2022 Developer Survey is open! Take survey.

Questions tagged [web-browser]

A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

Filter by
Sorted by
Tagged with
1 vote
1 answer
49 views

Are CSRF attacks a thing of the past?

If the default value for the samesite directive in the Set-Cookie header is lax, then surely the only way for a CSRF attack to work, is if the website's developer, for some reason, puts a less ...
user avatar
0 votes
0 answers
11 views

Which browser add-ons prevent downloading of malware when clicking a malicious link? [closed]

Which browser add-ons prevent you from downloading malware when clicking a malicious/infected link? Both Firefox and Chrome.
user avatar
  • 101
1 vote
1 answer
75 views

Databases for compromised passwords that browsers use

I am looking into databases of compromised passwords in order to ensure that passwords on a system I am responsible for are not already compromised. To have complete peace of mind, I prefer to get ...
user avatar
  • 331
-1 votes
0 answers
9 views

Is it possible to enforce CSS1 in browsers? [migrated]

I was recently surprised to learn that CSS2+ is Turing complete, and hence it is potentially dangerous, from the information security standpoint, to open websites containing CSS. That being said, if a ...
user avatar
27 votes
5 answers
6k views

Is it safe to ignore/override TLS warnings if user doesn't enter passwords or other data?

A user is trying to access a poorly maintained website using a modern OS (Windows 10) and web browser (Firefox 100.0). They want to download something from there, but they are seeing a security ...
user avatar
  • 381
9 votes
2 answers
2k views

Does the "auto formfill" feature in Chromium-based browsers actually send this to the webpage?

I use Vivaldi. I have previously filled in forms where I used a certain name and e-mail. Today I cleared the browser data except for the autofill stuff. Then I went to Stack Exchange to register an ...
user avatar
  • 107
0 votes
0 answers
11 views

Is There an MITMf ScreenShotter plugin for modern tools like bettercap?

I am looking for a plugin like the ScreenShotter , which is capable of capturing a screen shot of other local network connected devices opened browsers pages using html5 canvas A demo of ScreenShotter ...
user avatar
0 votes
0 answers
38 views

Verify frontend source code authenticity

I am developing a zero-knowledge web application. It stores user's data in an encrypted form, the encryption is done on the users browser, and I do not have the key. If implemented properly this ...
user avatar
  • 389
21 votes
6 answers
9k views

What protects users from fake web browsers?

Suppose a hacker creates a Windows application that looks and feels like a legitimate web browser. The user believes they are using, say, Google Chrome. If you simply watched the bits going to and ...
user avatar
  • 337
0 votes
1 answer
51 views

Encryption options when one-way secure channel is available

I would like to ask what encryption options are available for the following real scenario: There is an unsecure, full-duplex communication channel between a server and client There is also a secure ...
user avatar
5 votes
0 answers
59 views

Is chrome not blocking all third party cookies?

I opened a website 99acres.com in incognito windows on two browsers on a Macbook. Following are the settings: Chrome Version: 100.0.4896.75 (latest) Third Party cookies: Disabled Firefox Version: ...
user avatar
  • 151
3 votes
1 answer
79 views

Website with embedded PDFs and JavaScript for Acrobat

Context On my website, users can upload their PDF files, and then some, other users can view the uploaded PDF files. I was wondering if this could come with security issues. The uploaded PDF are ...
user avatar
  • 31
0 votes
0 answers
20 views

Load url from CSS applied to element outside DOM

I was wondering if it's possible to kick off a network call by manipulating the style tag on an element outside the DOM (which could lead to potential SSRF if this were done server-side). I've tried a ...
user avatar
  • 349
0 votes
0 answers
25 views

Can a website access your browser password vault using a button that the user clicks? [duplicate]

I'm asking this question because almost all new websites ask us to click Accept Cookies button. So I click it reluctantly. I am afraid that the Accept Cookies button action would trigger some script ...
user avatar
  • 101
0 votes
1 answer
62 views

Browser sends cookie with "SameSite=Strict" attribute on another domain

I am solving PortSwigger's lab: "CSRF where token is tied to non-session cookie". For testing SameSite attribute I created a cookie in my browser with SameSite=Strict for domain https://<...
user avatar
0 votes
2 answers
56 views

How to secure an enpoint to prevent programatic calls from the client?

We have a game that is built on the client side. People who get past a certain level are eligible to enter a raffle. This is done by sending a request to an endpoint from the client once they get past ...
user avatar
  • 1
0 votes
1 answer
39 views

Why is Content Security Policy necessary given Same Origin Policy?

