Questions tagged [websites]

Applications or informational pages, distributed via HTTP or HTTPS, using a web server. Pages are typically interconnected by hyperlinks and may contain forms or even entire applications.

Filter by
Sorted by
Tagged with
0 votes
0 answers
34 views

Bypass Options -Indexes in htaccess to view content

My professor gave me this task and said "Easy" about it! I don't know how serious is he! The task : I have a directory for example www.example.com/items The "items" directory ...
karam E's user avatar
1 vote
0 answers
57 views

Newsletter Spam Attack - Somehow by not directly attacking?

Our website(shopify website) has been getting a bot attack on our newsletter subscription form. Not sure if emails are real or not but there is some from gmail and hotmail etc or some from weird ...
tarik's user avatar
  • 11
4 votes
1 answer
176 views

Suspicious indexing of non-existent pages

Just recently, the Google search engine started indexing my site with a crazy number of requests. When I logged into the console, 600,000 pages were indexed, and 919,000 more were not indexed. For ...
Володька's user avatar
0 votes
0 answers
39 views

How to reproduce this CVE-2020-7774 parameter pollution vulnerability

While pentesting a website I came across yarn.lock file that contains an application dependency and I found this vulnerable library y18n v4.0.0 to CVE-2020-7774. How can I reproduce the vulnerability ...
ben39's user avatar
  • 1
2 votes
1 answer
173 views

How to know whether a VPN is blocking a website or a website is blocking a VPN

So I've got two VPN subscriptions, let's call them VPN A and VPN B. And I like going to a somewhat popular website, which I'll call Site C. I'm a new customer to VPN B, and I've noticed that I can't ...
hilltothesouth's user avatar
0 votes
0 answers
17 views

efficient subdomain extraction [duplicate]

I am wondering how we can effectively extract all subdomains of given website? For example, the free hosting websites, I would like to extract all subdomains and see if I can find some subdomains ...
glovescoffee's user avatar
2 votes
0 answers
33 views

Server-side solution to protect from bots? [duplicate]

I have a website where a user needs to register with his mobile phone number. It is verified by sending a verification code by SMS, each SMS costs me €0,10. I have already implemented a check that if ...
O'Niel's user avatar
  • 2,770
0 votes
0 answers
26 views

Spoofing IP to get content from website? [duplicate]

A website is returning valid response if IP of the client is in specific range(whitelist). I know that one can spoof IP within that range to bypass that block, but in that case the spoofer will not ...
Giorgi Natroshvili's user avatar
1 vote
3 answers
365 views

How do websites check that password hashes saved in the database are the same as passwords hashed client-side?

How do websites check that password hashes saved in the database are the same as passwords hashed and sent by a client? I know that client-side hashing is not secure.
Den4ik's user avatar
  • 21
0 votes
1 answer
266 views

HTTPS/TLS security with an invalid certificate

I'm trying to use a site that's https but has it's own certificate, and when I add an exception it still shows it as unsecure, with an exclamation on the padlock and when I click the padlock it says &...
vertigo's user avatar
  • 13
1 vote
1 answer
176 views

How do I best share a shared account's private key?

I made a website which among other things allows users to sign up to events. The HTML form is filled out and submitted, which automatically updates a google spreadsheet with all applications. This of ...
RattatAndyGo's user avatar
1 vote
0 answers
149 views

How does a website know if i've visited it before? (and how to bypass that) [closed]

For example: https://pdfcandy.com/pdf-ocr.html has a limit on how many times I can use a feature per hour, but if I use an incognito tab I can easily bypass that. But with https://ichigoreader.com/...
Kamisama's user avatar
37 votes
4 answers
6k views

What is the purpose of hiding spam links in some obscure forum posts?

I'm moderating one small Discourse forum and we, like everyone else, get spammers from time to time. Our forum is small, like 40-60 weekly unique visitors. Our forum requires that each new user's ...
Tommy's user avatar
  • 533
0 votes
0 answers
85 views

How does a website figure out the user's identity, even if I am using new IP and new browser cookie? [duplicate]

Background: I recently came across a child porn website and by US law I am obliged to report it. I've decided to collect evidence for a formal report; however, I don't want to reveal my identity due ...
dodo's user avatar
  • 101
1 vote
1 answer
87 views

"Pass-through" website interception detection and prevention

I face some sort of "MitM" attack type that I don't really know how to search, because I don't really know what it is called, so I am in the dark here, and need some help and advice. Let's ...
Iraka's user avatar
  • 13
1 vote
2 answers
247 views

Is it OK to expose admin API endpoints on frontend, as long as they're secure?

