Questions tagged [web-browser]
A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.
1,627
questions
0
votes
0
answers
18
views
what are legitimate reason for a program to need access to /proc/self/mem [migrated]
I have noticed that both browsers Firefox and Chromium on linux do open the file /proc/self/mem for reading. No other program on my system reads this file, as far as I can tell.
/proc/self/mem is ...
- 223
0
votes
0
answers
3
views
Block specific URLs / URIs in browser, like the file:// protocol and other from being visited - How to set Browser policies [migrated]
How to block specific Uris or Urls in a browser? For example I don't want the file:// protocol can be visited or other specific locations by the user. Can I also add other policies and if so, how?
- 56
6
votes
3
answers
2k
views
ESTABLISHED TCP connections after opening browser in linux
I am using netstat -acp | grep ESTABLISHED command to check established connection
between with my system.
$ sudo netstat -acp | grep ESTABLISHED
tcp 0 0 rg-Vostro-3546:51874 server-18-...
- 177
1
vote
1
answer
66
views
Ways to safeguard Internet users from fraudulent websites
Extended Validation SSL certificates have been effectively abandoned, as web browsers do not even show them as something special, so my question is: how would you go about safeguarding the user from ...
- 2,267
0
votes
1
answer
51
views
Is it dangerous to publicly surf the web while my browser is being run in an IDE?
While developing web software, I typically run a browser (chrome) from my IDE. Here's an example launch.json in VSCode:
{
// Use IntelliSense to learn about possible attributes.
// Hover to ...
- 878
2
votes
1
answer
113
views
Is there any secure way to make sure that a request comes from a browser and via a specific domain (by just using frontend)?
Let us assume that we have a public API, for example, company.com/publicEndpoint, that can accept requests from any source. Various websites, like foo.com and bar.com, use JavaScripts that call this ...
- 21
0
votes
0
answers
46
views
Can WebASM provide JavaScript style interactivity without the same vulnerabilities?
JavaScript is useful for interactivity. However, it is often disabled by security conscious browsers, such as the Tor Browser Bundle, and blocked with plugins such as NoScript.
I was wondering if it ...
- 705
0
votes
0
answers
44
views
Is it safe to enable password sync on Microsoft Edge?
Microsoft Edge, as well as other Chromium browsers, have a password sync feature built into their browsers, which look something like the image below.
Before I enable this feature for convenience and ...
- 101
0
votes
1
answer
108
views
HTTPS/TLS security with an invalid certificate
I'm trying to use a site that's https but has it's own certificate, and when I add an exception it still shows it as unsecure, with an exclamation on the padlock and when I click the padlock it says &...
- 13
0
votes
1
answer
132
views
Web browser emulator [closed]
I'm looking for online web services [preferably free of charge] which allow you to enter any URL, a web page gets rendered on the remote side and you'll get the web page as a rendered image to avoid ...
- 2,267
1
vote
1
answer
71
views
Reducing web browser artifacts from a web developers perspective
Situation:
Let’s say, I am about to develop a website based on known means of its creation, which would be the luggage of HTML + JS/TS/PHP + CSS wrapped in some framework, e.g. Angular, React, Laravel,...
- 11
0
votes
1
answer
49
views
How do browsers defend the user against XSS?
I'm learning about the different mitigations employed by browsers against XSS vulnerabilities.
Let's say, the developer made a mistake and there is a XSS vulnerability on a site. Unfortunately, a ...
- 1
2
votes
1
answer
122
views
A web browser localy encrypted by default
Some years ago, I've found a web browser which I can't remember the name. It had pretty impressive security standards. For example:
Symmetric encryption key (password) is mandatory for saving ...
- 21
1
vote
1
answer
41
views
How secure is it to implement most of the applications functionality using WASM on the client side/ in the browser?
I understand that nothing is perfectly secured.
If we have a web app where most of the functionality is done inside the browser using WASM, can someone get the binary of that WASM and use most of its ...
- 113
0
votes
1
answer
44
views
How are Fetch Metadata Request Headers more secure than the Referer Header?
https://www.w3.org/TR/fetch-metadata/ for reference.
It seems like this is a simplified version of referer headers. Is the only advantage backend developer usability?
- 474
0
votes
0
answers
122
views
How can I monitor which page in the web browser is making a DNS request?
I manage a Microsoft environment and I use FortiClient EMS for our endpoint security. That system is logging blocked requests to https://h.parrable.com. As best I can tell, this is not a malicious ...
- 153
6
votes
4
answers
769
views
How can non-root intercept privileged loopback ports?
