Questions tagged [websites]

Applications or informational pages, distributed via HTTP or HTTPS, using a web server. Pages are typically interconnected by hyperlinks and may contain forms or even entire applications.

Filter by
Sorted by
Tagged with
0
votes
1answer
68 views

What are some well known websites that do not require multiple character sets in passwords?

NIST guidelines discourage password policies that require multiple character sets. Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or ...
38
votes
5answers
9k views

What does a website see if I am connected on my native IP and then enable my VPN?

As per the question. If I am connected to a website, streaming content from my native IP and I then enable my VPN, what does the website see?
3
votes
1answer
177 views

Is it a good idea to test a live company website as part of an interview process?

I got an interview task, which is to pentest the careers section of a company's website. I'm keen to play around with any website, and permission was given but this feels like a free pentest. I ...
2
votes
1answer
118 views

To whom do I report this bizarre behavior (possibly hijacked website or DNS highjack)?

My coworker searched for "cutadapt" at Google Scholar and the top hit was http://journal.embnet.org/index.php/embnetjournal/article/view/200. When he clicked on it, it took him to a site that said ...
64
votes
11answers
22k views

Why don't websites and devices offer fake logins for hackers?

I was thinking about this earlier this morning and was wondering why websites and devices don't offer fake logins for hackers? What I mean by that is that if a hacker finds out some of your details ...
-5
votes
1answer
2k views

Protecting against input type ="password" changes? [closed]

Are there any protections against users using Chrome Developer Tools to right click on a password input field, and then change input type="pass" to "text" to reveal the password? There are probably ...
-2
votes
1answer
144 views

Why do websites like Truecaller make you prove that you are not a robot after a limited number of searches?

I used Truecaller for searching for a number but after around 20 to 25 searches they started asking me to prove that I am not a robot. Is this for protecting their website from a DDoS attacks or is it ...
0
votes
1answer
4k views

Does a third level domain wildcard certificate prove a fourth level domain website? [duplicate]

Suppose I have a certificate for *.example.com and privileged access to all example.com websites. Sure I could install the wildcard certificate into https://api.example.com website so that it can ...
1
vote
1answer
250 views

Handling the loss of a phone with FIDO UAF

I would like to know how this UAF method works when we lose our phone. With Google Authenticator we have to save on a paper some info about the generation of the secret key. But how does this work ...
5
votes
1answer
10k views

Can websites track the tabs you open while logged into their website?

If I am on chrome and am looking up a product on Amazon on tab A, can they tell what I search if I open a tab B while tab A is still open? Should I use a new chrome or another browser window to ...
4
votes
2answers
470 views

How to store data on server without an ability to read it?

Let's say, we develop a social network website, which allows to send personal messages between users. We don't want anyone (even us) to read these messages, except for message sender and receiver. Is ...
3
votes
1answer
68 views

Is there anything that a regular user can do to help remove fake websites?

I'm talking about domains like msn.org and stackoveflow.com that impersonate major websites and serve up malicious ads such as the "critical alert from Microsoft" ad. I've tried reporting these ads ...
57
votes
7answers
22k views

Email received regarding Security flaw in website

I received an email to techsupport@websitename.com (pretty generic email) saying that there was a security flaw in my website etc. etc My initial reaction was that this was a scam. (How/why did they ...
-3
votes
1answer
242 views

Let's say I visit a website that installs malware on my computer, how bad can the malware be, and how can I know that it is there? [closed]

Ok, I'm a bit paranoid about malware and hacking, and I already know that visiting websites can give you malware without you knowing, so I was just wondering, how can I know if I have this type of ...
-2
votes
1answer
117 views

Trying to detect a firewall

I have some HTML that was detected by one of my scripts firewall detections, it looks like this: <!--- HTTP 1.1 Status Code: 403 HTTP Headers: {'Content-Length': '1233', 'X-Powered-By': 'ASP.NET', ...
1
vote
1answer
82 views

A website sends account credential field as "empty"

One of Finland's largest banks, S-Pankki, seems to use some uncommon method to send the username field. At least Firefox's password manager doesn't detect the entered username and I've also ...
0
votes
2answers
289 views

Anyone heard of this site and was it safe?

