features everyday. They also have PWA. Unlike Android, browsers on Windows, MacOS, Linux and BSD don't run inside ...
  • 1
0 votes
1 answer
116 views

Alternative for secure browsing since Tor is too slow

What options for secure browsing are available these days? I always used Tor, but since the DDOS attack, even simple sites like google.com need almost 2 minutes to load. By "secure browsing" ...
1 vote
1 answer
200 views

Is the Web Crypto API secure when the server is trusted?

I've heard a lot of people say that the Web Crypto API is not very safe. For example: https://tonyarcieri.com/whats-wrong-with-webcrypto, Problems with in Browser Crypto. However, I'm looking to use ...
1 vote
1 answer
107 views

Does using a Hyper-V Ubuntu VM add more security when web browsing?

I've always been concerned that my casual browsing of the web directly from Windows 10 could infect my PC. How much added security (if any) could be obtained by using Hyper-V to run an Ubuntu 22.04 ...
0 votes
1 answer
202 views

Safest browser for iPad Air 1st Gen on iOS 12.5.5?

I have an old iPad Air 1st Generation with the latest supported iOS 12.5.5. How may I maximize its safety against system and browser vulnerabilities? I guess I should not use Safari? So is Brave a ...
  • 1
0 votes
0 answers
49 views

How to determine validation process of a certificate used by a website using HTTPS?

When visiting a website that uses HTTPS, we can see its certificate in the browser. But how can we know for sure which validation process the company or domain behind the website has gone through? ...
user avatar
0 votes
1 answer
88 views

What is the effect of the "&x=" in a SSRF? Is it something related to encoding?

I'm learning SSRF. I learnt that typing "&x=" kinda turn off the rest of an URL (like https://some.website.com/user?id=9&x=.website.com/api/item?id=9) Everything that comes after the ...
  • 3
0 votes
0 answers
43 views

Is tsheets.intuit.com a safe website? If so, why does it try to access a chrome-extension:// url?

This really doesn't seem safe to me, and I am wondering if there is a MITM attack happening or if this is somehow legit. I am worried something might be happening with my company's payroll data. Here ...
1 vote
1 answer
58 views

How does a device’s manufacturer’s webpage know that I just plugged in one of their products

I plugged in a wireless mouse receiver while browsing its manufacturer’s website. Browser settings that allowed sites access to USB devices were turned off. The manufacturer’s website, upon the ...
  • 25
0 votes
0 answers
38 views

How come remotedesktop.google.com can prevent the local OS from handling an Alt+Tab event on Chrome?

When I use Chrome Remote Desktop to connect to another computer, the webpage I'm looking at in Chrome (https://remotedesktop.google.com/...) is somehow able to prevent the local OS from handling an ...
  • 1
0 votes
1 answer
37 views

What other methods would an attacker use for making an HTTP request that isn't Fetch() or an XHR or using the DOM?

We are running user-submitted JavaScript, server-side to be executed within a headless browser that doesn't have a DOM or any child of the window or document or location objects - because these are ...
  • 47k
4 votes
2 answers
1k views

What will happen if I accept this "Change your search setting to: smartwebfinder.com"?

When I want to install Ultrasurf extension it gives me this message: So I do not understand what this "Change your search setting to: smartwebfinder.com" wants to do. When I go to this ...
  • 41
0 votes
1 answer
71 views

If software use encryption to protect one from ISP providers and other parties from snooping, how does this apply to browser software, esp. on mobile?

I believe the title says it all. As an example, let's say I use the Brave browser on a phone. From my understanding, all legitimate apps or computer software that connect to the Internet have some ...
  • 1
2 votes
1 answer
542 views

Adguard adds adware like JavaScript code to each page render. What is it?

I'm using Firefox 101.0.1 with the extension AdGuard from the official Firefox add-ons page. When this extension is activated, I find strange adware like JavaScript code with the dev tools, evaluated ...
  • 175
0 votes
2 answers
74 views

Most secure way to use a Raspberry Pi as a security cam

I want to make a security camera using a Raspberry Pi 3 B. I believe there are more ways of to view the video stream but one way I've found that seems very convenient is through a web server like in ...
  • 3
2 votes
0 answers
76 views

How are the values of stored firefox credit cards encrypted? And how does one decrypt those?

While researching about the safety of web browsers I made my own program that can decrypt stored credentials, cookies, and other information of different browsers to see for myself how easy it is. ...
  • 21
3 votes
1 answer
552 views

How is Paypal spying on my incognito browsing?

