Episode #125 of the Stack Overflow podcast is here. We talk Tilde Club and mechanical keyboards. Listen now

Questions tagged [web-browser]

A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

Filter by
Sorted by
Tagged with
28
votes
1answer
5k views

Is Dom based XSS still a valid security concern in modern browsers?

I am trying to understand how DOM based XSS work, e.g. from this post, I managed to reproduce it in IE11, but e.g. Chrome and Firefox are immune at least against this exact example. What happens is ...
-1
votes
0answers
17 views

can someone start the msftconnecttest? [on hold]

as i was away from home. i came home to a computer with a login screen to one of my networking devices (provides wifi and stuff) in a browser (firefox) tab. i checked the history and found that the ...
0
votes
0answers
32 views

Microsoft Edge Unexpected Page Redirect Without Interaction

Upon opening Microsoft edge, I clicked on a homepage Fox News article about a new bill being introduced. While reading, I looked down and checked my phone, and looked up to see my browser redirecting ...
0
votes
0answers
47 views

What are the most prominent attacks on web browsers and browser users one should know? [closed]

As a topic of inquiry, for those looking to gather insights into browser security, what do you consider as the most prominent attacks on browsers and the users of browsers, especially the ones that we ...
1
vote
1answer
62 views

In a content security policy header: Should the url's be quoted or not, and is there any security implication to this decision?

So in a CSP like the below: content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' https://stackexchange.com Should the url part be quoted like this (example from mozilla ...
0
votes
1answer
186 views

Can someone hack my Facebook if i give them my browser for a while?

As anyone can see network data using browser developer tool, can someone get access to my cookies or API keys by just turning on the developer tool in Chrome or Firefox? For example, imagine a ...
4
votes
1answer
94 views

How well do current browsers handle certificate revocation?

I am a Firefox user and recently stumbled upon the Liu, Yabing, et al. "An end-to-end measurement of certificate revocation in the web's PKI." Proceedings of the 2015 Internet Measurement Conference. ...
1
vote
0answers
111 views

Bizarre request being made from Chrome

I've been seeing a very weird request being made from my Chrome browser (haven't noticed it on Brave). It does not run on all websites, and not all the time (it can appear on a website, then after a ...
1
vote
1answer
68 views

Bypassing NET::ERR_CERT_DATE_INVALID

When I try to access the Openmailbox web site, Google Chrome returns a NET::ERR_CERT_DATE_INVALID error. The details state that "openmailbox.org normally uses encryption to protect your information. ...
0
votes
0answers
42 views

Safest way to open PDFs on Android and iOS?

I was checking out Qubes' way of creating safe PDFs, but unless you use Qubes as a daily driver (and use DispVMs to open PDFs) it's still not viable to just use it to create image-based PDFs if you ...
3
votes
1answer
132 views

Browser not generating kerberos ticket

Firstly, please apologise me if I'm still confused about stuff here, Kerberos auth is quite the complex issue for a java dev So, I have the following scenario: A suite of webapps which use kerberos ...
41
votes
4answers
6k views

What benefits are there to blocking most search engines?

While on a client's site using the corporate network, I see that only a few search engines are allowed. Google and Bing, possibly others; while my fav DuckDuckGo is blocked, and a few others that I'...
1
vote
1answer
52 views

Domain fronting through browser context [closed]

I am interested to see if it's possible to have domain fronting through a web browser, using any of its components (e.g. javascript) which can be utilized by the user. For example, i've tried through ...
0
votes
2answers
101 views

Can JavaScript from different origins communicate securely

I want to know if there is a way for JS from one Origin to delegate a task to JS from another origin in a secure way. The use case is to have a JS Agent from the users' home origin use the ...
-1
votes
0answers
28 views

Browser that cannot be fingerprinted? [duplicate]

I was using Tor Browser (some kind of Firefox) which is supposed to be immune to fingerprinting, but when I visited https://fpjs.io/demo I was surprised to see that every time I changed the identity ...
0
votes
1answer
81 views

Is there a danger to client port scanning?