I was browsing a reddit page and found a strange link to what it looked to be a image hosting site that I've never heard of http://imgh.us/elliotwp1.jpg. I clicked the link and it said "404 not found"...
6
votes
1answer
772 views

What is the security impact of JavaScript minification?

In recent years the use of JavaScript minification for web applications proliferated so quickly that it can be considered as a defacto standard nowadays. I am wondering whether the use of such tools ...
0
votes
2answers
1k views

Conducting Ethical Phishing Attack [closed]

For research purposes, I'm conducting an ethical phishing attack in my institution. I have permission from the institution for the same. I've created the phishing site and the email content, and I'll ...
12
votes
3answers
6k views

Why doesn't Tornado have session

I've heard that cookies is less secure than the session. For example, if a web uses a cookie to detect if an user has logged in or not, people can forge a cookie to simulate a false user because he ...
0
votes
2answers
1k views

How was Lowe's website exploited to steal merchandise?

How was Lowe's website exploited to steal merchandise? It says they were able to order products without paying for them. http://www.foxnews.com/us/2017/08/16/couple-exploited-lowes-website-glitch-to-...
4
votes
1answer
2k views

Is it a security risk if the user enters html characters in a textbox and they're reflected on the next page in a website? (not script tags)

In my website I have a textbox where the user can enter whatever they want and the text is printed out on the next page. For certain cases, they can type HTML tags to format their message so that in ...
0
votes
1answer
124 views

Can I create a website on wordpress anonymously? [duplicate]

If I use a VPN that doesn't keep logs and create an email account, then use that email account to create a wordpress website (still using the VPN) and give no personal information (address, name, etc.)...
1
vote
1answer
102 views

How are hackers able to plant Phishing URLs in existing websites? [closed]

As the question says, How are hackers able to plant Phishing URLs in existing websites? And can it be detected?
1
vote
1answer
6k views

What risks are associated with 'parked' websites?

Our internet policy blocks so-called 'parked' websites, i.e. those that are registered but do not seem to be active. I'm not sure what tests are used to determine parked status. There is a tool that ...
6
votes
3answers
745 views

What causes the "This site may be hacked" or "This site ahead contains malware" messages?

How does Google exactly detect if a site may/is hacked? What exactly triggers the warnings? I've seen plenty of companies offer services that help to remove these warnings on websites and get your ...
4
votes
2answers
1k views

Software for testing XSS and other web sites vulnerabilities [closed]

One of my site would be submitted for vulnerability test, not sure if the company does this test manually. I was wondering if i can find any software where I specify all variables names used in my ...
7
votes
5answers
5k views

How to validate user input

I am having a lot of trouble understanding where I as a developer can validate the data that my users send to me. Let's say for a simple example I have a web page where it has a simple form that ...
0
votes
1answer
67 views

Two-Factor Authentication on downloadable client but not website

A friend of mine plays RuneScape, and mentioned to me that her account was recently compromised. She told me she has two step authentication on her RuneScape account, and on the email address ...
1
vote
3answers
3k views

Using hidden form fields to modify prices on a website

I came across this question on cybrary about the attack to be used to modify prices on a website. First off, I'm assuming that by prices they mean prices of a product like on an E-Commerce website.(...
1
vote
1answer
82 views

How can websites with URL traversal functionality protect itself from revealing its IP?

