Questions tagged [websites]

Applications or informational pages, distributed via HTTP or HTTPS, using a web server. Pages are typically interconnected by hyperlinks and may contain forms or even entire applications.

Filter by
Sorted by
Tagged with
-1
votes
1answer
83 views

Do websites ever delete data about me and my activities? [closed]

I wanted to know for how long Porn websites retain data about visitors' IP addresses and the specific pages they visit. I wanted to check it for Pornhub, xnxx, and xvideos. However, my country ...
1
vote
0answers
85 views

What's the latest thinking on website session expiry time? [closed]

Websites that persist any user-specific state (either a login capability or, say, a basket & checkout purchasing system) tend to have a deliberately expiring session that lasts a few minutes or ...
13
votes
3answers
5k views

What risks am I taking by using an http site to play a video game that just records mouse events?

There's this game at http://slither.io which I like to play. Only inputs that I give to it are space bar, and cursor location. It's not https. Are there any risks?
0
votes
1answer
62 views

How can I build a simple website that contains SQL injection vulnerabilities? [closed]

How can I build a simple website that contains SQL injection vulnerabilities for study purposes? What do I need to learn?
1
vote
1answer
46 views

Can it be dangerous to curl without any option an HTTP address?

I wanted to know my external IP address from the command line. I found this answer on Ask Ubuntu: Command for determining my public IP? which suggests to use curl -s https://checkip.dyndns.org | sed -...
0
votes
1answer
104 views

How do I redirect HTTPS site to another HTTPS site over LAN using a linux? [closed]

Is there a tool, or a command for linux that can make possible to redirect HTTPS site to another HTTPS site on LAN? i'm using Kali Linux, and all the tools and commands that i found was to redirect ...
1
vote
1answer
157 views

Why is pastebin considered a high risk service

The company I work at uses zscaler to restrict access to certain websites. Earlier today, I tried to visit pastebin.com, but got the error message in the picture below: Trying to google why pastebin ...
3
votes
2answers
203 views

Can a web page really log keystrokes on a different page shown later on the same tab (or a different tab)?

According to this Reddit comment, an advertisement on one page seems to be able to log a user's keystrokes on a different page (if I understand the comment correctly). Is this really true? Can an ...
0
votes
2answers
50 views

How do I make a word list for cracking password? [duplicate]

I already know the password format: 1 Upper Case Letters + 5 digits + bf (bf is the known letters, they must included in the password and at the end) For example: A12345bf, C12301bf, D10282bf. I want ...
1
vote
1answer
71 views

Securing Admin Login by only whitelisting a dedicated vpn ip [closed]

Is it is a good idea to restrict access to the admin-login-page-url of a website, by making a .htaccess rule that only allows access to the dedicated VPN IP? If so, is it recommended to just buy the ...
0
votes
0answers
22 views

Should I be concerned about websites emailing me my plaintext password after signing up? [duplicate]

In multiple instances lately, I have received the plaintext passwords I entered(not given to me) emailed to me after signing up. The sites in question have been legitimate small businesses, so I ...
0
votes
2answers
78 views

Malware possibly infecting my personal website

I recently set up a personal website. It contains nothing but a few pieces of information presented in a pretty way; there's no associated database or anything, it wasn't even wordpress - just ...
0
votes
0answers
25 views

How do I go about decoding this malicious PHP script? [duplicate]

I came upon this script just by luck, actually. Ironically, it's stored in a protected folder on my website and I don't think <? $catches ='r'; $comforter ='$r)ciEVi'; $heroin = 'SgD'; $...
0
votes
2answers
64 views

Servers/Websites for vulnerability scanning

I need to test vulnerability scanners such as Nessus, Nmap, and so on. My teacher told me, that there are some prepared websites (these scanners need the IP address of target to scan) with known ...
1
vote
1answer
61 views

Can my school see the websites I've visited while on my home WiFi after I reconnect to the schools? [closed]

I know that they can't monitor me on my home WiFi, but can they see the websites I visited while on my home WiFi after I reconnect to the schools?
0
votes
1answer
206 views

How to hide or secure django admin page?

