Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [websites]

Applications or informational pages, distributed via HTTP or HTTPS, using a web server. Pages are typically interconnected by hyperlinks and may contain forms or even entire applications.

3
votes
2answers
125 views

Can websites uniquely identify users by the sim card used to access the website?

If I was to use a phone's data connection to access a website, and then pop that sim card into another phone to access the same website, could the website tell that I am the same user?
1
vote
0answers
40 views

How to determine if a website has been hijacked?

I noticed that the URL of a website I sometimes visit was redirecting to a new URL. I noticed this through a tool that I use that does not actually load the new URL. I was surprised by this change, ...
0
votes
1answer
69 views

How to know you're secure?

How do you KNOW your website is secure? (Accounting only for your own mistakes; i.e. assuming the libraries you use are flawless.) For any given issue (e.g. XSS, MitM, etc.) there are lists of ...
1
vote
1answer
51 views

Account identified only by name, surname and date of birth

I am working in QA field and we have a project about a famous booking website. I have discovered that if I create an account with the same name, surname and date of birth of an already registered ...
-3
votes
2answers
121 views

website security of a domain

There is a website and I want to see if it is secure or not: When I enter the site with the domain address as https://2nate.com/ the browser says that it is secure. But when I enter the domain ...
0
votes
1answer
64 views

What security arrangements do I need to think about when passing a password through my site server

I want to automate some of my home admin. I'm writing a small-ish website, to do that. Written in C#/.NET, hosted on Azure, backed by an Azure SQL DB, codebase available publicly on GitHub. One of ...
1
vote
1answer
74 views

I want to create a website, what aspects of security should I really care of? [duplicate]

I'm going to create a website with Wordpress. I'm a junior software developer myself and I have experience working with servers and with the Magento Ecommerce software. But I'm not a systems ...
0
votes
1answer
26 views

Displaying username in profile section of a Web Application

Is it a good idea to display the username in the user profile section of a web application, when the user is already logged in? My web application uses basic authentication and does not have any 2 ...
64
votes
6answers
15k views

Employer makes me use what I believe to be an insecure website for HR functions. What to do?

At my job, to be able to view my paychecks, vacation hours and HR data on myself I need to log into a 3rd party website. I'm by no means a security expert or expert programmer but I could tell (...
0
votes
1answer
230 views

DNS Poisoning? Unable to access a specific website

Below are the DNS servers that I have been using for many years: 84.200.69.80 DNS Watch (Hostname: resolver1.ihgip.net ISP: Accelerated IT Services GmbH) 91.239.100.100 Uncensored DNS (IP: 130.225....
0
votes
2answers
73 views

How to monitor password protected web page

I want to use a website monitor to check that a web page is working but the web page requires that the user is authenticated. Is there a crafty way of achieving this that doesn't require storing an ...
84
votes
5answers
20k views

Can “Accept cookie” button in a website be malicious?

I don't remember when this "accept/cancel cookie" button started to be used in websites. Why do they insist on getting users to click on this button? Can it do any harm to user's PC or to collect ...
1
vote
2answers
149 views

Is it secure to interact with a web page before it has fully loaded?

Web pages are often displayed in the browser before they have finished fully loading (i.e. the loading indicator is still spinning, etc). Usually this is caused by a slow advert or a video, etc. But ...
0
votes
1answer
123 views

Can I assume that an empty user agent will always be a robot?

I want to prevent robots flooding my website and I'm thinking about a ban in these cases... Can I assume that an empty user agent will always be a robot?
0
votes
1answer
60 views

Getting confusion that this responce indicate CORS vulnerability

HTTP/1.1 200 OK Content-Type: application/json Content-Length: 12 Connection: close Date: Tue, 25 Sep 2018 12:59:56 GMT x-amzn-RequestId: xxxxxxxxxxx Access-Control-Allow-Origin: * Access-Control-...
-1
votes
1answer
29 views

Whois History resources authentic source

I have couple of doubts related to Whois records. For a particulate domain... How authentic are the Whois records? As per my research the records are not permissible in courts (or at least would ...
0
votes
2answers
93 views

What is the responsible thing to do when I care about a vulnerability more than the team behind the system? [duplicate]

I've encountered a security vulnerability in a website. The website is that of a leading brand in it's industry. There are user accounts etc. and this website is very popular. I've contact multiple ...
2
votes
1answer
89 views

List of common website endings/pages for enumeration? [closed]

I am currently building a Python-based OSINT tool that allows a user to crawl a supplied domain for pages using traditional scraping/spider methods, but I also want to have the option to 'brute force' ...
0
votes
1answer
299 views

Can I get malicious malware in my computer or any kinds of virus by registering through Google/Facebook to a specifc site?

