Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [websites]

Applications or informational pages, distributed via HTTP or HTTPS, using a web server. Pages are typically interconnected by hyperlinks and may contain forms or even entire applications.

0
votes
1answer
35 views

What security arrangements do I need to think about when passing a password through my site server

I want to automate some of my home admin. I'm writing a small-ish website, to do that. Written in C#/.NET, hosted on Azure, backed by an Azure SQL DB, codebase available publicly on GitHub. One of ...
1
vote
1answer
70 views

I want to create a website, what aspects of security should I really care of? [duplicate]

I'm going to create a website with Wordpress. I'm a junior software developer myself and I have experience working with servers and with the Magento Ecommerce software. But I'm not a systems ...
0
votes
1answer
26 views

Displaying username in profile section of a Web Application

Is it a good idea to display the username in the user profile section of a web application, when the user is already logged in? My web application uses basic authentication and does not have any 2 ...
64
votes
6answers
15k views

Employer makes me use what I believe to be an insecure website for HR functions. What to do?

At my job, to be able to view my paychecks, vacation hours and HR data on myself I need to log into a 3rd party website. I'm by no means a security expert or expert programmer but I could tell (...
0
votes
1answer
124 views

DNS Poisoning? Unable to access a specific website

Below are the DNS servers that I have been using for many years: 84.200.69.80 DNS Watch (Hostname: resolver1.ihgip.net ISP: Accelerated IT Services GmbH) 91.239.100.100 Uncensored DNS (IP: 130.225....
0
votes
2answers
63 views

How to monitor password protected web page

I want to use a website monitor to check that a web page is working but the web page requires that the user is authenticated. Is there a crafty way of achieving this that doesn't require storing an ...
83
votes
5answers
20k views

Can “Accept cookie” button in a website be malicious?

I don't remember when this "accept/cancel cookie" button started to be used in websites. Why do they insist on getting users to click on this button? Can it do any harm to user's PC or to collect ...
1
vote
2answers
139 views

Is it secure to interact with a web page before it has fully loaded?

Web pages are often displayed in the browser before they have finished fully loading (i.e. the loading indicator is still spinning, etc). Usually this is caused by a slow advert or a video, etc. But ...
0
votes
1answer
86 views

Can I assume that an empty user agent will always be a robot?

I want to prevent robots flooding my website and I'm thinking about a ban in these cases... Can I assume that an empty user agent will always be a robot?
0
votes
1answer
58 views

Getting confusion that this responce indicate CORS vulnerability

HTTP/1.1 200 OK Content-Type: application/json Content-Length: 12 Connection: close Date: Tue, 25 Sep 2018 12:59:56 GMT x-amzn-RequestId: xxxxxxxxxxx Access-Control-Allow-Origin: * Access-Control-...
-1
votes
1answer
27 views

Whois History resources authentic source

I have couple of doubts related to Whois records. For a particulate domain... How authentic are the Whois records? As per my research the records are not permissible in courts (or at least would ...
0
votes
2answers
85 views

What is the responsible thing to do when I care about a vulnerability more than the team behind the system? [duplicate]

I've encountered a security vulnerability in a website. The website is that of a leading brand in it's industry. There are user accounts etc. and this website is very popular. I've contact multiple ...
2
votes
1answer
87 views

List of common website endings/pages for enumeration? [closed]

I am currently building a Python-based OSINT tool that allows a user to crawl a supplied domain for pages using traditional scraping/spider methods, but I also want to have the option to 'brute force' ...
0
votes
1answer
283 views

Can I get malicious malware in my computer or any kinds of virus by registering through Google/Facebook to a specifc site?

Lately, there is a start up company in Israel called Initiative Q and currently it gives out coins (that are similar to bitcoin but they don't run on Blockchain technology) in order to advertise their ...
0
votes
0answers
101 views

Dirty ajax calls allows me to get free pizza [duplicate]

Recently my buddy at work wanted to order some food for lunch from a website that we usually order from. The site allows the visitor to become a member of the site by registering and then logging in. ...
1
vote
2answers
222 views

Should I continue using this (potentially dangerous) website?