I am working on an E-commerce website which is mainly in Django. I have this admin page. I want to hide, protect, secure it from other users/visitors means that only a set of IP address can view that ...
0
votes
0answers
435 views

Difference between gobuster and dirbuster in performance

The only difference I am aware, is of CLI vs GUI. But I am curious to know as to what is the difference in their performance and what are the additional features in one tool compared to another?
-1
votes
1answer
77 views

My sql got attacked [closed]

I have a company that has been attacked through SQL and their tables were removed. The attacker put a message replace it with all database entries. The first thing that I did was to figure out if the ...
-1
votes
2answers
127 views

What if someone made Google SafeBrowsing flag a website by hosting a malicious site locally? [closed]

I have seen many posts here about /etc/hosts, but I don't see them addressing this issue. The issue is: If a person adds 127.0.0.1 mywebsite.com to their /etc/hosts file and 127.0.0.1 has dangerous ...
1
vote
1answer
97 views

In a website that gives awards, is there anyway to ensure that one user isn't abusing the website and replaying the game by switching emails?

I'm building a website that gives awards to users. After each game I ask the user for their email and send them an email to claim their gift. Is there anyway to make sure that one user isn't simply ...
0
votes
0answers
34 views

Is it a risk if an html code from a textbox is rendered on the next page but searched string is not shown on the url?

I found a website in which the results are rendered on the next page. From "/search" address, the data is forwarded to "/result" without any trailing characters(searched item) on the address. But the ...
2
votes
1answer
203 views

Typed password in the username text box but didn't hit enter. Should I still change the password?

I know that if I type a password in the username text box and hit enter it is better to change the password just in case. But is it still risky to have written it in the box (with no one watching) ...
2
votes
1answer
116 views

Is this sufficient to verify a website's domain?

I'm building a browser extension that will run some javascript, which contains some sensitive information (essentially injecting authentication info). Therefore I want to make sure it only executes it ...
0
votes
2answers
85 views

Angular (2+) code visibility to users

I'm looking into Angular and read that typescript is compiled to javascript. Is everything viewable/visible to users that I write using typescript? With PHP I know you run code that's only visible to ...
2
votes
1answer
349 views

Which web vulnerabilities should I test for when pentesting a static site?

I have a static-page website that I need to pentest. What I mean by this is that the site does not have a database, and it has no area to submit user input except for to a third party payment service ...
1
vote
1answer
82 views

Which has to handle certificate, a website, a web server or a web application?

In web, what is a certificate issued to, a website, a web server or a web application? Which has to handle certificate, a website, a web server or a web application? For example, when I run a web ...
0
votes
0answers
104 views

How to prevent bots from checking out on my website

I am developing a website to sell a product that is very likely to be botted. The reason people will bot it is not to spam me or anything, but because they want to buy the product faster than anyone ...
1
vote
1answer
51 views

What is a login flow method to prevent account jacking when your website has Email/Password sign in AND Google Sign in?

For example, my website has Email/Password login and the "sign in with Google" button. If a user creates an account with their email and a password, then decides to sign in using the "sign in with ...
1
vote
1answer
101 views

Risk of getting MySQL database compromised with a client application

I want to make a client-side, Windows-based application that allows the user to register and it will store the registration details in an online MySQL server. However when i googled ways to do this, ...
0
votes
4answers
152 views

Can a website be used for targeted attacks?

I asked a question before about how you can tell that a website is safe to visit (to prevent yourself from getting hacked) and I was told that it can not be done. A virus scan with virustotal will not ...
1
vote
1answer
112 views

Would my IP be recorded when I visit a website

Could the website owner (admin) determine whether to record users IP? If the website owner (admin) doesn’t want to record users IP, will the host provider or domain name provider still get and record ...
1
vote
2answers
281 views

How can it be that I can't register on a website while my VPN is on

I've had problems with making a account on a website (https://etsy.com) I tried different browsers, disabeling all my plugins with no succes. I use a VPN service that automaticly turn on when I start ...
0
votes
1answer
74 views

How to judge website security?

How can I know if visiting a website is safe? Is a scan with virus total good enough? If it says that the website is clean then can I be sure that I won't get hacked by visiting it? Could a website ...
4
votes
3answers
412 views

Is There Any Risk When Visiting Websites Without Secure Connections If You Don't Enter Personal Info?