Lately, there is a start up company in Israel called Initiative Q and currently it gives out coins (that are similar to bitcoin but they don't run on Blockchain technology) in order to advertise their ...
0
votes
0answers
105 views

Dirty ajax calls allows me to get free pizza [duplicate]

Recently my buddy at work wanted to order some food for lunch from a website that we usually order from. The site allows the visitor to become a member of the site by registering and then logging in. ...
1
vote
2answers
231 views

Should I continue using this (potentially dangerous) website?

As a part of my project I had to scrape some motivational pictures, so I considered using the gallery section of the website, "Quotes Cover" - "https://quotescover.com/category/quotes-gallery". ...
0
votes
1answer
210 views

My site was hacked and has injected code on index.php and 404.php [duplicate]

Here is the code injected to index.php if(@isset($_GET[bots])){ echo '<form action="" method="post" enctype="multipart/form-data" name="silence" id="silence">'; echo '<input type="...
0
votes
1answer
64 views

What are some well known websites that do not require multiple character sets in passwords?

NIST guidelines discourage password policies that require multiple character sets. Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or ...
38
votes
5answers
9k views

What does a website see if I am connected on my native IP and then enable my VPN?

As per the question. If I am connected to a website, streaming content from my native IP and I then enable my VPN, what does the website see?
3
votes
1answer
164 views

Is it a good idea to test a live company website as part of an interview process?

I got an interview task, which is to pentest the careers section of a company's website. I'm keen to play around with any website, and permission was given but this feels like a free pentest. I ...
2
votes
1answer
106 views

To whom do I report this bizarre behavior (possibly hijacked website or DNS highjack)?

My coworker searched for "cutadapt" at Google Scholar and the top hit was http://journal.embnet.org/index.php/embnetjournal/article/view/200. When he clicked on it, it took him to a site that said ...
62
votes
11answers
22k views

Why don't websites and devices offer fake logins for hackers?

I was thinking about this earlier this morning and was wondering why websites and devices don't offer fake logins for hackers? What I mean by that is that if a hacker finds out some of your details ...
-6
votes
1answer
826 views

Protecting against input type =“password” changes? [closed]

Are there any protections against users using Chrome Developer Tools to right click on a password input field, and then change input type="pass" to "text" to reveal the password? There are probably ...
-2
votes
1answer
118 views

Why do websites like Truecaller make you prove that you are not a robot after a limited number of searches?

I used Truecaller for searching for a number but after around 20 to 25 searches they started asking me to prove that I am not a robot. Is this for protecting their website from a DDoS attacks or is it ...
0
votes
0answers
49 views

Has Microsoft ever official recommended forms auth over Windows Auth

My team is debating using Windows Authentication for a public facing website. I’ve been scouring the forms and can see the numerous security vulnerabilities of replying on NTML, and I can see the ...
-2
votes
1answer
671 views

Does a third level domain wildcard certificate prove a fourth level domain website? [duplicate]

Suppose I have a certificate for *.example.com and privileged access to all example.com websites. Sure I could install the wildcard certificate into https://api.example.com website so that it can ...
1
vote
1answer
169 views

Handling the loss of a phone with FIDO UAF

I would like to know how this UAF method works when we lose our phone. With Google Authenticator we have to save on a paper some info about the generation of the secret key. But how does this work ...
4
votes
1answer
1k views

Can websites track the tabs you open while logged into their website?

If I am on chrome and am looking up a product on Amazon on tab A, can they tell what I search if I open a tab B while tab A is still open? Should I use a new chrome or another browser window to ...
4
votes
2answers
443 views

How to store data on server without an ability to read it?

