Questions tagged [web-browser]

A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

Filter by
Sorted by
Tagged with
0
votes
1answer
72 views

index.html integrity

Is it possible to make browsers verify that index.html matches some checksum? Context: With subresource integrity, you can specify SHA hashes for URLs, so that you know that you are getting the ...
2
votes
1answer
92 views

Is this sufficient to verify a website's domain?

I'm building a browser extension that will run some javascript, which contains some sensitive information (essentially injecting authentication info). Therefore I want to make sure it only executes it ...
0
votes
0answers
14 views

What information leaks to a site that I am hotlinking images from? [migrated]

Suppose I have two websites: website A and website B. Website A hotlinks to images on website B. What information will visitors to website A be sending to website B? In particular, I would like to ...
0
votes
0answers
19 views

Where does Blazor store form data? [migrated]

Interestingly, some input elements of Blazor Forms don't have the data stored in HTML as value (attribute) of the input-field. The fields doesn't even have a value attribute! When I inspect and use '...
2
votes
2answers
92 views

using NoScript - what approach to use with randomnly named CDN scripts?

I ran across this on namecheap.com. This question isn't about namecheap.com itself, which I have no problem trusting. Rather, what approach do you recommend in dealing with CDN scripts that have ...
0
votes
2answers
90 views

Why not sandbox websites instead of using Same-Origin-Policy?

Why do Browsers implement a Same-Origin-Policy (SOP) to prevent open websites in the browser from executing scripts that may access / modify data of other open websites in the used browser? Another ...
-1
votes
0answers
72 views

Minimum (safest) firewall holes to create to connect to public WiFi networks and use a web browser?

What are the minimum (safest) Windows Firewall holes to make to permit Windows 7-10 computers to connect to public (secured or open) WiFi networks and browse the web with any modern web browser? ...
0
votes
0answers
72 views

How can I access a website without it being able to determine any information about my device, network or location?

Basically I want to be able to access a website without it being able to determine any of the things it dermined about me (my device, location, connection etc) when I accessed it last, no matter how ...
1
vote
0answers
25 views

SSO and browser vs. server

We've got implementations in a browser-based system right now that does both SAML and OpenID-connect login support, but does them differently and was looking for advice on the risks. Our SAML ...
0
votes
0answers
43 views

How safe is using private tor obfs4 bridges?

If you live in an oppressed country like China etc. then you must use tor bridges but if all the ISPs blocked all tor bridges (public ones) then you need to use private bridges which are not ...
0
votes
1answer
73 views

What attacks can be done from a “sketchy” internet site

I've heard that tabs in modern web browsers are fairly well sandboxed, so what kind of attacks could a malicious site do to your computer and/or web browser assuming you don't do anything obviously ...
-1
votes
1answer
100 views

Can WebAssembly execution be disabled in browsers?

I've recently found out about this new technology, which recently became a World Wide Web Consortium recommendation and also that now almost all main browsers support it and it is enabled by default, ...
2
votes
2answers
182 views

“Tor Profile” folder in Brave Browser cache

I am using Brave Browser Version 1.0.0 Chromium: 78.0.3904.97 (Official Build) (64-bit) on Ubuntu 18.04. The browser has an option, open new private window with Tor . When looking into cache files ...
-2
votes
1answer
63 views

What part of this request can be logged? [closed]

While testing a website i noticed a weird behaviour. When resetting the password a POST request with empty body is generated. The request is the following: POST /reset/token/[token]/passwhord-hash ...
2
votes
1answer
57 views

Is there any drawbacks of “accepting all cookies” while in incognito mode?

Since the GDPR landed, many websites have to inform you about their cookie usage and give you an option to enable/disable them for provider and for reason of storage. Say that I find a link I want to ...
2
votes
1answer
53 views

Code Change That Resulted in Database Fields and Values Exposed

At my company, we have a new development team that has been completely rewriting all of the code for different parts of the system. I've noticed that with one of the recent changes, you can now see ...
3
votes
1answer
133 views

A workaround for external website's HTTP registration page

There is a website which I want to register for but it is a internship/job-seeking website and thus on registration some VERY sensitive data is required. When registering Firefox alerted me that the ...
0
votes
1answer
109 views

Is there a vulnerability other than XSS which can result in client side script execution?