I'm wondering if it's OK for sharing the same frontend panel with admins and normal users. Although, it would expose some admin-accessible-only API endpoints. A malicious attacker would be able to ...
stupid dev's user avatar
0 votes
0 answers
27 views

Can someone find out my other websites based on the IP address of one of my websites? [duplicate]

As far as I know, the IP address of any website is detectable by a simple ping test. Say I host several websites on a given webhost with a single IP. If someone finds out the IP of one of my websites, ...
user283460's user avatar
0 votes
0 answers
109 views

How to make the website owner anonymous? [duplicate]

Buying an international web domain (so there is no national law to expose its details beyond the domain registrar) Not putting any personal and family name in the website What else?
user283460's user avatar
1 vote
2 answers
84 views

What was the purpose of this example of a website hijacking?

Recently helped a friend after their website was hijacked via a compromised (and very simple) hosting and cPanel password. The site was just static html and css, showing business hours etc and contact ...
nuggetbram's user avatar
0 votes
1 answer
158 views

How easy is it really for malicious websites to steal session cookies or other data?

I would like to know how feasible an attack on a web browser is. Is that something that occurs frequently or is it difficult to manage for a malicious website to steal sensitive data using remote code ...
noto77's user avatar
  • 31
0 votes
2 answers
594 views

Offline downloading: Can the website owner know that I’ve saved the page as webarchive while I’m not connected to the internet?

I noticed I can save a webpage as .webarchive file from my iPhone Safari while I’m offline. Basically what I did was to open the website, log in, go to the specific page, then when it’s finished ...
Tocchi's user avatar
  • 3
2 votes
3 answers
494 views

Can I visit a malicious website by using Tor with settings set to safest or by using NoScript on an ordinary browser with settings set to untrusted?

Can I visit a malicious website by using Tor with settings set to safest or by using NoScript on an ordinary browser with settings set to untrusted? If not then is there any way to visit a malicious ...
User4857's user avatar
0 votes
1 answer
79 views

HTML Injection into custom sanitiser

I found a curious website that shows listings. It allows you to type a description, and also allows for you to use tags like <b> and <u> for formatting. But it doesn't let you do more ...
John Hon's user avatar
  • 101
2 votes
2 answers
214 views

What kind of loophole are spam messages, containing just a few words and no links, trying to exploit?

I recently built a website using Django. It has a contact form and some minimal pages about me and my work portfolio. I have been getting a few spam messages a day and their content intrigues me (...
Prateek Verma's user avatar
-1 votes
1 answer
64 views

Can using 2FA compromise me in any way if the website owner goes rogue?

Context This question concerns a website that has no commercial or business background, it is a purely personal project. This website is ran by 2 strangers from the internet, who lend access to ...
D. Tunus's user avatar
  • 101
4 votes
1 answer
229 views

What is this attacker trying to do by making edits to Stack Exchange posts?

While reviewing the suggested edits for the Personal Finance & Money Stack Exchange site, I came across some strange proposed edits: Example 1: Example 2: This looks like some kind of attempt at ...
Flux's user avatar
  • 793
0 votes
1 answer
2k views

Session ID not changed after logging in/ logging out

I am testing website security when I came across this: When I enter the site URL, the user is given a session ID without any user input like: 7F746326038B30F51609423B2086BEBB Scenario 1: Once I ...
Supraja's user avatar
2 votes
1 answer
169 views

Is it safe for website to generate fake profile pages?

Today I found a website which generates a fake profile when asked if said profile exists. Example: www.site.com/user/mycoolname doesn't exist yet. But if I put it in the browser for the site I get a ...
Phaidrin's user avatar
0 votes
1 answer
99 views

How can 2FA help prevent formjacking?

This article by Avira (part of NortonLifeLock) claims that 2FA (2-Factor Authentication) may be sufficient to protect against formjacking: Enable 2-Factor Authentication: Create strong and complex ...
End Anti-Semitic Hate's user avatar
7 votes
4 answers
510 views

Realistically, how likely it is to have a computer compromised from browsing random websites?

Another question inspired by a recent discussion in the 'The DMZ' chatroom. Long story short: IT guys are worried that accountants' workstations may become compromised because accountants watch cat ...
gaazkam's user avatar
  • 5,747
1 vote
0 answers
359 views

Looking for origin/ verification of malicious domain names [closed]

My network sniffer for websites has discovered a number of hosting domains in the report which I can not correctly assign to categories. I don't know if there are providers behind these domains that ...
Kbowser's user avatar
  • 11
0 votes
1 answer
183 views

Is the "same-origin" implied when using "frame-ancestor" in the CSP header?

If my Content-Security-Policy is set to the following: Content-Security-Policy: frame-ancestors 'self' Does it also imply: Content-Security-Policy: default-src 'self' Or is it a lot safer to put ...
Alexis Wilke's user avatar
1 vote
2 answers
138 views

How to assess a website's trustworthiness?

