Questions tagged [websites]

Applications or informational pages, distributed via HTTP or HTTPS, using a web server. Pages are typically interconnected by hyperlinks and may contain forms or even entire applications.

Filter by
Sorted by
Tagged with
0
votes
0answers
70 views

What does this website do? [closed]

My brother received the following website link from his friend telling him to open it: http://toddphelps.com//dHtKFTqXovg2ump/fcbg/?cat=3&i=1778287 Unfortunately he opened it before telling me ...
0
votes
0answers
63 views

What kind of virus this website have? [closed]

I found website https://coronavirus-map.com and send it to a friend, then he said this website have a virus because his antivirus detect this website like virus. I didn't know that websites can have ...
1
vote
1answer
57 views

Which has to handle certificate, a website, a web server or a web application?

In web, what is a certificate issued to, a website, a web server or a web application? Which has to handle certificate, a website, a web server or a web application? For example, when I run a web ...
0
votes
0answers
89 views

How to prevent bots from checking out on my website

I am developing a website to sell a product that is very likely to be botted. The reason people will bot it is not to spam me or anything, but because they want to buy the product faster than anyone ...
1
vote
1answer
45 views

What is a login flow method to prevent account jacking when your website has Email/Password sign in AND Google Sign in?

For example, my website has Email/Password login and the "sign in with Google" button. If a user creates an account with their email and a password, then decides to sign in using the "sign in with ...
1
vote
2answers
72 views

Risk of getting MySQL database compromised with a client application

I want to make a client-side, Windows-based application that allows the user to register and it will store the registration details in an online MySQL server. However when i googled ways to do this, ...
0
votes
4answers
147 views

Can a website be used for targeted attacks?

I asked a question before about how you can tell that a website is safe to visit (to prevent yourself from getting hacked) and I was told that it can not be done. A virus scan with virustotal will not ...
1
vote
1answer
102 views

Would my IP be recorded when I visit a website

Could the website owner (admin) determine whether to record users IP? If the website owner (admin) doesn’t want to record users IP, will the host provider or domain name provider still get and record ...
1
vote
2answers
135 views

How can it be that I can't register on a website while my VPN is on

I've had problems with making a account on a website (https://etsy.com) I tried different browsers, disabeling all my plugins with no succes. I use a VPN service that automaticly turn on when I start ...
0
votes
1answer
58 views

How to judge website security?

How can I know if visiting a website is safe? Is a scan with virus total good enough? If it says that the website is clean then can I be sure that I won't get hacked by visiting it? Could a website ...
4
votes
3answers
206 views

Is There Any Risk When Visiting Websites Without Secure Connections If You Don't Enter Personal Info?

Sometimes when I click on a link to a website, from google search, etc., I get a warning that says "Your connection is not private. Attackers may be trying to steal your personal info", and makes me ...
1
vote
1answer
48 views

Can website exploit kits contain bootkits?

Can a website exploit kit theoretically contain a bootkit (it flashes your UEFI/BIOS)?
0
votes
1answer
79 views

security issues related to setting cookie using an <img> tag

Site A will be having an <img> tag with src= attribute as an absolute URL pointing to site B. Site B will return an image response, and in that response a cookie will be set (cookie of Site B's ...
23
votes
4answers
5k views

More than three domains hosted on the same IP address

Not on purpose I did a reverse IP address look up on my site, and it shows that there are three other websites hosted on my server, and now I'm worried. My web is arturofm.com, and here is the lookup:...
1
vote
3answers
109 views

Is exposing enumerated id's a bad idea if precautions are taken?

