Questions tagged [web-browser]

A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

Filter by
Sorted by
Tagged with
0
votes
0answers
24 views

How to easily browse through browser's image cache using autopsy?

I'm looking for a way to find images in all web browser cache folders. I can see a list of all images, and I can navigate folders. however, it is very time consuming if I have multiple data sources in ...
1
vote
1answer
107 views

Man in the middle using HTTPs downgrade to HTTP

In general browsers attempt to establish a HTTPs-Connection if possible. How would you force a browser to fallback to HTTP when somebody enters asdf.xyz in the search bar of his/her browser without ...
0
votes
1answer
41 views

Does Opera Android track me?

I used to think that this browser is safe and does not track me. Then I did little experiment - i went to specific webpage on Opera and next day I found ads for it on Facebook app. How did it happen? ...
0
votes
0answers
32 views

When do browsers block automatic redirects?

I am trying to understand various reasons where the browser would block redirects to another site. This lead me to have an understanding of why do sites have an interstitial redirect page which says ...
-1
votes
0answers
63 views

Why am I seeing this in my history? [closed]

I have never heard of this site, "receive-sms". I happened across it because it was in my recent chrome history. How does this happen? Am I using this without knowing or am I seeing things I ...
0
votes
0answers
42 views

XSS via Ajax request?

I'm currently honing in on my web exploitation skills and came across this JavaScript function here: Event.observe(window, 'load', function() { new Ajax.Request('/dir/dir', { method: 'post',...
25
votes
5answers
8k views

Can a website steal passwords saved in my browser?

Today I was on Steam and someone sent me a link and asked me to vote for him in some online gaming league. I clicked on it and the browser told me that this could be an unsafe link so I didn't proceed ...
1
vote
0answers
70 views

Why is web scraping software recognized as human?

I know that there are many open source projects that focus on web scraping and automation testing. The prominent ones are Puppeteer and Selenium. But these projects are not recognized as bots in ...
1
vote
0answers
44 views

My college manages my Google account, can they view my browsing history if I use a personal device on a home network while logged in?

I have found multiple sources telling me otherwise, but most are outdated by a year or two. If I am logged into my G-suite managed account on google, and search something up on a home network and ...
0
votes
0answers
22 views

How can the CSRF happen if browsers do not allow cross-origin requests by default? [duplicate]

How can the CSRF happen if browsers do not allow cross-origin requests by default? Brief CSRF overview, which is relevant for the question. CSRF is a type of attack (i.e. cross-site request forgery). ...
0
votes
0answers
28 views

Browser with flexibility for tool integration

Browsers don't allow a JavaScript to spoof/modify 'Host' header. It's a part of a browser's security. For a regular user that is a feature, for me that is a limitation in a context of my tool which ...
0
votes
1answer
49 views

CSRF Security Independent From Front-End

I'm trying to figure out if I completely understand CSRF security properly. Based on: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html In all ...
0
votes
0answers
47 views

communicate with security device from browser to encrypt/decrypt data

I would like to build a feature in my website that will store certain information. But i would like this data to be encrypted and decrypted by the user via a USB security device, such as the NitroKey. ...
8
votes
2answers
304 views

Solution to the ‘Browser Crypto Chicken-and-Egg Problem’?

From time to time, questions come up in this board concerning web applications that utilize client-side cryptography (or ‘in-browser’ cryptography), where these applications claim to be designed in ...
1
vote
1answer
125 views

Can I view a user's browser history if the history/cache has been cleared?

A client wants to track a specific employee's browsing habits. Assuming that the employee knows how to clear their browser history, is there any way to recover the history so it can be read by ...
1
vote
2answers
102 views

Open Backdoor in web browser using xss?

I am trying to learn about of xss attack and so I far, I understood that a successful attack result in the attacker capable of injecting malicious js in the victim's browser. If my understanding is ...
0
votes
1answer
75 views

What is the list of known host domains where subdomains come from different providers?

