Questions tagged [websites]

Applications or informational pages, distributed via HTTP or HTTPS, using a web server. Pages are typically interconnected by hyperlinks and may contain forms or even entire applications.

Filter by
Sorted by
Tagged with
0 votes
0 answers
13 views

Shared credentials logins between separate websites and trust issues

Brand A has multiple, separate websites - these websites reference each other as part of the brand family, but do not have a shared single sign on system. Instead, each website has their own login and ...
user avatar
  • 540
0 votes
1 answer
35 views

HTML Injection into custom sanitiser

I found a curious website that shows listings. It allows you to type a description, and also allows for you to use tags like <b> and <u> for formatting. But it doesn't let you do more ...
user avatar
  • 101
1 vote
2 answers
110 views

What kind of loophole are spam messages, containing just a few words and no links, trying to exploit?

I recently built a website using Django. It has a contact form and some minimal pages about me and my work portfolio. I have been getting a few spam messages a day and their content intrigues me (...
user avatar
-1 votes
1 answer
56 views

Can using 2FA compromise me in any way if the website owner goes rogue?

Context This question concerns a website that has no commercial or business background, it is a purely personal project. This website is ran by 2 strangers from the internet, who lend access to ...
user avatar
  • 101
4 votes
1 answer
195 views

What is this attacker trying to do by making edits to Stack Exchange posts?

While reviewing the suggested edits for the Personal Finance & Money Stack Exchange site, I came across some strange proposed edits: Example 1: Example 2: This looks like some kind of attempt at ...
user avatar
  • 583
0 votes
1 answer
71 views

Session ID not changed after logging in/ logging out

I am testing website security when I came across this: When I enter the site URL, the user is given a session ID without any user input like: 7F746326038B30F51609423B2086BEBB Scenario 1: Once I ...
user avatar
1 vote
1 answer
63 views

Is it safe for website to generate fake profile pages?

Today I found a website which generates a fake profile when asked if said profile exists. Example: www.site.com/user/mycoolname doesn't exist yet. But if I put it in the browser for the site I get a ...
user avatar
0 votes
1 answer
75 views

How can 2FA help prevent formjacking?

This article by Avira (part of NortonLifeLock) claims that 2FA (2-Factor Authentication) may be sufficient to protect against formjacking: Enable 2-Factor Authentication: Create strong and complex ...
user avatar
0 votes
0 answers
94 views

Is it possible to find out if and why the FBI took down a website?

While doing some research on an unrelated subject, I recently came across a website whose content had been replaced with the following (uncentered) image: It looks similar enough to the kind of ...
user avatar
0 votes
0 answers
25 views

Is there any way to deal with hacked website? [duplicate]

Our website has got hacked and we have no idea how to deal with it. It's a core PHP website uploaded over Cpanel. Now neither we are able to open Cpanel nor hit the website. It shows this: Now, what ...
user avatar
4 votes
3 answers
299 views

Realistically, how likely it is to have a computer compromised from browsing random websites?

Another question inspired by a recent discussion in the 'The DMZ' chatroom. Long story short: IT guys are worried that accountants' workstations may become compromised because accountants watch cat ...
user avatar
  • 5,587
1 vote
0 answers
283 views

Looking for origin/ verification of malicious domain names [closed]

My network sniffer for websites has discovered a number of hosting domains in the report which I can not correctly assign to categories. I don't know if there are providers behind these domains that ...
user avatar
  • 11
0 votes
1 answer
82 views

Is the "same-origin" implied when using "frame-ancestor" in the CSP header?

If my Content-Security-Policy is set to the following: Content-Security-Policy: frame-ancestors 'self' Does it also imply: Content-Security-Policy: default-src 'self' Or is it a lot safer to put ...
user avatar
1 vote
2 answers
101 views

How to assess a website's trustworthiness?

How do you assess the trustworthiness of a new website? Especially to download and then install software from. Edit: My underlying concern is to: Trust the website. Trust the website to not inject ...
user avatar
0 votes
0 answers
23 views

Can a website see my specific device? [duplicate]

I was suspended from a particular website. Can a website see my specific device? If I reset my device and connect to public wifi, can a website know I've visited it before? Can he see my IMEI and ...
user avatar
3 votes
2 answers
774 views

What constitutes "military grade encryption" in 2021?

I often see it claimed on a website that they use banking or military grade encryption. As of 2021, what kind of encryption do the majority of (Western) banks and militaries currently use? Or in other ...
user avatar
0 votes
2 answers
161 views

Any way to open a maybe malicious website without having to use a VM?