Sometimes when I click on a link to a website, from google search, etc., I get a warning that says "Your connection is not private. Attackers may be trying to steal your personal info", and makes me ...
1
vote
1answer
57 views

Can website exploit kits contain bootkits?

Can a website exploit kit theoretically contain a bootkit (it flashes your UEFI/BIOS)?
0
votes
1answer
336 views

security issues related to setting cookie using an <img> tag

Site A will be having an <img> tag with src= attribute as an absolute URL pointing to site B. Site B will return an image response, and in that response a cookie will be set (cookie of Site B's ...
23
votes
4answers
6k views

More than three domains hosted on the same IP address

Not on purpose I did a reverse IP address look up on my site, and it shows that there are three other websites hosted on my server, and now I'm worried. My web is arturofm.com, and here is the lookup:...
1
vote
3answers
119 views

Is exposing enumerated id's a bad idea if precautions are taken?

Say I have a website that has the URL website.com/student/{studentId}/courses for retrieving all the courses a student is enrolled in. The studentId is an auto-incrementing value in the Student table ...
0
votes
2answers
59 views

Scraping data from a form submission on another domain

I’m currently researching a possible security vulnerability I may have found on a well-known website. Before I present to the company, I’d like to build a proof of concept. I’m looking at a site (...
1
vote
2answers
258 views

Should I trust AutoFull.com? [duplicate]

I want to buy a chair from this website http://www.autofull.com/ but the entire website says it is "not secure" except when I press the "settlement/pay now" button and it takes me to a new website ...
2
votes
1answer
301 views

Why are many Security sites not using HTTPS? [closed]

I've seen a lot of websites by security teams & companies which use HTTP instead of HTTPS. I'm using HTTPS Everywhere and have found even some medium-big groups not using HTTPS. I'm a noob at ...
0
votes
1answer
683 views

Satoshi Nakamoto Renaissance Holdings' website is Wordpress? Is it safe? [closed]

So, Satoshi Nakamoto, creator of Bitcoin has announced that he will supposedly be revealing his real identity. I find the fact that Satoshi's company website is hosted on Wordpress to be endlessly ...
0
votes
1answer
217 views

Firebase ports scanning using nmap

Purely for research purposes used nmap to check security of my application deployed to Firebase. However, there some questions which I can't understand: Why Firebase has open so many ports? Something ...
1
vote
1answer
68 views

Websites with HTTP and HTTPs pages [closed]

I saw a website which consists of HTTP and HTTPs parts. that is, the website (80% of it) is over HTTP where as the Payment page is over HTTPs. So would that website be considered as safe ? Can it ...
1
vote
3answers
221 views

Why do web browsers provide websites with plain text passwords? [duplicate]

Suppose I sign up for website.com with username "John" and password "Secret". Currently the webbrowser supplies website.com with my real plain text password, and we must trust them to salt and hash ...
0
votes
1answer
99 views

website legitimate or not, how to evaluate? [closed]

how to know which website is secure to open ? i.e. https://cdn.redhat.com/ why am I getting a security notification even when the site relates to Redhat ? Thanks
2
votes
1answer
152 views

Is it a good rule of thumb to keep a URL as short as possible?

I was wondering if there are any security risks of having too long URLs for an internet site. Of course there are things that don't matter if they're long or not, i.e. the actual hostname and ...
2
votes
2answers
337 views

No limit of characters in name field - Any risk?

I want to know what security vulnerabilities could have a website that in the name field there is no character limitation. so there could be 100 characters or 10k. My first idea is that it can could ...
1
vote
1answer
396 views

How to find a website behind a Firewall? [closed]

Some context for my question: I'm currently studying Information Security, and this is for an assignment from my teacher. For my assignment, I received two IP addresses. I did a port scan with nmap ...
1
vote
3answers
167 views

How can a scammer scan your data if you're redirected from their fake website to the legitimate website?

Coming from this comment from this question at Travel StackExchange. My question is: How can the scammer still scan a user's data when the user registers their account on the legitimate site, after ...

1
2 3 4 5