I recall that there is a list of hosting domains that are known to have subdomains from different sources, as for example wix.com and appspot.com, built into browsers. For such domains, subdomains do ...
0
votes
0answers
43 views

Passing confidential data to an IFrame

There are two different web applications Host and App which are hosted separatedly, i.e. in particular on different domains. App is not designed to be accessed directly. Rather users are expected to ...
4
votes
2answers
128 views

Does this registry entry for implementing custom protocol handlers in Windows present a security risk?

Background Some features are not yet available on the web platform and thus require cooperation with a native application in order to provide them. One method for a web application and a native ...
1
vote
0answers
52 views

Cookie is not being set after CRLF Injection in one domain but set in another domain. How can i bypass/set it?

Ok i am facing a very weird behaviour that sets and doesnt set cookie both. So, first i have found CRLF injection in 2 domains, redacted.de and redacted_another.com. When i go to redacted_another.com ...
1
vote
1answer
109 views

“Your connection is not private” for specific website, once when opening a new tab

Like many, since March, I've been working from home and using the company's VPN to do my work. Recently, if I open a new tab in Chrome, and navigate to "news.bbc.co.uk", I got the ...
0
votes
0answers
17 views

E2EE through a browser for multiple users and devices in a many-to-many scenario

I've multiple IoT devices that read and write streams of data (audio/video signals, sensory data, ecc...) and multiple users that can do the same, I should be able to interchange informations from one ...
0
votes
0answers
35 views

CSP Violation ms-appx-web://

We have a java application which allows users to upload attachments and save it on the server. The application has a content security policy defined like this: base-uri 'self'; child-src 'self'; form-...
0
votes
2answers
189 views

What's the deal with X25519 Support in Chrome/Firefox?

RFC8446/TLSv1.3 Section 9.1 says that "implementations SHOULD support X25519". An online list of software supporting Curve25519 list both Firefox and /Chrome as supporting it for TLS. I did ...
6
votes
1answer
206 views

How safe is it to store your passwords in a modern browser?

There's a few questions here along these same lines already, but they're nearly a decade old. I'd like to know if things have changed, especially now that Chrome has become more aggressive about ...
3
votes
2answers
187 views

Why would a certificate authority have multiple root certificates?

When I look at the trusted certificates in my browser, I see that many certificate authorities have multiple root certificates associated with them. For example, org-Amazon has Amazon Root CA 1, ...
0
votes
2answers
77 views

Safe mobile browsing

What actions can I take to make web browsing on mobile phone (android) as safe as possible? My main concern are sites that would install malware (has happened before on desktop computer). On a ...
1
vote
0answers
57 views

Allowing 3rd-party cookies in major 2020 browsers [closed]

I'm trying to get 3rd party cookies to work on major mid-year 2020 browsers [1]. It's as simple as pointing an iframe to an external URL to make a cookied request and probably get the response ...
0
votes
1answer
52 views

Tor Browser: Could a website or ISP detect modification to DOM done by users if Javascript is disabled?

I have Tor Browser (which is basically Firefox ESR) on "Safest" setting (Javascript disabled). We're generally scolded about using extensions in it, as they can alter web traffic patterns to ...
2
votes
1answer
118 views

Is javascript fingerprinting becoming obsolete?

Okta recently sent out an email to admins about changes to their new device detection strategy. According to them: Due to browser advancements in anonymous web browsing, JavaScript fingerprinting ...
0
votes
2answers
176 views

How do I access a website on my phone without it being able to determine that it was accessed from the same phone and location?

How is it possible to create an account in a website with completely different credentials without the website being able to link the user of the first account and this new one? Tor is not a viable ...
10
votes
3answers
5k views

How safe is opening any website on new browser tab?

When I do online shopping where I use my credit card information to purchase, I clear the browser cache, cookies and only open that single site. After I am done, I again clear the cache, cookies and ...
1
vote
0answers
35 views

What, if anything, are the consequences of temporarily enabling and then disabling WebRTC in Firefox?

For security and privacy purposes, it's best to keep WebRTC disabled if you aren't using it. Firefox makes this easy by simply setting media.peerconnection.enabled to false. Due to COVID-19, the use ...
0
votes
0answers
392 views

Is it secure to use services in Rambox?

Same question is asked for More secure to use e.g. Whatsapp Web in Franz than in browser? [closed]. On its answer it is said that: No, Franz is not inherently more secure than a regular browser. In ...
0
votes
2answers
140 views

Why do pop up ads automatically download .exe files?