Given that Same Origin Policy prevents JavaScript from one origin from running in another origin and accessing another origin's cookies, why is CSP necessary? Is it that CORS selectively removes some ...
user avatar
  • 412
21 votes
9 answers
9k views

Could videos be authenticated using private and public keys?

I saw a news report about now freely available software to make "deepfake" videos. Couldn't videos be internally marked using a private key, so that everyone could verify the originator ...
user avatar
0 votes
0 answers
19 views

Best approaches to test collision detection in different browser fingerprinting approaches

There are various libraries available for browser fingerprint generation. Typically they generate a fingerprintId using some metadata from the browser. Given fingerprints from multiple libraries, ...
user avatar
  • 101
0 votes
3 answers
126 views

Is there a way to scan a pdf to ensure it doesn't contain anything that could be a virus?

The answers to Can a PDF file contain a virus? show that clearly it can! Sometimes we can be quite sure a certain pdf should not need to do anything sophisticated - for example a book in pdf form - so ...
user avatar
  • 1,224
0 votes
1 answer
57 views

Browser Not Sharing Cookies Between Different Windows

I was quite surprised to find out that both Chrome/Chromium and Firefox share cookies between different windows, even in their privacy-focused modes. This seems a huge threat since it gives an ...
user avatar
0 votes
0 answers
56 views

What's the best way to handle authentication across multiple different domains under the same service?

For a social networking site example.com, users all have their own domains. How can you keep someone seamlessly authenticated across all domains? For the main site, example.com, I am currently using: &...
user avatar
  • 1
1 vote
1 answer
73 views

Is it recommended to set Referrer-Policy explicitly when the browsers already has a default policy?

I wanted to explicitly define the referrer-policy as "strict-origin-when-cross-origin" in my web application. However, "strict-origin-when-cross-origin" is the browser's default ...
user avatar
1 vote
3 answers
152 views

Verifiable alternative to screenshots for web browsers

Screenshots are generally held to be dubious evidence when presented in court because they are susceptible to alteration, especially when it comes to pages rendered in web browsers. You can use the ...
user avatar
  • 1,343
1 vote
2 answers
256 views

How can I make an SSL certificate for an IoT device trusted on all browsers?

I have a web server running on an IoT device, more specifically, on an ESP32. This web server serves a website that is used for managing the device and can contain some sensitive information, hence I ...
user avatar
0 votes
2 answers
105 views

Is it possible to send X-Forward-Host headers from client side?

I found a report on hackerone which is being awarded $200 for XSS via forwarded host header. It is a reflected xss and I was wondering how an attacker can attack the victim? Is there any way in ...
user avatar
0 votes
1 answer
94 views

How do you sniff information exchanged with a site which does not use TLS/SSL?

Whenever you visit a website without HTTPS (because for whatever reason there are still quite a few of them even in 2022) typically the browser will announce that you should not enter any sensitive ...
user avatar
1 vote
3 answers
134 views

What's the point of blocking third party cookies in incognito?

When using incognito, any data will be cleared when the session is closed. Then why do browsers have the option to disable them?
user avatar
0 votes
1 answer
50 views

Can I prevent credential leakage from csrf or xss attack if I check both cookie and token?

Suppose the server can provide one cookie and one token. Then I set them when the user login. The cookie was set to httpOnly and the token will be saved in localStorage. Both of them will be sent back ...
user avatar
  • 101
0 votes
1 answer
71 views

Multiple user sessions at the same time in a backoffice

I am currently working on a project for a veterinary practice and one of its components is a web-based backoffice for general management. The practice already has a backoffice-style software, but it's ...
user avatar
  • 1
1 vote
0 answers
197 views

Why can I watch videos on Crunchyroll without having DRM content enabled in Firefox?

The title pretty much covers the question. I'm using Linux and, whenever I go to sites like Amazon Prime and such, if I try to watch any of their videos, the player would error out in an error code ...
user avatar
  • 67
0 votes
0 answers
56 views

Can malicious code running in isolated Electron's renderer process send data to attacker's server?

I'm trying to evaluate if a malicious npm dependency running in Electron's app renderer process (which has sensitive information) could send data from the webpage out to an attacker's server (or trick ...
user avatar
0 votes
0 answers
60 views

What ways a website could hack a device? [duplicate]

Is it possible that clicking a link would hack a device? For example: injecting a malicious code into the device directly from the link's host website connecting to the device remotely in a way ...
user avatar
0 votes
0 answers
80 views

Prevent browsers from providing time zone info to webservers

I use Cloudflare's Warp VPN all the time for regular browsing and yet I recently found that Patreon can tell the country I'm physically located in. It baffled me how it could do so; Patreon could tell ...
user avatar
  • 101
0 votes
1 answer
150 views

What can happen when you click on a bad link? [duplicate]

I sleepily clicked on this bad link yesterday (DONT CLICK Unless you know what you're doing: https://6to.me/idsoni7kjv with a "?fbclid=" param - presumably identifying me) I'm wondering how ...
user avatar
  • 1
0 votes
1 answer
72 views

How can 2FA help prevent formjacking?