Please walk through how an attacker can intercept Chrome's connection to 127.0.0.1:999, as suggested by the warning below.
This warning is consitently displayed across many versions of Chrome in many ...
- 389
2
votes
3
answers
163
views
Is Chrome's view-source dangerous when visiting malicious sites? [duplicate]
What are the risks of viewing the source code of malicious pages on Google Chrome?
I want to go directly to view-source:https://example-site.com to visit the sites without rendering anything malicious ...
2
votes
1
answer
109
views
How does microsoftonline.com know which device I am on, and whether it is a registered device?
Most of the webprogramming and IT security I know is from ten years ago. I'm far from being a pro, so please keep my ignorance in mind when answering.
Back then, browsers sometimes sent details about ...
- 131
-1
votes
1
answer
39
views
Difference between the telegram (win1) desktop app and web interface when it is "managed by your organization"?
Sometime ago I was told by our cyber department that Telegram desktop app is not "safe" as it allows silent installation of programs (first I heard about it, and they could not back it by ...
1
vote
1
answer
59
views
Can websites, through cookies or other usual means, access PDFs opened in browser?
Can websites through the use of cookies or other usual means, see the content in a PDF (saved and opened locally or opened from the web) that is also opened in the browser at the same time, or in the ...
0
votes
1
answer
49
views
Logging secrets in the user agent (browser)
There are sound reasons not to put any secrets, PII or other sensitive information into the logs on the server side (see OWASP ASVS V7).
But should the same rule apply on the client side? Is there a ...
- 383
0
votes
1
answer
96
views
How dangerous is it to visit a website?
I visited theannoyingsite (not hyperlinked because it is a nightmare)
It tells you to press space for three seconds, and then it unleashes hell upon your senses. Loud noises, bouncing windows, ...
0
votes
0
answers
10
views
Are there any risks to pasting arbitrary Javascript code in web browser console and running it? [duplicate]
Due to failing IT infrastructure in Sweden, clever developers have provided ways of cheating the system to book train tickets (which is tremendously underdimensioned and failing due to high demand). ...
- 111
0
votes
0
answers
51
views
How to ensure safety while visiting malicious links in a VM? [duplicate]
Just wanted to ask how dangerous would it be to visit malicious links in a VM? The reason why I want to do this is to test out a tool I wrote that identifies malicious links from a database and ...
0
votes
1
answer
47
views
What techniques can web server use against user and how to prevent it?
As we surf the web and visit various sites there is a chance to visit malicious web site.
I wish to know what methods can malicious web server use against it's visitor, and what can we do about it, ...
- 131
1
vote
1
answer
84
views
Website fingerprinting based on packet traces
Given a set of traces coming from different websites, where each trace is a packet. Assume we only know the time of arrival, size and direction of each packet. How do we go about fingerprinting these ...
- 11
1
vote
2
answers
135
views
Are browser extensions inherently unsafe?
If we're doing sensitive things in the browser, like logging into cryptocurrency exchanges, is it too risky to have any browser extensions, for fear that there's a virus or something in them?
- 13
18
votes
2
answers
4k
views
Why doesn't a TLS certificate with a domain name mask that doesn't match the site name trigger a warning in the browser?
I visited stackoverflow.com and found in Chrome that its certificate is valid and has Common Name (CN) *.stackexchange.com. After that I checked a fingerprint for stackexchange.com and it matched ...
- 345
1
vote
1
answer
89
views
How to determine what process accessed the web browser
I received a CrowdStrike Alert where a particular user was using Chrome and the process was connected to the web browser but the user does not know what he did to connect to the malicious IP address ...
- 11
0
votes
2
answers
120
views
Offline downloading: Can the website owner know that I’ve saved the page as webarchive while I’m not connected to the internet?
I noticed I can save a webpage as .webarchive file from my iPhone Safari while I’m offline. Basically what I did was to open the website, log in, go to the specific page, then when it’s finished ...
- 3
1
vote
3
answers
131
views
Why don't applications suggest passwords themselves?
Imagine a web app that, on the login page, has a password field which does not allow user input, but just displays a client-only generated password that is reasonably strong, with a button to re-...
- 227
-1
votes
1
answer
172
views
How much secure are modern browsers?
Modern web browsers like Firefox, Chrome and Chromium based browsers are getting new features everyday. They also have PWA. Unlike Android, browsers on Windows, MacOS, Linux and BSD don't run inside ...
user281798
0
votes
1
answer
159
views
Alternative for secure browsing since Tor is too slow
What options for secure browsing are available these days? I always used Tor, but since the DDOS attack, even simple sites like google.com need almost 2 minutes to load.