A good number of websites these days are not served directly over the internet, but through an intermediate providers, such as Cloudflare and Incapsula. A basic premise of the security provided by ...
0
votes
1answer
489 views

Google's view of a web page is corrupted

Recently, one of my website has been hacked in a very interesting way. By doing some researches I've found that I wasn't the only one affected by the hack, but didn't find anything about it. Note : ...
14
votes
1answer
2k views

What parties have access to the *full* requested URL of a website accessed via the HTTPS protocol? [duplicate]

What parties have access to the full requested URL of a website accessed via the HTTPS protocol? Here are some possibilities I can think of, and there could be more: local device accessing the ...
-2
votes
1answer
544 views

How to allow only selected people visit a webpage? [closed]

Simple question, is there a secure way to make your page require some sort of password? So in practise I'd give someone a password that would allow him to visit my webpage. I need something easy to be ...
0
votes
1answer
473 views

Is it possible to still perform click-jacking with if a website has SSL? [closed]

There are someways to stop click-jacking on websites without HTTPS, but I have seen that you cannot perform click-jacking on website the does have SSL. Is this true or can you still perform click-...
2
votes
2answers
934 views

How can someone stop clickjacking?

I was looking at a lecture of clickjacking and when I tried to create an iframe to go to website, I noticed that websites with no https are able vulnerable to clickjacking. Is there another way to ...
2
votes
2answers
154 views

Website customer e-mail collection form getting spammed, why and what to do

I am the webmaster for my girlfriend's page where she advertises her services as an online tutor. The webpage has a simple PHP post form, using which the visitors can leave their e-mail addresses to ...
122
votes
4answers
107k views

What is the website checking about my browser to protect the website from a DDoS?

Some sites I visit take me to a page that says roughly, "Checking your browser before accessing example.com. DDoS attack protection by CloudFlare". What exactly about my browser is being checked and ...
18
votes
2answers
9k views

How is the lack of the "SameSite" cookie flag a risk?

Nowadays cookies can have HTTPOnly, Secure and SameSite flags. The purposes of HTTPOnly and Secure flags are pretty clear. But what does SameSite scripting prevent exactly and how? Additionally, how ...
0
votes
2answers
69 views

Why are websites migrating to HTTPS? [duplicate]

HTTPS is the secure version of HTTP, which adds encryption, authentication and integration to the HTTP protocol. It is clear why banking websites and the websites with sensitive information are ...
1
vote
2answers
167 views

Is there a secure way that a website can retrieve and send your "forgotten" password in plain text [duplicate]

My question is related to What to do about websites that store plain text passwords. There are a few websites that I use that when I click "forgot password" my password is sent in plain text to the ...
0
votes
1answer
589 views

How to encrypt user name and password between my website and an Android app?

I am developing an ecommerce website and an Android application. How can I encrypt a user name and password so that I can make it more secure?
1
vote
2answers
464 views

Is there any reason to log out of websites?

If a user is logged in to a website (via https), is there any reason to log out of the website when they are done using it? For this question, please assume: The network is reasonably secure (ex. ...
0
votes
2answers
2k views

Guidelines for preventing HTML injection [closed]

We have a tell-a-friend feature on our website where we present a form to the user for recipient email and personal message. The personal message is added to our email template. The email is sent on ...
1
vote
1answer
671 views

Can a WAF block or detect crafted html file and obfuscated PHP script/shell

What happened was, a friend's company is using dated dot net nuke framework. A html page with 'hacked by xxxx' was found uploaded onto the web server. Upon investigating, it is determined that a ...
1
vote
2answers
71 views

Too many spam comments [closed]

My website is receiving too many spam comments, what I do? I have installed a plugin but I'm not satisfied with it. How to block spam comments and spam users etc.
0
votes
2answers
2k views

Should I host portfolio website in public GitHub repository? [closed]

I have a small portfolio site that I work on in my spare time as a way of demonstrating and applying what I have learned from school/work. Part of this demonstration involves me currently listing the ...
-1
votes
1answer
84 views

How to view the content from script that loads from a web page [closed]

I want to see what scripts web pages load into memory because sometimes they are malicious and I do not see what content or process is triggered.
3
votes
1answer
11k views

Is this passport survey website legitimate? [closed]

I recently asked a question on skeptics.se about a website regarding the legitimacy of it as a survey website for a passport survey. The website address is https://www.passportplanning.com, and is a ...
3
votes
1answer
495 views

Is it okay to keep .zip files in the public_html folder? [duplicate]

My company website just take copies of the public html folder and keep zip files as backup in the same folder, I want to know if this is secure or not ? Because other people don't know the name for ...