Sometimes there are websites I'd like to checkout but I have the feeling that the site may have something malicious in it, the easiest way would be to just load my VM and opening the site there, but ...
user avatar
  • 11
0 votes
0 answers
19 views

Infection from website [duplicate]

I wanted to learn more about keyloggers and how to protect myself from them. I clicked on a result from google, but the site seems to be infected. Link to Sucuri results Do I need to reinstall my ...
user avatar
  • 1
1 vote
0 answers
99 views

Can a website track keystrokes like OS or browser related keybind pressing?

There are several ways to track how a user interacts with a website, including mouse position and clicks. Does the same apply to taking screenshots though? Can a website track browser or system ...
user avatar
  • 33
2 votes
1 answer
330 views

Is it still possible to get a virus simply by visiting a website? [closed]

I know this is a duplicate question, but there aren't any recent updates on the answers given to this question(here and here) and after a few years, I'm sure browser security has improved drastically. ...
user avatar
2 votes
1 answer
218 views

Preserving crime evidence from a website I do not own

Is there a standard procedure when it comes to preserving evidence of a crime committed on a website of a third party? Let's assume that a crime was committed on a website I visit, like defamation. ...
user avatar
  • 33
0 votes
1 answer
89 views

responding to comment spam

My website has several forms which are periodically spammed. When a submission gets flagged as spam, and is internally rerouted to where spam should go, what is the appropriate response: show an ...
user avatar
2 votes
2 answers
1k views

Does escaping quotes in a HTML attribute context prevent XSS?

I'm learning about XSS and I found I can inject code in this tag a few days ago. Tag: <div id="pagenotfound" title='Cannot find /it/search/testtesttesttetst\'onload=alert(1)'> My ...
user avatar
  • 21
0 votes
1 answer
177 views

What is a secure way to send credentials to the server?

I am currently making a file server (Based on HTTP) for my service. I want an upload key, so a key that is needed for uploading. To get this key, the client has to provide his login data. Let's say my ...
user avatar
1 vote
0 answers
85 views

Can I buy a standard SSL certificate to protect a website i.e. certificates.xxxxxx.com? [closed]

I don't have much experience in buying and installing ssl certificates. I have one website like certificates.xxxxx.com. So, my question is that can I buy a standard ssl certificate from GoDaddy to ...
user avatar
  • 11
0 votes
1 answer
531 views

How do I serve a webpage on a local PC without revealing my IP-address to end users? [closed]

Are there any ways to serve a webpage locally without revealing IP to end users?
user avatar
1 vote
2 answers
114 views

Which firewalls filters should I consider applying to my company's website?

Context The company I work in is starting to have a more dynamic website, which can process sensitive user information. With so, we want to improve our security. We are a healthcare company from ...
user avatar
  • 493
-1 votes
1 answer
616 views

How to prevent someone from proxying your Websites

So i think someone is mirroring my site with a proxy and hides behind cloudflare (cloudflare already notified and google also) so i cant find out the real ip of the server to block it. Is there anyway ...
user avatar
  • 1
1 vote
1 answer
236 views

Is it safe to visit any website in TOR when the Security Bar is set at Maximum? (Safest)

Someone has sent me a link on Tor which when visited instantly read that the website itself was not available and that apparently the link is broken somehow. When using Tor i use the option "...
user avatar
0 votes
0 answers
98 views

My school said they can track what websites we visit and games we play via online learning. is this true or just a way to scare us? [duplicate]

So my teacher caught someone playing a game in my online class and warned us that they have installed a new program so they can track "everything we do using our ip address" now im quite ...
user avatar
  • 1
-1 votes
1 answer
2k views

Do websites ever delete data about me and my activities? [closed]

I wanted to know for how long Porn websites retain data about visitors' IP addresses and the specific pages they visit. I wanted to check it for Pornhub, xnxx, and xvideos. However, my country ...
user avatar
1 vote
0 answers
605 views

What's the latest thinking on website session expiry time? [closed]

Websites that persist any user-specific state (either a login capability or, say, a basket & checkout purchasing system) tend to have a deliberately expiring session that lasts a few minutes or ...
user avatar
13 votes
3 answers
5k views

What risks am I taking by using an http site to play a video game that just records mouse events?

There's this game at http://slither.io which I like to play. Only inputs that I give to it are space bar, and cursor location. It's not https. Are there any risks?
user avatar
  • 249
0 votes
1 answer
111 views

How can I build a simple website that contains SQL injection vulnerabilities? [closed]

How can I build a simple website that contains SQL injection vulnerabilities for study purposes? What do I need to learn?
user avatar
  • 1
1 vote
1 answer
352 views

Can it be dangerous to curl without any option an HTTP address?