By "secure browsing" ...
1
vote
1
answer
325
views
Is the Web Crypto API secure when the server is trusted?
I've heard a lot of people say that the Web Crypto API is not very safe. For example: https://tonyarcieri.com/whats-wrong-with-webcrypto, Problems with in Browser Crypto. However, I'm looking to use ...
- 63
1
vote
1
answer
140
views
Does using a Hyper-V Ubuntu VM add more security when web browsing?
I've always been concerned that my casual browsing of the web directly from Windows 10 could infect my PC.
How much added security (if any) could be obtained by using Hyper-V to run an Ubuntu 22.04 ...
0
votes
1
answer
293
views
How to harden the browser on an old iPad Air 1st Gen on iOS 12.5.5?
I have an old iPad Air 1st Generation with the latest supported iOS 12.5.5.
How may I maximize its safety against system and browser vulnerabilities? I guess I should not use Safari? So is Brave a ...
- 1
0
votes
0
answers
63
views
How to determine validation process of a certificate used by a website using HTTPS?
When visiting a website that uses HTTPS, we can see its certificate in the browser. But how can we know for sure which validation process the company or domain behind the website has gone through?
...
user279925
0
votes
1
answer
221
views
What is the effect of the "&x=" in a SSRF? Is it something related to encoding?
I'm learning SSRF. I learnt that typing "&x=" kinda turn off the rest of an URL (like https://some.website.com/user?id=9&x=.website.com/api/item?id=9)
Everything that comes after the ...
- 3
0
votes
0
answers
55
views
Is tsheets.intuit.com a safe website? If so, why does it try to access a chrome-extension:// url?
This really doesn't seem safe to me, and I am wondering if there is a MITM attack happening or if this is somehow legit. I am worried something might be happening with my company's payroll data. Here ...
- 109
1
vote
1
answer
65
views
How does a device’s manufacturer’s webpage know that I just plugged in one of their products
I plugged in a wireless mouse receiver while browsing its manufacturer’s website. Browser settings that allowed sites access to USB devices were turned off.
The manufacturer’s website, upon the ...
- 25
0
votes
0
answers
46
views
How come remotedesktop.google.com can prevent the local OS from handling an Alt+Tab event on Chrome?
When I use Chrome Remote Desktop to connect to another computer, the webpage I'm looking at in Chrome (https://remotedesktop.google.com/...) is somehow able to prevent the local OS from handling an ...
- 1
0
votes
1
answer
40
views
What other methods would an attacker use for making an HTTP request that isn't Fetch() or an XHR or using the DOM?
We are running user-submitted JavaScript, server-side to be executed within a headless browser that doesn't have a DOM or any child of the window or document or location objects - because these are ...
- 47k
4
votes
2
answers
1k
views
What will happen if I accept this "Change your search setting to: smartwebfinder.com"?
When I want to install Ultrasurf extension it gives me this message:
So I do not understand what this "Change your search setting to: smartwebfinder.com" wants to do.
When I go to this ...
- 41
0
votes
1
answer
81
views
If software use encryption to protect one from ISP providers and other parties from snooping, how does this apply to browser software, esp. on mobile?
I believe the title says it all.
As an example, let's say I use the Brave browser on a phone.
From my understanding, all legitimate apps or computer software that connect to the Internet have some ...
- 1
2
votes
1
answer
604
views
Adguard adds adware like JavaScript code to each page render. What is it?
I'm using Firefox 101.0.1 with the extension AdGuard from the official Firefox add-ons page. When this extension is activated, I find strange adware like JavaScript code with the dev tools, evaluated ...
- 175
0
votes
2
answers
93
views
Most secure way to use a Raspberry Pi as a security cam
I want to make a security camera using a Raspberry Pi 3 B.
I believe there are more ways of to view the video stream but one way I've found that seems very convenient is through a web server like in ...
- 3
2
votes
0
answers
98
views
How are the values of stored firefox credit cards encrypted? And how does one decrypt those?
While researching about the safety of web browsers I made my own program that can decrypt stored credentials, cookies, and other information of different browsers to see for myself how easy it is.
...
- 21
3
votes
1
answer
742
views
How is Paypal spying on my incognito browsing?
This weekend, Paypal started sending me emails with discount offers based on websites I visit in incognito mode on my phone.
I have an Android smartphone and am browsing in incognito mode in Chrome. ...
- 155
0
votes
1
answer
174
views
Another browser opens URL without logging in
I was required to log in and pay an invoice but for some reason the website did not work with Safari due to a cookie issue as suggested by the alert banner and asked me to use a different browser. I ...
- 3