Questions tagged [websites]

Applications or informational pages, distributed via HTTP or HTTPS, using a web server. Pages are typically interconnected by hyperlinks and may contain forms or even entire applications.

Filter by
Sorted by
Tagged with
2
votes
1answer
122 views

Typed password in the username text box but didn't hit enter. Should I still change the password?

I know that if I type a password in the username text box and hit enter it is better to change the password just in case. But is it still risky to have written it in the box (with no one watching) ...
2
votes
1answer
94 views

Is this sufficient to verify a website's domain?

I'm building a browser extension that will run some javascript, which contains some sensitive information (essentially injecting authentication info). Therefore I want to make sure it only executes it ...
-2
votes
0answers
63 views

Which open source tools are being used for scanning websites on crypto-miners? [closed]

I'm searching for an open source tool for massive scanning to check whether the website is using crypto-mining scripts or not.
0
votes
2answers
71 views

Angular (2+) code visibility to users

I'm looking into Angular and read that typescript is compiled to javascript. Is everything viewable/visible to users that I write using typescript? With PHP I know you run code that's only visible to ...
0
votes
1answer
77 views

Which web vulnerabilities should I test for when pentesting a static site?

I have a static-page website that I need to pentest. What I mean by this is that the site does not have a database, and it has no area to submit user input except for to a third party payment service ...
1
vote
1answer
60 views

Which has to handle certificate, a website, a web server or a web application?

In web, what is a certificate issued to, a website, a web server or a web application? Which has to handle certificate, a website, a web server or a web application? For example, when I run a web ...
0
votes
0answers
89 views

How to prevent bots from checking out on my website

I am developing a website to sell a product that is very likely to be botted. The reason people will bot it is not to spam me or anything, but because they want to buy the product faster than anyone ...
1
vote
1answer
45 views

What is a login flow method to prevent account jacking when your website has Email/Password sign in AND Google Sign in?

For example, my website has Email/Password login and the "sign in with Google" button. If a user creates an account with their email and a password, then decides to sign in using the "sign in with ...
1
vote
2answers
73 views

Risk of getting MySQL database compromised with a client application

I want to make a client-side, Windows-based application that allows the user to register and it will store the registration details in an online MySQL server. However when i googled ways to do this, ...
0
votes
4answers
147 views

Can a website be used for targeted attacks?

I asked a question before about how you can tell that a website is safe to visit (to prevent yourself from getting hacked) and I was told that it can not be done. A virus scan with virustotal will not ...
1
vote
1answer
102 views

Would my IP be recorded when I visit a website

Could the website owner (admin) determine whether to record users IP? If the website owner (admin) doesn’t want to record users IP, will the host provider or domain name provider still get and record ...
1
vote
2answers
135 views

How can it be that I can't register on a website while my VPN is on

I've had problems with making a account on a website (https://etsy.com) I tried different browsers, disabeling all my plugins with no succes. I use a VPN service that automaticly turn on when I start ...
0
votes
1answer
58 views

How to judge website security?

How can I know if visiting a website is safe? Is a scan with virus total good enough? If it says that the website is clean then can I be sure that I won't get hacked by visiting it? Could a website ...
4
votes
3answers
206 views

Is There Any Risk When Visiting Websites Without Secure Connections If You Don't Enter Personal Info?

Sometimes when I click on a link to a website, from google search, etc., I get a warning that says "Your connection is not private. Attackers may be trying to steal your personal info", and makes me ...
1
vote
1answer
50 views

Can website exploit kits contain bootkits?