As a part of my project I had to scrape some motivational pictures, so I considered using the gallery section of the website, "Quotes Cover" - "https://quotescover.com/category/quotes-gallery". ...
0
votes
1answer
162 views

My site was hacked and has injected code on index.php and 404.php [duplicate]

Here is the code injected to index.php if(@isset($_GET[bots])){ echo '<form action="" method="post" enctype="multipart/form-data" name="silence" id="silence">'; echo '<input type="...
0
votes
1answer
64 views

What are some well known websites that do not require multiple character sets in passwords?

NIST guidelines discourage password policies that require multiple character sets. Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or ...
38
votes
5answers
9k views

What does a website see if I am connected on my native IP and then enable my VPN?

As per the question. If I am connected to a website, streaming content from my native IP and I then enable my VPN, what does the website see?
3
votes
1answer
160 views

Is it a good idea to test a live company website as part of an interview process?

I got an interview task, which is to pentest the careers section of a company's website. I'm keen to play around with any website, and permission was given but this feels like a free pentest. I ...
2
votes
1answer
105 views

To whom do I report this bizarre behavior (possibly hijacked website or DNS highjack)?

My coworker searched for "cutadapt" at Google Scholar and the top hit was http://journal.embnet.org/index.php/embnetjournal/article/view/200. When he clicked on it, it took him to a site that said ...
62
votes
11answers
22k views

Why don't websites and devices offer fake logins for hackers?

I was thinking about this earlier this morning and was wondering why websites and devices don't offer fake logins for hackers? What I mean by that is that if a hacker finds out some of your details ...
-6
votes
1answer
528 views

Protecting against input type =“password” changes? [closed]

Are there any protections against users using Chrome Developer Tools to right click on a password input field, and then change input type="pass" to "text" to reveal the password? There are probably ...
-2
votes
1answer
109 views

Why do websites like Truecaller make you prove that you are not a robot after a limited number of searches?

I used Truecaller for searching for a number but after around 20 to 25 searches they started asking me to prove that I am not a robot. Is this for protecting their website from a DDoS attacks or is it ...
0
votes
0answers
46 views

Has Microsoft ever official recommended forms auth over Windows Auth

My team is debating using Windows Authentication for a public facing website. I’ve been scouring the forms and can see the numerous security vulnerabilities of replying on NTML, and I can see the ...
-2
votes
1answer
476 views

Does a third level domain wildcard certificate prove a fourth level domain website? [duplicate]

Suppose I have a certificate for *.example.com and privileged access to all example.com websites. Sure I could install the wildcard certificate into https://api.example.com website so that it can ...
1
vote
1answer
143 views

Handling the loss of a phone with FIDO UAF

I would like to know how this UAF method works when we lose our phone. With Google Authenticator we have to save on a paper some info about the generation of the secret key. But how does this work ...
4
votes
1answer
743 views

Can websites track the tabs you open while logged into their website?

If I am on chrome and am looking up a product on Amazon on tab A, can they tell what I search if I open a tab B while tab A is still open? Should I use a new chrome or another browser window to ...
4
votes
2answers
443 views

How to store data on server without an ability to read it?

Let's say, we develop a social network website, which allows to send personal messages between users. We don't want anyone (even us) to read these messages, except for message sender and receiver. Is ...
3
votes
1answer
64 views

Is there anything that a regular user can do to help remove fake websites?

I'm talking about domains like msn.org and stackoveflow.com that impersonate major websites and serve up malicious ads such as the "critical alert from Microsoft" ad. I've tried reporting these ads ...
57
votes
7answers
12k views

Email received regarding Security flaw in website

I received an email to techsupport@websitename.com (pretty generic email) saying that there was a security flaw in my website etc. etc My initial reaction was that this was a scam. (How/why did they ...
-3
votes
1answer
77 views

Let's say I visit a website that installs malware on my computer, how bad can the malware be, and how can I know that it is there? [closed]

Ok, I'm a bit paranoid about malware and hacking, and I already know that visiting websites can give you malware without you knowing, so I was just wondering, how can I know if I have this type of ...
-2
votes
1answer
59 views

Trying to detect a firewall

I have some HTML that was detected by one of my scripts firewall detections, it looks like this: <!--- HTTP 1.1 Status Code: 403 HTTP Headers: {'Content-Length': '1233', 'X-Powered-By': 'ASP.NET', ...
1
vote
1answer
76 views

A website sends account credential field as “empty”

One of Finland's largest banks, S-Pankki, seems to use some uncommon method to send the username field. At least Firefox's password manager doesn't detect the entered username and I've also ...
0
votes
2answers
181 views

Anyone heard of this site and was it safe?