I wanted to know my external IP address from the command line. I found this answer on Ask Ubuntu: Command for determining my public IP? which suggests to use curl -s https://checkip.dyndns.org | sed -...
user avatar
  • 111
0 votes
1 answer
1k views

How do I redirect HTTPS site to another HTTPS site over LAN using a linux? [closed]

Is there a tool, or a command for linux that can make possible to redirect HTTPS site to another HTTPS site on LAN? i'm using Kali Linux, and all the tools and commands that i found was to redirect ...
user avatar
  • 1
1 vote
1 answer
254 views

Why is pastebin considered a high risk service

The company I work at uses zscaler to restrict access to certain websites. Earlier today, I tried to visit pastebin.com, but got the error message in the picture below: Trying to google why pastebin ...
user avatar
3 votes
2 answers
663 views

Can a web page really log keystrokes on a different page shown later on the same tab (or a different tab)?

According to this Reddit comment, an advertisement on one page seems to be able to log a user's keystrokes on a different page (if I understand the comment correctly). Is this really true? Can an ...
user avatar
  • 773
0 votes
2 answers
319 views

How do I make a word list for cracking password? [duplicate]

I already know the password format: 1 Upper Case Letters + 5 digits + bf (bf is the known letters, they must included in the password and at the end) For example: A12345bf, C12301bf, D10282bf. I want ...
user avatar
1 vote
1 answer
162 views

Securing Admin Login by only whitelisting a dedicated vpn ip [closed]

Is it is a good idea to restrict access to the admin-login-page-url of a website, by making a .htaccess rule that only allows access to the dedicated VPN IP? If so, is it recommended to just buy the ...
user avatar
0 votes
2 answers
117 views

Malware possibly infecting my personal website

I recently set up a personal website. It contains nothing but a few pieces of information presented in a pretty way; there's no associated database or anything, it wasn't even wordpress - just ...
user avatar
  • 111
0 votes
2 answers
133 views

Servers/Websites for vulnerability scanning

I need to test vulnerability scanners such as Nessus, Nmap, and so on. My teacher told me, that there are some prepared websites (these scanners need the IP address of target to scan) with known ...
user avatar
  • 3
1 vote
1 answer
280 views

Can my school see the websites I've visited while on my home WiFi after I reconnect to the schools? [closed]

I know that they can't monitor me on my home WiFi, but can they see the websites I visited while on my home WiFi after I reconnect to the schools?
user avatar
0 votes
1 answer
1k views

How to hide or secure django admin page?

I am working on an E-commerce website which is mainly in Django. I have this admin page. I want to hide, protect, secure it from other users/visitors means that only a set of IP address can view that ...
user avatar
0 votes
0 answers
2k views

Difference between gobuster and dirbuster in performance

The only difference I am aware, is of CLI vs GUI. But I am curious to know as to what is the difference in their performance and what are the additional features in one tool compared to another?
user avatar
-1 votes
1 answer
124 views

My sql got attacked [closed]

I have a company that has been attacked through SQL and their tables were removed. The attacker put a message replace it with all database entries. The first thing that I did was to figure out if the ...
user avatar
  • 1
-2 votes
2 answers
209 views

What if someone made Google SafeBrowsing flag a website by hosting a malicious site locally? [closed]

I have seen many posts here about /etc/hosts, but I don't see them addressing this issue. The issue is: If a person adds 127.0.0.1 mywebsite.com to their /etc/hosts file and 127.0.0.1 has dangerous ...
user avatar
1 vote
1 answer
148 views

In a website that gives awards, is there anyway to ensure that one user isn't abusing the website and replaying the game by switching emails?

I'm building a website that gives awards to users. After each game I ask the user for their email and send them an email to claim their gift. Is there anyway to make sure that one user isn't simply ...
user avatar
  • 113
2 votes
1 answer
731 views

Typed password in the username text box but didn't hit enter. Should I still change the password?

I know that if I type a password in the username text box and hit enter it is better to change the password just in case. But is it still risky to have written it in the box (with no one watching) ...
user avatar
2 votes
1 answer
162 views

Is this sufficient to verify a website's domain?

I'm building a browser extension that will run some javascript, which contains some sensitive information (essentially injecting authentication info). Therefore I want to make sure it only executes it ...
user avatar
  • 1,236

1
2 3 4 5