Say I have a website that has the URL website.com/student/{studentId}/courses for retrieving all the courses a student is enrolled in. The studentId is an auto-incrementing value in the Student table ...
0
votes
2answers
55 views

Scraping data from a form submission on another domain

I’m currently researching a possible security vulnerability I may have found on a well-known website. Before I present to the company, I’d like to build a proof of concept. I’m looking at a site (...
1
vote
2answers
80 views

Should I trust AutoFull.com? [duplicate]

I want to buy a chair from this website http://www.autofull.com/ but the entire website says it is "not secure" except when I press the "settlement/pay now" button and it takes me to a new website ...
2
votes
1answer
283 views

Why are many Security sites not using HTTPS? [closed]

I've seen a lot of websites by security teams & companies which use HTTP instead of HTTPS. I'm using HTTPS Everywhere and have found even some medium-big groups not using HTTPS. I'm a noob at ...
0
votes
1answer
676 views

Satoshi Nakamoto Renaissance Holdings' website is Wordpress? Is it safe? [closed]

So, Satoshi Nakamoto, creator of Bitcoin has announced that he will supposedly be revealing his real identity. I find the fact that Satoshi's company website is hosted on Wordpress to be endlessly ...
0
votes
1answer
123 views

Firebase ports scanning using nmap

Purely for research purposes used nmap to check security of my application deployed to Firebase. However, there some questions which I can't understand: Why Firebase has open so many ports? Something ...
1
vote
1answer
67 views

Websites with HTTP and HTTPs pages [closed]

I saw a website which consists of HTTP and HTTPs parts. that is, the website (80% of it) is over HTTP where as the Payment page is over HTTPs. So would that website be considered as safe ? Can it ...
1
vote
3answers
207 views

Why do web browsers provide websites with plain text passwords? [duplicate]

Suppose I sign up for website.com with username "John" and password "Secret". Currently the webbrowser supplies website.com with my real plain text password, and we must trust them to salt and hash ...
0
votes
1answer
85 views

website legitimate or not, how to evaluate? [closed]

how to know which website is secure to open ? i.e. https://cdn.redhat.com/ why am I getting a security notification even when the site relates to Redhat ? Thanks
2
votes
1answer
149 views

Is it a good rule of thumb to keep a URL as short as possible?

I was wondering if there are any security risks of having too long URLs for an internet site. Of course there are things that don't matter if they're long or not, i.e. the actual hostname and ...
2
votes
2answers
204 views

No limit of characters in name field - Any risk?

I want to know what security vulnerabilities could have a website that in the name field there is no character limitation. so there could be 100 characters or 10k. My first idea is that it can could ...
1
vote
1answer
263 views

How to find a website behind a Firewall? [closed]

Some context for my question: I'm currently studying Information Security, and this is for an assignment from my teacher. For my assignment, I received two IP addresses. I did a port scan with nmap ...
1
vote
3answers
162 views

How can a scammer scan your data if you're redirected from their fake website to the legitimate website?

Coming from this comment from this question at Travel StackExchange. My question is: How can the scammer still scan a user's data when the user registers their account on the legitimate site, after ...
22
votes
2answers
5k views

If the Charles SSL Proxy shows me sensitive data, is that data insecure/exposed?

Today I was exploring a website used for keeping track of student grades and everything related to school. Basically like a school progress tracker for your child which is used by 90% of schools in my ...
1
vote
2answers
619 views

Is it possbile to conduct http header injection attack with a web site or web app uses https?

If a web site or web application is running with https, is it possible to conduct http header attacks like http header injections and so on?
5
votes
2answers
750 views

CSRF token unique per user session - Why?

OWASP recommends that a CSRF token should be unique per user session. What is the attack vector or reasoning behind that? How could an attacker exploit a web application that does not invalidate the ...
33
votes
4answers
9k views

What is more safe for browsing the web: PC or smartphone?

The scenario is: somebody without concern about security is navigating through the web. This person will access doubtful websites, like adult content or media sharing, for example. Between a pc with ...
1
vote
1answer
88 views

Will SIM‐like PIN on website as second password increase security

On SIM cards, which are used in mobile telephony, PIN (and PUK) is used. Unlike a password, they are locked after some incorrect attempts to prevent brute force attack. If wrong PIN is entered 3 times,...
1
vote
3answers
125 views

Security concerns around sharing secret on a website

I need to share credentials with users. These credentials are created when the user wants them, but cannot be chosen by the user specifically (AAD credentials). I want to share the same with the user ...
0
votes
1answer
82 views

Published URL File APP.CSS

I am crossing an analysis on a website and while fuzzing and testing I came across the below URL: https//www.****.**.*/content/css/app.css Which generated the below output: /* Minification failed. ...
3
votes
1answer
273 views

Can websites uniquely identify users by the sim card used to access the website?