Are there any security risks associated with client-side port scanning? Or, more specifically, a "trusted" site (e.g., banking website) loading javascript trying to connect to various localhost ports? ...
-1
votes
1answer
132 views

How is this allowing me to bypass recaptcha [closed]

I was testing rate limit on the login page of a site. It was captcha protected. I could not even intercept the POST request on burp, so from Google Chrome I looked at the logs and in its POST request, ...
-7
votes
1answer
216 views

Honeypot for hunting browser zero-days, rootkits and malware [closed]

I would like to create a honeypot (bot) to hunt browser zero-days (and browser extensions). What is the best way to find those 0days automatically (I would like to create a sandboxed bot which would ...
-2
votes
1answer
137 views

How common is the usage of browser zero-days in the wild?

We have an overview with known but fixed vulnerabilities for this browsers: Google Chrome, Mozilla Firefox and Internet Explorer. Such lists exist for many other browsers too. We also have such ...
2
votes
0answers
141 views

Is it still possible to use HTTP TRACE for XSS in modern Web Browsers?

Let's assume we are talking about top 10 most used web browsers: Usage share of web browsers https://www.cgisecurity.com/questions/httptrace.shtml 'TRACE' is a HTTP request method used for ...
12
votes
3answers
4k views

How to decide whether an eshop is safe or compromised

So, I am having this issue where I want to buy a specific wacom product but their online store eu-store.wacom.com and us-store.wacom.com, even though it is being accessed through https, does not ...
2
votes
3answers
227 views

Why is it not possible for browsers to completely detect the Phishing pages?

The browsers have some capability to detect the phishing pages, but they are not able to detect all. Why is that? Phishing still remains to be one of the most convenient way to hacking. Why is it not ...
0
votes
0answers
39 views

Url Storage, History & Personal Data

Just Curious to Know, Where my information is being stored and how long its kept for I'm running the latest version of windows 10, my main Browser being firefox developer edition 68. I clear my ...
10
votes
5answers
5k views

Running code generated in realtime in JavaScript with eval()

Consider a front-end JavaScript application where menu items needed to be shown or hidden based on somewhat simple logic (roles that user has and some other logical state). A simple language was ...
2
votes
1answer
147 views

Should a browser make its own password manager? [closed]

I'm trying to figure out if products such as Firefox's Lockwise are a superb idea or a terrible one. On the one hand, installing a third-party addon to your browser comes with inherent risks, so ...
0
votes
5answers
347 views

How do keyloggers tell it's a password? (And how to fool them.)

This question also applies to clipboard monitoring. Imagine you are planning to deploy 100,000 copies of a Windows trojan with keylogger functionality. (For the record, I'm not talking about myself ...
0
votes
2answers
77 views

is it possible to bypass cookie protection to perform a CSRF on HUAWEI HG531 v1 router?

the AJAX login script var xhr1 = new XMLHttpRequest(); xhr1.open("post", 'https://192.168.1.1/index/login.cgi', false); xhr1.send("Username=admin&Password=...
2
votes
1answer
75 views

Are there any security reasons for an organization to disable browser session restoration?

Does the browser setting to restore the previous session on startup pose any security concerns on a machine with separate logins for each user? Are there any security reasons for an organization to ...
1
vote
2answers
134 views

What can a 3rd party learn about a user through only CSS and images?

In its default settings, uMatrix content blocker allows CSS and images (JPG, PNG, etc) from all sources, unless denied by a site-specific block list. It also allows 1st party cookies, scripts, and ...
0
votes
0answers
76 views

How do I create a secure authentication service which works both for web apps and mobile apps?

As far as I am aware the best way to securely store session data on a client is to use an HTTP-only, secure cookie + HTTPS on a browser and to store a (JWT) token in a secure place for a mobile app. ...
1
vote
1answer
40 views

Having web client do requests with User's 3rd party API key?

I am trying to figure out the best way to do this. I have done some searching and all I have found is about storing API keys in a back end, nothing like my use-case where there is no back end. ...
1
vote
3answers
206 views

Why do web browsers provide websites with plain text passwords? [duplicate]

Suppose I sign up for website.com with username "John" and password "Secret". Currently the webbrowser supplies website.com with my real plain text password, and we must trust them to salt and hash ...
0
votes
0answers
21 views

Certificate Pinning with SockJS

What is the SockJS way of pinning SSL Certificates in the client side when contacting wss:// to avoid CA trust? FYI, when using modules like HTTPS or WS, we can listen to the socket event and then on ...
0
votes
1answer
96 views

How to stop other programs from reading passwords stored in my browser?