This article by Avira (part of NortonLifeLock) claims that 2FA (2-Factor Authentication) may be sufficient to protect against formjacking: Enable 2-Factor Authentication: Create strong and complex ...
user avatar
28 votes
4 answers
9k views

Do websites know which previous website I visited?

Suppose I am using a web browser to look at example.com. Now, from the same web browser tab, I enter example.org in the address bar and go to that completely different website operated by another ...
user avatar
  • 583
1 vote
2 answers
283 views

Virtual Yubikey [closed]

If reports are to be believed, Google and others are starting to force 2FA on user accounts starting late ~2021: https://www.theverge.com/2021/10/5/22710421/google-security-2fa-inactive-account-...
user avatar
  • 27
-1 votes
2 answers
153 views

Keep encryption password in javascript file hidden from browser debug tool

I'm sort of new to Frontend programming. I'm trying to build a PWA, it stores data (client data i.e: address, name, phones) to be ready in an offline state, for which I'm using localForage. I've ...
user avatar
4 votes
1 answer
305 views

Does using view page source on a possibly malicious site carry any real risks?

As far as I know, View page source does not execute any JavaScript, but is that good enough? Could there in theory be any vulnerabilities in the HTML parser or something similar? Have there been any ...
user avatar
1 vote
0 answers
106 views

GPU vs integrated graphics hardware, browser canvas fingerprinting, and multi- or dual-boot systems

My goal is to ensure that two operating systems installed side-by-side on the same device are unable to return the same canvas fingerprint, when a modern browser is allowed to run javascript without ...
user avatar
  • 769
0 votes
3 answers
402 views

Does SOP prevent a class of CSRF attacks?

Just want to settle a debate I'm having with someone. Suppose there is no SOP. Via an XSS exploit, code can run on website A.com and submit an XHR request to B.com. Suppose B.com stores an auth token ...
user avatar
  • 11
0 votes
1 answer
275 views

How to resist JA3 fingerprinting while browsing using common browsers (e.g. Firefox, Chrome, etc)

Background. Context. I use Firefox, Google Chrome, or Chromium on Linux. Question. How to have my browser resist the JA3 fingerprint, so that sites don't identify me by it? Thoughts. I guess it may ...
user avatar
  • 142
0 votes
1 answer
108 views

How to detect whether request to a URL from a system is made through a browser or through a software/malware

I am using FortiAnalyzer-VM64 v6.4.2 GA build2122. Many requests are logged in my firewall/UTM log that are to malicious websites. Although these requests are blocked by the UTM, the problem is that I ...
user avatar
0 votes
3 answers
213 views

Github knows where I have used my password

How can the operator of Github detect whether or not my password applied on their website is commonly used by me on other websites? I have received a warning message from them forcing me to change my ...
user avatar
1 vote
1 answer
164 views

Does enabling SharedArrayBuffers via service worker headers create Spectre vulnerability?

In browsers, use of SharedArrayBuffer is restricted to sites with the following HTTP headers because otherwise it exposes vulnerabilities to Spectre and Meltdown. Cross-Origin-Embedder-Policy: require-...
user avatar
0 votes
3 answers
148 views

Can I use some modified browser for gaining upper hand on a front-end?

Browsers follow certain standards to securely render webpages and execute scripts. But it's all in browser. An example is that I can't access stuff inside a JS module from the browser console. What if ...
user avatar
5 votes
3 answers
271 views

Realistically, how likely it is to have a computer compromised from browsing random websites?

Another question inspired by a recent discussion in the 'The DMZ' chatroom. Long story short: IT guys are worried that accountants' workstations may become compromised because accountants watch cat ...
user avatar
  • 5,587
0 votes
0 answers
102 views

What is the possible impact of inserting user input into image src?

A website takes user input and pass into img src. What is the possible impact that I can do with it? <img src="https://website.com/static/{user-input}"> I did think of some options: ...
user avatar
0 votes
0 answers
109 views

How do developers prevent a third party from looking at exposed information on a javascript console? For example on a public computer

If a user was using your application on a public computer and were to log out of your website without closing the tab, the next person to use this computer could snoop through the console and look for ...
user avatar

1
2 3 4 5
32