Can a website exploit kit theoretically contain a bootkit (it flashes your UEFI/BIOS)?
1
vote
1answer
108 views

What security arrangements do I need to think about when passing a password through my site server

I want to automate some of my home admin. I'm writing a small-ish website, to do that. Written in C#/.NET, hosted on Azure, backed by an Azure SQL DB, codebase available publicly on GitHub. One of ...
0
votes
1answer
79 views

security issues related to setting cookie using an <img> tag

Site A will be having an <img> tag with src= attribute as an absolute URL pointing to site B. Site B will return an image response, and in that response a cookie will be set (cookie of Site B's ...
23
votes
4answers
5k views

More than three domains hosted on the same IP address

Not on purpose I did a reverse IP address look up on my site, and it shows that there are three other websites hosted on my server, and now I'm worried. My web is arturofm.com, and here is the lookup:...
0
votes
1answer
84 views

Published URL File APP.CSS

I am crossing an analysis on a website and while fuzzing and testing I came across the below URL: https//www.****.**.*/content/css/app.css Which generated the below output: /* Minification failed. ...
0
votes
2answers
55 views

Scraping data from a form submission on another domain

I’m currently researching a possible security vulnerability I may have found on a well-known website. Before I present to the company, I’d like to build a proof of concept. I’m looking at a site (...
1
vote
3answers
109 views

Is exposing enumerated id's a bad idea if precautions are taken?

Say I have a website that has the URL website.com/student/{studentId}/courses for retrieving all the courses a student is enrolled in. The studentId is an auto-incrementing value in the Student table ...
1
vote
2answers
83 views

Should I trust AutoFull.com? [duplicate]

I want to buy a chair from this website http://www.autofull.com/ but the entire website says it is "not secure" except when I press the "settlement/pay now" button and it takes me to a new website ...
2
votes
1answer
283 views

Why are many Security sites not using HTTPS? [closed]

I've seen a lot of websites by security teams & companies which use HTTP instead of HTTPS. I'm using HTTPS Everywhere and have found even some medium-big groups not using HTTPS. I'm a noob at ...
0
votes
1answer
676 views

Satoshi Nakamoto Renaissance Holdings' website is Wordpress? Is it safe? [closed]

So, Satoshi Nakamoto, creator of Bitcoin has announced that he will supposedly be revealing his real identity. I find the fact that Satoshi's company website is hosted on Wordpress to be endlessly ...
0
votes
1answer
129 views

Firebase ports scanning using nmap

Purely for research purposes used nmap to check security of my application deployed to Firebase. However, there some questions which I can't understand: Why Firebase has open so many ports? Something ...
1
vote
1answer
67 views

Websites with HTTP and HTTPs pages [closed]

I saw a website which consists of HTTP and HTTPs parts. that is, the website (80% of it) is over HTTP where as the Payment page is over HTTPs. So would that website be considered as safe ? Can it ...
110
votes
4answers
74k views

What is the website checking about my browser to protect the website from a DDoS?

Some sites I visit take me to a page that says roughly, "Checking your browser before accessing example.com. DDoS attack protection by CloudFlare". What exactly about my browser is being checked and ...
1
vote
3answers
207 views

Why do web browsers provide websites with plain text passwords? [duplicate]

Suppose I sign up for website.com with username "John" and password "Secret". Currently the webbrowser supplies website.com with my real plain text password, and we must trust them to salt and hash ...
5
votes
2answers
778 views

CSRF token unique per user session - Why?

OWASP recommends that a CSRF token should be unique per user session. What is the attack vector or reasoning behind that? How could an attacker exploit a web application that does not invalidate the ...
0
votes
1answer
85 views

website legitimate or not, how to evaluate? [closed]

how to know which website is secure to open ? i.e. https://cdn.redhat.com/ why am I getting a security notification even when the site relates to Redhat ? Thanks
2
votes
1answer
149 views

Is it a good rule of thumb to keep a URL as short as possible?

I was wondering if there are any security risks of having too long URLs for an internet site. Of course there are things that don't matter if they're long or not, i.e. the actual hostname and ...
2
votes
2answers
204 views

No limit of characters in name field - Any risk?

I want to know what security vulnerabilities could have a website that in the name field there is no character limitation. so there could be 100 characters or 10k. My first idea is that it can could ...
1
vote
1answer
271 views

How to find a website behind a Firewall? [closed]

Some context for my question: I'm currently studying Information Security, and this is for an assignment from my teacher. For my assignment, I received two IP addresses. I did a port scan with nmap ...
1
vote
3answers
162 views

How can a scammer scan your data if you're redirected from their fake website to the legitimate website?