I was using a movie streaming website, (the ones with all the pop-up ads at each click). Usually I just close the ad and nothing happens but recently when the ad pops up a .exe file is downloaded and ...
0
votes
1answer
117 views

Will there be a grace period for the CA change to mandatory 1 year?

As I can see some sites were working yesterday and today they are not working so my guess is browsers have a grace period set in them. certificate lifespans limited to 1 year in browsers. Maybe this ...
7
votes
2answers
224 views

Why is the use of TAB (%09) characters in the middle a 'javascript:' URL valid?

Some context: I was assinged on a pentest and found an application that let me place my own links in an a tag's href attribute. As expected, all strange values like javascript: were correctly filtered ...
0
votes
0answers
39 views

How safe is the built in browser on the iOS Facebook app?

There is no option in the iOS Facebook app to open URLs in an external browser by default (although you can open a link, and then choose to open it in Safari). How safe (mainly from a privacy ...
0
votes
0answers
82 views

Are web worker / service worker secure environments to store a password, credit card information, access tokens?

If there is a case where I wish to store sensitive data like a password, credit card information, or access tokens: Are web workers / service workers a secure environment, where such data can not be ...
0
votes
1answer
93 views

Why does Chrome display “Managed by Organisation”? [closed]

My wife inadvertently clicked on a flash player update and suddenly my chrome browser displays that it is being managed by an Organisation. I tried deleting chrome and reinstalling it but nothing ...
0
votes
0answers
129 views

Can someone explain the 'IE No Open' X-Download-Options Header, as enforced by Helmet.js?

I've been preparing to deploy an Express server using Helmet.js for some added security. I've been reading through their docs to make sure I understand what I am doing here, and I don't understand one ...
1
vote
0answers
68 views

Why are DNS prefetch requests sent in clear text with DNS over HTTPS enabled?

I am trying to understand how DNS-over-HTTPS (DoH) works in both Chrome and Firefox browsers. To do so, I have enabled DoH on each browser and set the DNS provider to Cloudflare DNS servers (1.1.1.1 ...
0
votes
0answers
65 views

Clear Browser Cache of Certificates Used for Authentication

We are using cert based authentication where the client sends a cert to the server, which is validated for authentication for a web application. This all works well. The problem happens when the user ...
-1
votes
1answer
51 views

LinkedIn connection marked unsafe

From time to time my LinkedIn connection gets marked as unsafe: no green lock next to the URL. First, I believed this was a browser issue, but after I switched to another browser, the warning did not ...
0
votes
1answer
41 views

Is it possible for a website to get information about you through its upload feature?

Reddit has a new image upload feature that takes a very long time to work after you click submit-- as long as 30 seconds. It isn't caused by the upload itself; that happens very quickly. I don't know ...
2
votes
1answer
49 views

Is possible to implement a Web Cryptography API custom provider?

I'm reading some basic info about Web Cryptography API and I'm wondering if is possible to implement some crypto provider (C/C++ library or something) with some extra algorithms or is mandatory to use ...
1
vote
1answer
74 views

Which approach is technically more effective to hinder user tracking - fingerprint generalization or randomization?

Tor's approach to countering fingerprinting is to make as many users "appear the same" as possible. Let us call this "generalization". While Brave tries to randomize all fingerprints of each and every ...
0
votes
0answers
37 views

Restricting website usage for Google Maps API doesn't prevent it from being used in the browser?

Say I've restricted my Google Maps API key to the website example.com/*. This would mean that no other website domains could use my API key to make requests to maps.googleapis.com. However, using the ...
0
votes
0answers
44 views

Taking advantage of subdomains for refresh token rotation in SPAs

Say I have three components in a system: An identity service, hosted at identity.mydomain.com A single page application, served from app.mydomain.com An API, protected by requiring a bearer token ...
0
votes
1answer
48 views

Credential theft by browser conferencing software?

While using the webex conference software, I noticed that simply pressing a "share content" button allows me to share my full screen. There was no security confirmation from my webbrowser (chrome): I ...

1
2 3 4 5
30