Let's say, we develop a social network website, which allows to send personal messages between users. We don't want anyone (even us) to read these messages, except for message sender and receiver. Is ...
3
votes
1answer
64 views

Is there anything that a regular user can do to help remove fake websites?

I'm talking about domains like msn.org and stackoveflow.com that impersonate major websites and serve up malicious ads such as the "critical alert from Microsoft" ad. I've tried reporting these ads ...
58
votes
7answers
13k views

Email received regarding Security flaw in website

I received an email to techsupport@websitename.com (pretty generic email) saying that there was a security flaw in my website etc. etc My initial reaction was that this was a scam. (How/why did they ...
-3
votes
1answer
84 views

Let's say I visit a website that installs malware on my computer, how bad can the malware be, and how can I know that it is there? [closed]

Ok, I'm a bit paranoid about malware and hacking, and I already know that visiting websites can give you malware without you knowing, so I was just wondering, how can I know if I have this type of ...
-2
votes
1answer
63 views

Trying to detect a firewall

I have some HTML that was detected by one of my scripts firewall detections, it looks like this: <!--- HTTP 1.1 Status Code: 403 HTTP Headers: {'Content-Length': '1233', 'X-Powered-By': 'ASP.NET', ...
1
vote
1answer
76 views

A website sends account credential field as “empty”

One of Finland's largest banks, S-Pankki, seems to use some uncommon method to send the username field. At least Firefox's password manager doesn't detect the entered username and I've also ...
0
votes
2answers
189 views

Anyone heard of this site and was it safe?

I was browsing a reddit page and found a strange link to what it looked to be a image hosting site that I've never heard of http://imgh.us/elliotwp1.jpg. I clicked the link and it said "404 not found"...
4
votes
1answer
343 views

What is the security impact of JavaScript minification?

In recent years the use of JavaScript minification for web applications proliferated so quickly that it can be considered as a defacto standard nowadays. I am wondering whether the use of such tools ...
0
votes
2answers
473 views

Conducting Ethical Phishing Attack [closed]

For research purposes, I'm conducting an ethical phishing attack in my institution. I have permission from the institution for the same. I've created the phishing site and the email content, and I'll ...
9
votes
3answers
5k views

Why doesn't Tornado have session

I've heard that cookies is less secure than the session. For example, if a web uses a cookie to detect if an user has logged in or not, people can forge a cookie to simulate a false user because he ...
0
votes
2answers
829 views

How was Lowe's website exploited to steal merchandise?

How was Lowe's website exploited to steal merchandise? It says they were able to order products without paying for them. http://www.foxnews.com/us/2017/08/16/couple-exploited-lowes-website-glitch-to-...
4
votes
1answer
551 views

Is it a security risk if the user enters html characters in a textbox and they're reflected on the next page in a website? (not script tags)

In my website I have a textbox where the user can enter whatever they want and the text is printed out on the next page. For certain cases, they can type HTML tags to format their message so that in ...
0
votes
1answer
108 views

Can I create a website on wordpress anonymously? [duplicate]

If I use a VPN that doesn't keep logs and create an email account, then use that email account to create a wordpress website (still using the VPN) and give no personal information (address, name, etc.)...
1
vote
1answer
82 views

How are hackers able to plant Phishing URLs in existing websites? [closed]

As the question says, How are hackers able to plant Phishing URLs in existing websites? And can it be detected?
1
vote
1answer
2k views

What risks are associated with 'parked' websites?

Our internet policy blocks so-called 'parked' websites, i.e. those that are registered but do not seem to be active. I'm not sure what tests are used to determine parked status. There is a tool that ...
6
votes
3answers
486 views

What causes the “This site may be hacked” or “This site ahead contains malware” messages?

How does Google exactly detect if a site may/is hacked? What exactly triggers the warnings? I've seen plenty of companies offer services that help to remove these warnings on websites and get your ...
4
votes
2answers
568 views

Software for testing XSS and other web sites vulnerabilities [closed]

One of my site would be submitted for vulnerability test, not sure if the company does this test manually. I was wondering if i can find any software where I specify all variables names used in my ...