Coming from this comment from this question at Travel StackExchange. My question is: How can the scammer still scan a user's data when the user registers their account on the legitimate site, after ...
11
votes
1answer
1k views

Best Practices for Security Questions

When a website asks me to enter security questions in addition to a password what is best practice on my part? This often happens with banks and other institutions but I see it less with other ...
1
vote
2answers
633 views

Is it possbile to conduct http header injection attack with a web site or web app uses https?

If a web site or web application is running with https, is it possible to conduct http header attacks like http header injections and so on?
22
votes
2answers
5k views

If the Charles SSL Proxy shows me sensitive data, is that data insecure/exposed?

Today I was exploring a website used for keeping track of student grades and everything related to school. Basically like a school progress tracker for your child which is used by 90% of schools in my ...
1
vote
1answer
88 views

Will SIM‐like PIN on website as second password increase security

On SIM cards, which are used in mobile telephony, PIN (and PUK) is used. Unlike a password, they are locked after some incorrect attempts to prevent brute force attack. If wrong PIN is entered 3 times,...
1
vote
3answers
125 views

Security concerns around sharing secret on a website

I need to share credentials with users. These credentials are created when the user wants them, but cannot be chosen by the user specifically (AAD credentials). I want to share the same with the user ...
33
votes
4answers
9k views

What is more safe for browsing the web: PC or smartphone?

The scenario is: somebody without concern about security is navigating through the web. This person will access doubtful websites, like adult content or media sharing, for example. Between a pc with ...
2
votes
2answers
149 views

Website customer e-mail collection form getting spammed, why and what to do

I am the webmaster for my girlfriend's page where she advertises her services as an online tutor. The webpage has a simple PHP post form, using which the visitors can leave their e-mail addresses to ...
3
votes
1answer
278 views

Can websites uniquely identify users by the sim card used to access the website?

If I was to use a phone's data connection to access a website, and then pop that sim card into another phone to access the same website, could the website tell that I am the same user?
1
vote
0answers
67 views

How to determine if a website has been hijacked?

I noticed that the URL of a website I sometimes visit was redirecting to a new URL. I noticed this through a tool that I use that does not actually load the new URL. I was surprised by this change, ...
0
votes
2answers
51k views

Browsing file/directory structure of a website

I want to know whether can we browse file/directory structure of any website. If yes, then how? If no, why can't we?
0
votes
1answer
84 views

How to know you're secure?

How do you KNOW your website is secure? (Accounting only for your own mistakes; i.e. assuming the libraries you use are flawless.) For any given issue (e.g. XSS, MitM, etc.) there are lists of ...
1
vote
1answer
73 views

Account identified only by name, surname and date of birth

I am working in QA field and we have a project about a famous booking website. I have discovered that if I create an account with the same name, surname and date of birth of an already registered ...
-3
votes
2answers
139 views

website security of a domain

There is a website and I want to see if it is secure or not: When I enter the site with the domain address as https://2nate.com/ the browser says that it is secure. But when I enter the domain ...
64
votes
6answers
16k views

Employer makes me use what I believe to be an insecure website for HR functions. What to do?

At my job, to be able to view my paychecks, vacation hours and HR data on myself I need to log into a 3rd party website. I'm by no means a security expert or expert programmer but I could tell (...
4
votes
2answers
8k views

How secure is CodeIgniter 3.x?

How secure is the CodeIgniter 3.x framework? I have read that people discourage usage of CodeIgniter because it is unsafe. The problem is: These posts are old and is mainly pointed to the 2.x versions ...
-9
votes
2answers
802 views

I need to hack my website [closed]

I'm writing a simple web framework for a project of mine and need to ensure that the websites it produces are secure. In order to check this I thought I might as well just try and hack my own website ...

1 2 3 4 5