How do you assess the trustworthiness of a new website? Especially to download and then install software from. Edit: My underlying concern is to: Trust the website. Trust the website to not inject ...
YetAnotherRandomUser's user avatar
3 votes
2 answers
1k views

What constitutes "military grade encryption" in 2021?

I often see it claimed on a website that they use banking or military grade encryption. As of 2021, what kind of encryption do the majority of (Western) banks and militaries currently use? Or in other ...
Hashim Aziz's user avatar
0 votes
2 answers
710 views

Any way to open a maybe malicious website without having to use a VM?

Sometimes there are websites I'd like to checkout but I have the feeling that the site may have something malicious in it, the easiest way would be to just load my VM and opening the site there, but ...
Simon's user avatar
  • 11
0 votes
0 answers
19 views

Infection from website [duplicate]

I wanted to learn more about keyloggers and how to protect myself from them. I clicked on a result from google, but the site seems to be infected. Link to Sucuri results Do I need to reinstall my ...
sk5's user avatar
  • 1
1 vote
0 answers
172 views

Can a website track keystrokes like OS or browser related keybind pressing?

There are several ways to track how a user interacts with a website, including mouse position and clicks. Does the same apply to taking screenshots though? Can a website track browser or system ...
Lili's user avatar
  • 33
2 votes
1 answer
2k views

Is it still possible to get a virus simply by visiting a website? [closed]

I know this is a duplicate question, but there aren't any recent updates on the answers given to this question(here and here) and after a few years, I'm sure browser security has improved drastically. ...
unrealapex's user avatar
2 votes
1 answer
244 views

Preserving crime evidence from a website I do not own

Is there a standard procedure when it comes to preserving evidence of a crime committed on a website of a third party? Let's assume that a crime was committed on a website I visit, like defamation. ...
Lili's user avatar
  • 33
0 votes
1 answer
96 views

responding to comment spam

My website has several forms which are periodically spammed. When a submission gets flagged as spam, and is internally rerouted to where spam should go, what is the appropriate response: show an ...
appeal sigma's user avatar
2 votes
2 answers
3k views

Does escaping quotes in a HTML attribute context prevent XSS?

I'm learning about XSS and I found I can inject code in this tag a few days ago. Tag: <div id="pagenotfound" title='Cannot find /it/search/testtesttesttetst\'onload=alert(1)'> My ...
CR00D3X's user avatar
  • 21
0 votes
1 answer
1k views

What is a secure way to send credentials to the server?

I am currently making a file server (Based on HTTP) for my service. I want an upload key, so a key that is needed for uploading. To get this key, the client has to provide his login data. Let's say my ...
PugsAreCute's user avatar
1 vote
0 answers
119 views

Can I buy a standard SSL certificate to protect a website i.e. certificates.xxxxxx.com? [closed]

I don't have much experience in buying and installing ssl certificates. I have one website like certificates.xxxxx.com. So, my question is that can I buy a standard ssl certificate from GoDaddy to ...
Stacky's user avatar
  • 11
0 votes
1 answer
836 views

How do I serve a webpage on a local PC without revealing my IP-address to end users? [closed]

Are there any ways to serve a webpage locally without revealing IP to end users?
infinitieunique's user avatar
1 vote
2 answers
120 views

Which firewalls filters should I consider applying to my company's website?

Context The company I work in is starting to have a more dynamic website, which can process sensitive user information. With so, we want to improve our security. We are a healthcare company from ...
RA828's user avatar
  • 493
-1 votes
1 answer
1k views

How to prevent someone from proxying your Websites

So i think someone is mirroring my site with a proxy and hides behind cloudflare (cloudflare already notified and google also) so i cant find out the real ip of the server to block it. Is there anyway ...
Marzel's user avatar
  • 1
1 vote
1 answer
303 views

Is it safe to visit any website in TOR when the Security Bar is set at Maximum? (Safest)

Someone has sent me a link on Tor which when visited instantly read that the website itself was not available and that apparently the link is broken somehow. When using Tor i use the option "...
ticalluke02's user avatar
0 votes
0 answers
145 views

My school said they can track what websites we visit and games we play via online learning. is this true or just a way to scare us? [duplicate]

So my teacher caught someone playing a game in my online class and warned us that they have installed a new program so they can track "everything we do using our ip address" now im quite ...
Mark's user avatar
  • 1
-1 votes
1 answer
3k views

Do websites ever delete data about me and my activities? [closed]

I wanted to know for how long Porn websites retain data about visitors' IP addresses and the specific pages they visit. I wanted to check it for Pornhub, xnxx, and xvideos. However, my country ...
Andrew Rozario's user avatar
3 votes
0 answers
2k views

What's the latest thinking on website session expiry time? [closed]

Websites that persist any user-specific state (either a login capability or, say, a basket & checkout purchasing system) tend to have a deliberately expiring session that lasts a few minutes or ...
Robin Winslow's user avatar

1
2 3 4 5 6