If the intention of attacker is to execute an arbitrary client side script in the context of a web application, is XSS the only possible attack other than compromising the server with an RCE or a sub-...
38
votes
1answer
5k views

Can a browser extension (Chrome, Firefox, etc.) read the web console log?

I realized that my bank handles sensitive information in the web console log, so my concern is if any browser extension could read the log?
17
votes
3answers
4k views

What use would a privacy browser, such as Firefox Focus for iPhone, have for an internal web server?

The Mozilla Foundation has a "privacy browser" called Firefox Focus that is available for example iPhone (here). This browser has an always-on ad blocking function. I was checking the third-party ...
0
votes
2answers
233 views

Why does Firefox (version 71.0 (64-bit)) indicate “weak encryption” but Google Chrome (Version 79.0.3945.88) does not?

I read that Mozilla uses its own trust certificate store but does "weak encryption" have anything to do with whether the browser trusts the certificate? Has it got anything to do with the signature ...
0
votes
1answer
97 views

Why is JavaScript executed manually from the browser console not allowed to access everything?

Why is JavaScripts executed manually from the browser console not allowed to access "everything"? Especially the "visited" status (see this question) of links? What kind of security threat would that ...
42
votes
7answers
5k views

Will the same JavaScript fetched by HTTP and HTTPS be cached separately by the browser?

Say that a web server supports both HTTP and HTTPS. If a browser fetches the same JavaScript with a HTTP GET and a HTTPS GET, and the JavaScript is cache-able, will the browser cache two copies of the ...
1
vote
1answer
163 views

Leaking details about the user in web application

Imagine a web application, which is used for getting og Open Graph tags from url. User can submit a form, which has single url input. Server opens the url in a headless browser, get og:title, og:...
7
votes
3answers
1k views

Why are file URLs marked as not secure while HTTPS URLs are marked as secure in browsers?

I understand that modern HTTPS protocols are secure enough for an average user. However, since these protocols need to fetch files from the server while the file protocol just tells the browser to ...
1
vote
1answer
102 views

Can somebody explain why the IP address 192.168.1.1 is apparently “special” and not following the CORS rules?

I asked this question: What would happen if some random webpage made an Ajax request for http://127.0.0.1/private.txt? The answers/comments confuse me. Am I right in interpreting them like this? "...
3
votes
1answer
128 views

Can a system administrator check if their website is being scraped by a headless browser?

A recent article on scraping tiktok and Facebook states: On the one hand running selenium headlessly is perfect to keep your machine “cool”, however it may help get you flagged as a scraper. System ...
1
vote
1answer
62 views

Posting from HTTPS without specifying protocol - secure?

I have a form that is on a secure (HTTPS) page, which posts to another page. In the form action, the protocol is not specified but I would assume uses the same protocol as the page that it came from, ...
1
vote
0answers
29 views

WMI Performance Adapter function for Chrome browser?

Does someone know why the WMI Performance Adapter (WmiApSrv.exe) always starts when launching Chrome browser? Whats the function of this service? I have heared this service can be maliciously used to ...
7
votes
3answers
388 views

Browser setups to stay safe from malware and unwanted stuff

I have to set up a browser to surf the internet. I'm trying to stay safe from malware as much as possible. (I already know that there's no way to stay 100% safe.) My idea is to use Firefox with these ...
0
votes
0answers
53 views

Is it a good idea from a security standpoint to disable Referer headers in the browser? What discomforts will you have to deal with?

So what kind of discomfort will you have to deal with? Will it break websites? Or is it just a win for privacy? You can disable the Referer headers in Firefox like this: Open Firefox and type “...
2
votes
0answers
88 views

Mirror site attack [closed]

I've created and published a .com web-application (nodejs-express in backend, react in frontend) with social-login (facebook, google, linkedin etc..). But I haven't gone out publicly to ask people to ...
4
votes
1answer
1k views

LastPass installer scary message about sideloading

I've been using LastPass for years, generally through the original Chrome extension. In recent months, certain features of the extension have been totally broken, such as the ability to share ...
1
vote
0answers
62 views

How do fingerprinting techniques involving Canvas and WebGL work?