If I was to use a phone's data connection to access a website, and then pop that sim card into another phone to access the same website, could the website tell that I am the same user?
1
vote
0answers
66 views

How to determine if a website has been hijacked?

I noticed that the URL of a website I sometimes visit was redirecting to a new URL. I noticed this through a tool that I use that does not actually load the new URL. I was surprised by this change, ...
0
votes
1answer
84 views

How to know you're secure?

How do you KNOW your website is secure? (Accounting only for your own mistakes; i.e. assuming the libraries you use are flawless.) For any given issue (e.g. XSS, MitM, etc.) there are lists of ...
1
vote
1answer
73 views

Account identified only by name, surname and date of birth

I am working in QA field and we have a project about a famous booking website. I have discovered that if I create an account with the same name, surname and date of birth of an already registered ...
-3
votes
2answers
139 views

website security of a domain

There is a website and I want to see if it is secure or not: When I enter the site with the domain address as https://2nate.com/ the browser says that it is secure. But when I enter the domain ...
1
vote
1answer
108 views

What security arrangements do I need to think about when passing a password through my site server

I want to automate some of my home admin. I'm writing a small-ish website, to do that. Written in C#/.NET, hosted on Azure, backed by an Azure SQL DB, codebase available publicly on GitHub. One of ...
1
vote
1answer
91 views

I want to create a website, what aspects of security should I really care of? [duplicate]

I'm going to create a website with Wordpress. I'm a junior software developer myself and I have experience working with servers and with the Magento Ecommerce software. But I'm not a systems ...
0
votes
1answer
43 views

Displaying username in profile section of a Web Application

Is it a good idea to display the username in the user profile section of a web application, when the user is already logged in? My web application uses basic authentication and does not have any 2 ...
64
votes
6answers
16k views

Employer makes me use what I believe to be an insecure website for HR functions. What to do?

At my job, to be able to view my paychecks, vacation hours and HR data on myself I need to log into a 3rd party website. I'm by no means a security expert or expert programmer but I could tell (...
0
votes
1answer
662 views

DNS Poisoning? Unable to access a specific website

Below are the DNS servers that I have been using for many years: 84.200.69.80 DNS Watch (Hostname: resolver1.ihgip.net ISP: Accelerated IT Services GmbH) 91.239.100.100 Uncensored DNS (IP: 130.225....
0
votes
2answers
184 views

How to monitor password protected web page

I want to use a website monitor to check that a web page is working but the web page requires that the user is authenticated. Is there a crafty way of achieving this that doesn't require storing an ...
84
votes
5answers
21k views

Can “Accept cookie” button in a website be malicious?

I don't remember when this "accept/cancel cookie" button started to be used in websites. Why do they insist on getting users to click on this button? Can it do any harm to user's PC or to collect ...
1
vote
2answers
155 views

Is it secure to interact with a web page before it has fully loaded?

Web pages are often displayed in the browser before they have finished fully loading (i.e. the loading indicator is still spinning, etc). Usually this is caused by a slow advert or a video, etc. But ...
0
votes
1answer
672 views

Can I assume that an empty user agent will always be a robot?

I want to prevent robots flooding my website and I'm thinking about a ban in these cases... Can I assume that an empty user agent will always be a robot?
0
votes
1answer
75 views

Getting confusion that this responce indicate CORS vulnerability

HTTP/1.1 200 OK Content-Type: application/json Content-Length: 12 Connection: close Date: Tue, 25 Sep 2018 12:59:56 GMT x-amzn-RequestId: xxxxxxxxxxx Access-Control-Allow-Origin: * Access-Control-...
-1
votes
1answer
35 views

Whois History resources authentic source

I have couple of doubts related to Whois records. For a particulate domain... How authentic are the Whois records? As per my research the records are not permissible in courts (or at least would ...