I was browsing a reddit page and found a strange link to what it looked to be a image hosting site that I've never heard of http://imgh.us/elliotwp1.jpg. I clicked the link and it said "404 not found"...
4
votes
1answer
293 views

What is the security impact of JavaScript minification?

In recent years the use of JavaScript minification for web applications proliferated so quickly that it can be considered as a defacto standard nowadays. I am wondering whether the use of such tools ...
0
votes
2answers
404 views

Conducting Ethical Phishing Attack [closed]

For research purposes, I'm conducting an ethical phishing attack in my institution. I have permission from the institution for the same. I've created the phishing site and the email content, and I'll ...
9
votes
3answers
4k views

Why doesn't Tornado have session

I've heard that cookies is less secure than the session. For example, if a web uses a cookie to detect if an user has logged in or not, people can forge a cookie to simulate a false user because he ...
0
votes
2answers
769 views

How was Lowe's website exploited to steal merchandise?

How was Lowe's website exploited to steal merchandise? It says they were able to order products without paying for them. http://www.foxnews.com/us/2017/08/16/couple-exploited-lowes-website-glitch-to-...
3
votes
1answer
446 views

Is it a security risk if the user enters html characters in a textbox and they're reflected on the next page in a website? (not script tags)

In my website I have a textbox where the user can enter whatever they want and the text is printed out on the next page. For certain cases, they can type HTML tags to format their message so that in ...
0
votes
1answer
103 views

Can I create a website on wordpress anonymously? [duplicate]

If I use a VPN that doesn't keep logs and create an email account, then use that email account to create a wordpress website (still using the VPN) and give no personal information (address, name, etc.)...
1
vote
1answer
81 views

How are hackers able to plant Phishing URLs in existing websites? [closed]

As the question says, How are hackers able to plant Phishing URLs in existing websites? And can it be detected?
1
vote
1answer
2k views

What risks are associated with 'parked' websites?

Our internet policy blocks so-called 'parked' websites, i.e. those that are registered but do not seem to be active. I'm not sure what tests are used to determine parked status. There is a tool that ...
5
votes
3answers
426 views

What causes the “This site may be hacked” or “This site ahead contains malware” messages?

How does Google exactly detect if a site may/is hacked? What exactly triggers the warnings? I've seen plenty of companies offer services that help to remove these warnings on websites and get your ...
4
votes
2answers
490 views

Software for testing XSS and other web sites vulnerabilities [closed]

One of my site would be submitted for vulnerability test, not sure if the company does this test manually. I was wondering if i can find any software where I specify all variables names used in my ...
5
votes
5answers
2k views

How to validate user input

I am having a lot of trouble understanding where I as a developer can validate the data that my users send to me. Let's say for a simple example I have a web page where it has a simple form that ...
0
votes
1answer
61 views

Two-Factor Authentication on downloadable client but not website

A friend of mine plays RuneScape, and mentioned to me that her account was recently compromised. She told me she has two step authentication on her RuneScape account, and on the email address ...
0
votes
3answers
732 views

Using hidden form fields to modify prices on a website

I came across this question on cybrary about the attack to be used to modify prices on a website. First off, I'm assuming that by prices they mean prices of a product like on an E-Commerce website.(...
1
vote
1answer
72 views

How can websites with URL traversal functionality protect itself from revealing its IP?

A good number of websites these days are not served directly over the internet, but through an intermediate providers, such as Cloudflare and Incapsula. A basic premise of the security provided by ...
0
votes
1answer
294 views

Google's view of a web page is corrupted

Recently, one of my website has been hacked in a very interesting way. By doing some researches I've found that I wasn't the only one affected by the hack, but didn't find anything about it. Note : ...