Websites can fingerprint a web browser with techniques involving WebGL and HTML5 Canvas. The website like https://amiunique.org/fp shows an example of this. How exactly do these techniques work? I ...
2
votes
1answer
55 views

Offline HTML JS App

I designed a small webapp (I would rather call it browserApp) that helps me to automate a task. Now, I don't need a webserver to host this app as it is merely using js, jquery and other js libraries ...
0
votes
1answer
93 views

Remote extraction of passwords from browser password managers

I'm writing an essay about "Browser Password Managers". As part of this I have to write about vulnerabilities and exploits. I stumbled across the following scientific paper from 2013: "Password ...
2
votes
1answer
131 views

Browser copy function overridden silently, is this security risk?

I came across a site which overrides copy functionality and injects current page url as paste value. I was trying to select couple of words and instead it copied the page link. Simple developer tools ...
2
votes
0answers
57 views

Are there any JRE/JDK exploits that do not require the presence of applets or plugins?

For triggering a Java exploit should applets be enabled in the user's machine? That is, in a drive by download scenario, can just visiting a malicious URL trigger an exploit/cve on the user's pc due ...
3
votes
2answers
142 views

How do attacks on web browsers succeed? [closed]

We all know that attacks on web browsers are entirely possible. This includes attacks such as drive-by downloads, MITB (man-in-the-browser) attacks and keylogger browser plugins/extensions. However, ...
-1
votes
2answers
105 views

Do browser notifications threaten privacy/anonymity when using a VPN? [closed]

These: Do they threaten privacy/anonymity on a VPN? In this particular case, I'm using Opera VPN, which I thought might bear mentioning because it's a browser-based VPN, but I am asking about ...
2
votes
1answer
311 views

How to change the browser canvas html hash for fingerprinting?

building on this previous post Can canvas hash be used to track me and ruin my anonymity? I want to ask: Is there any way a user can affect this canvas html hash generation, a way to make the hash ...
28
votes
1answer
5k views

Is Dom based XSS still a valid security concern in modern browsers?

I am trying to understand how DOM based XSS work, e.g. from this post, I managed to reproduce it in IE11, but e.g. Chrome and Firefox are immune at least against this exact example. What happens is ...
0
votes
0answers
36 views

Microsoft Edge Unexpected Page Redirect Without Interaction

Upon opening Microsoft edge, I clicked on a homepage Fox News article about a new bill being introduced. While reading, I looked down and checked my phone, and looked up to see my browser redirecting ...
1
vote
1answer
79 views

In a content security policy header: Should the url's be quoted or not, and is there any security implication to this decision?

So in a CSP like the below: content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' https://stackexchange.com Should the url part be quoted like this (example from mozilla ...
0
votes
1answer
202 views

Can someone hack my Facebook if i give them my browser for a while?

As anyone can see network data using browser developer tool, can someone get access to my cookies or API keys by just turning on the developer tool in Chrome or Firefox? For example, imagine a ...
8
votes
1answer
207 views

How well do current browsers handle certificate revocation?

I am a Firefox user and recently stumbled upon the Liu, Yabing, et al. "An end-to-end measurement of certificate revocation in the web's PKI." Proceedings of the 2015 Internet Measurement Conference. ...
1
vote
0answers
128 views

Bizarre request being made from Chrome

I've been seeing a very weird request being made from my Chrome browser (haven't noticed it on Brave). It does not run on all websites, and not all the time (it can appear on a website, then after a ...
1
vote
2answers
454 views

Bypassing NET::ERR_CERT_DATE_INVALID

When I try to access the Openmailbox web site, Google Chrome returns a NET::ERR_CERT_DATE_INVALID error: "openmailbox.org normally uses encryption to protect your information. When Google Chrome ...
0
votes
0answers
51 views

Safest way to open PDFs on Android and iOS?

I was checking out Qubes' way of creating safe PDFs, but unless you use Qubes as a daily driver (and use DispVMs to open PDFs) it's still not viable to just use it to create image-based PDFs if you ...
3
votes
1answer
367 views

Browser not generating kerberos ticket

Firstly, please apologise me if I'm still confused about stuff here, Kerberos auth is quite the complex issue for a java dev So, I have the following scenario: A suite of webapps which use kerberos ...

1 2 3 4 5 28