I was very surprised and alarmed to see that a free software could list passwords stored by browser in plain text. I thought that these passwords (such as the ones for email) are encrypted and can't ...
0
votes
2answers
209 views

Why is 0.0.0 an associate of 0.0.0.0? [closed]

When i redirected a single webpage to an address http://0.0.0, i also found that 0.0.0 is an alias of the network address, but since it is only 3 bytes, this seems to be strange. Why would chrome and ...
1
vote
1answer
304 views

How can Instagram cause Chrome to attempt to login and show me my username when I'm using incognito mode?

When I reach Instagram user pages while in Incognito mode, Chrome pops up a window with my non-incognito username asking whether or not to sign in. See screenshot below. Although I assume Chrome ...
-2
votes
1answer
144 views

Reason for fake academic pdf files found on sites like Google Scholar? [closed]

Using my web-browser, I clicked a link on Google Scholar that led to a fake paper (in .pdf format). The pdf contained many keywords and phrases related to the research topic, possibly for search ...
-1
votes
1answer
77 views

How to delete browser malware? [closed]

I've got some malware so now my browser is sending requests to strange sites: Also if I click on any html element in a browser It may redirect me to unwanted pages I've tried to fix this using ...
0
votes
0answers
26 views

Personal file separation in office workstation

Background: The company I work for is SOC2 and some other Compliant. So to comply with that regulatory compliance they asked us to install SolarWinds RMM agent in our workstations (Not production ...
0
votes
0answers
309 views

“We noticed you’re browsing in private mode.” — how do they know? [duplicate]

I sometimes get messages such as the following from newspapers' web sites (Washington Post and New York Times): We noticed you’re browsing in private mode. Private browsing is permitted exclusively ...
-2
votes
1answer
109 views

Inspect Element Prevention?

I was just actually wondering if there is a permanent way of preventing or disabling inspect element on client-side? Assuming with inspect element you could change values in hidden forms as well as ...
4
votes
2answers
190 views

Is it possible to track/save Google searches that were never submitted?

When you start typing out a google search, it lists a bunch of options to autocomplete your search. This made me wonder how that autocomplete works. Is there a cache stored somewhere in the browser? ...
0
votes
0answers
37 views

Browser Exploiting - Using SyncManager to keep Service Workers alive forever

I just read the paper "Master of Web Puppets: Abusing Web Browsers for Persistent and Stealthy Computation". The authors claim to use the SyncManager Interface in order to keep Service Workers alive ...
-1
votes
2answers
94 views

CDN change for “enhanced security”? (now uses cookies)

For the past few months, I've been unable to continue a particular course on udemy. I can access all other video courses accept that particular course and their support has answered "We recently ...
3
votes
1answer
96 views

What mechanism does Firefox use to remember the in-session logins, after entering the Master Password?

After I have entered my Master Password, does Firefox decrypt all the logins and store them somewhere? Or does it store the Master Password itself? Is the in-session period (more) vulnerable to attack?...
1
vote
1answer
107 views

How to hide my platform from a browser to keep my privacy? [duplicate]

I just visited https://amiunique.org/fp in order to try to understand what makes a web page realize what platform it is running on, aside from User-Agent request header. So I learned about window....
1
vote
2answers
181 views

Is LocalStorage in web browsers safe enough to store passwords?

I currently have a system I'm building where users can enter an email address and password into my login page, and if they click the signup button after doing that, it stores that data in LocalStorage,...
0
votes
1answer
316 views

How can I inject cookie from Wireshark into a browser sesson [duplicate]

For education and research purpose, I need to inject a cookie value into my browser to allow me login indirectly (without entering the user name and password). I collected traffic during a login ...
1
vote
1answer
83 views

Is using a web service in a browser safer than running it natively installed? [closed]

let's take a theoretical app that has both an installable version and a web version. I use it via my web browser or I can install the app. What are the safety considerations for the host operating ...
0
votes
2answers
160 views

Does HTTP:// to HTTPS:// redirection means strict HTTPS from server

when I try to connect to some websites using http:// (notice the absence of s) , my client end up with https://. I use python requests for this purpose, which simulate a client behavior. It performs ...