This weekend, Paypal started sending me emails with discount offers based on websites I visit in incognito mode on my phone. I have an Android smartphone and am browsing in incognito mode in Chrome. ...
  • 155
0 votes
1 answer
115 views

Another browser opens URL without logging in

I was required to log in and pay an invoice but for some reason the website did not work with Safari due to a cookie issue as suggested by the alert banner and asked me to use a different browser. I ...
3 votes
1 answer
156 views

Are CSRF attacks a thing of the past?

If the default value for the samesite directive in the Set-Cookie header is lax, then surely the only way for a CSRF attack to work, is if the website's developer, for some reason, puts a less ...
1 vote
1 answer
98 views

Databases for compromised passwords that browsers use

I am looking into databases of compromised passwords in order to ensure that passwords on a system I am responsible for are not already compromised. To have complete peace of mind, I prefer to get ...
  • 343
27 votes
5 answers
6k views

Is it safe to ignore/override TLS warnings if user doesn't enter passwords or other data?

A user is trying to access a poorly maintained website using a modern OS (Windows 10) and web browser (Firefox 100.0). They want to download something from there, but they are seeing a security ...
  • 381
9 votes
2 answers
2k views

Does the "auto formfill" feature in Chromium-based browsers actually send this to the webpage?

I use Vivaldi. I have previously filled in forms where I used a certain name and e-mail. Today I cleared the browser data except for the autofill stuff. Then I went to Stack Exchange to register an ...
  • 107
0 votes
0 answers
30 views

Is There an MITMf ScreenShotter plugin for modern tools like bettercap?

I am looking for a plugin like the ScreenShotter , which is capable of capturing a screen shot of other local network connected devices opened browsers pages using html5 canvas A demo of ScreenShotter ...
0 votes
0 answers
62 views

Verify frontend source code authenticity

I am developing a zero-knowledge web application. It stores user's data in an encrypted form, the encryption is done on the users browser, and I do not have the key. If implemented properly this ...
  • 389
21 votes
6 answers
9k views

What protects users from fake web browsers?

Suppose a hacker creates a Windows application that looks and feels like a legitimate web browser. The user believes they are using, say, Google Chrome. If you simply watched the bits going to and ...
  • 337
0 votes
1 answer
60 views

Encryption options when one-way secure channel is available

I would like to ask what encryption options are available for the following real scenario: There is an unsecure, full-duplex communication channel between a server and client There is also a secure ...
4 votes
0 answers
96 views

Is chrome not blocking all third party cookies?

I opened a website 99acres.com in incognito windows on two browsers on a Macbook. Following are the settings: Chrome Version: 100.0.4896.75 (latest) Third Party cookies: Disabled Firefox Version: ...
  • 141
2 votes
1 answer
160 views

Website with embedded PDFs and JavaScript for Acrobat

Context On my website, users can upload their PDF files, and then some, other users can view the uploaded PDF files. I was wondering if this could come with security issues. The uploaded PDF are ...
  • 21
0 votes
0 answers
26 views

Load url from CSS applied to element outside DOM

I was wondering if it's possible to kick off a network call by manipulating the style tag on an element outside the DOM (which could lead to potential SSRF if this were done server-side). I've tried a ...
  • 349
0 votes
0 answers
28 views

Can a website access your browser password vault using a button that the user clicks? [duplicate]

I'm asking this question because almost all new websites ask us to click Accept Cookies button. So I click it reluctantly. I am afraid that the Accept Cookies button action would trigger some script ...
  • 101
1 vote
1 answer
330 views

Browser sends cookie with "SameSite=Strict" attribute on another domain

I am solving PortSwigger's lab: "CSRF where token is tied to non-session cookie". For testing SameSite attribute I created a cookie in my browser with SameSite=Strict for domain https://<...
0 votes
2 answers
60 views

How to secure an enpoint to prevent programatic calls from the client?

We have a game that is built on the client side. People who get past a certain level are eligible to enter a raffle. This is done by sending a request to an endpoint from the client once they get past ...
  • 1
0 votes
1 answer
134 views

Why is Content Security Policy necessary given Same Origin Policy?

Given that Same Origin Policy prevents JavaScript from one origin from running in another origin and accessing another origin's cookies, why is CSP necessary? Is it that CORS selectively removes some ...
  • 472
20 votes
9 answers
9k views

Could videos be authenticated using private and public keys?

I saw a news report about now freely available software to make "deepfake" videos. Couldn't videos be internally marked using a private key, so that everyone could verify the originator ...
0 votes
0 answers
27 views

Best approaches to test collision detection in different browser fingerprinting approaches

There are various libraries available for browser fingerprint generation. Typically they generate a fingerprintId using some metadata from the browser. Given fingerprints from multiple libraries, ...
  • 101

1
2 3 4 5
33