Questions tagged [websites]

Applications or informational pages, distributed via HTTP or HTTPS, using a web server. Pages are typically interconnected by hyperlinks and may contain forms or even entire applications.

Filter by
Sorted by
Tagged with
17
votes
2answers
9k views

How is the lack of the “SameSite” cookie flag a risk?

Nowadays cookies can have HTTPOnly, Secure and SameSite flags. The purposes of HTTPOnly and Secure flags are pretty clear. But what does SameSite scripting prevent exactly and how? Additionally, how ...
0
votes
2answers
68 views

Why are websites migrating to HTTPS? [duplicate]

HTTPS is the secure version of HTTP, which adds encryption, authentication and integration to the HTTP protocol. It is clear why banking websites and the websites with sensitive information are ...
1
vote
2answers
163 views

Is there a secure way that a website can retrieve and send your “forgotten” password in plain text [duplicate]

My question is related to What to do about websites that store plain text passwords. There are a few websites that I use that when I click "forgot password" my password is sent in plain text to the ...
0
votes
1answer
555 views

How to encrypt user name and password between my website and an Android app?

I am developing an ecommerce website and an Android application. How can I encrypt a user name and password so that I can make it more secure?
1
vote
2answers
328 views

Is there any reason to log out of websites?

If a user is logged in to a website (via https), is there any reason to log out of the website when they are done using it? For this question, please assume: The network is reasonably secure (ex. ...
0
votes
2answers
1k views

Guidelines for preventing HTML injection [closed]

We have a tell-a-friend feature on our website where we present a form to the user for recipient email and personal message. The personal message is added to our email template. The email is sent on ...
1
vote
1answer
535 views

Can a WAF block or detect crafted html file and obfuscated PHP script/shell

What happened was, a friend's company is using dated dot net nuke framework. A html page with 'hacked by xxxx' was found uploaded onto the web server. Upon investigating, it is determined that a ...
1
vote
2answers
69 views

Too many spam comments [closed]

My website is receiving too many spam comments, what I do? I have installed a plugin but I'm not satisfied with it. How to block spam comments and spam users etc.
0
votes
2answers
995 views

Should I host portfolio website in public GitHub repository? [closed]

I have a small portfolio site that I work on in my spare time as a way of demonstrating and applying what I have learned from school/work. Part of this demonstration involves me currently listing the ...
-1
votes
1answer
74 views

How to view the content from script that loads from a web page [closed]

I want to see what scripts web pages load into memory because sometimes they are malicious and I do not see what content or process is triggered.
3
votes
1answer
10k views

Is this passport survey website legitimate? [closed]

I recently asked a question on skeptics.se about a website regarding the legitimacy of it as a survey website for a passport survey. The website address is https://www.passportplanning.com, and is a ...
3
votes
1answer
351 views

Is it okay to keep .zip files in the public_html folder? [duplicate]

My company website just take copies of the public html folder and keep zip files as backup in the same folder, I want to know if this is secure or not ? Because other people don't know the name for ...
-8
votes
2answers
215 views

HTTP websites vs HTTPS websites [closed]

Why do we say that an http website is not secure compared to an https website?
14
votes
1answer
4k views

Is a plain password in the URL a potential security threat? [duplicate]

I'm in no way a security expert, in fact I'm just your average Joe with a question. I was on my car insurance website, I registered and as I logged in I saw my password, not encrypted, in plain ...
3
votes
4answers
527 views

Why don't web apps use custom security questions?

From my own reading, security questions on websites seem to have a reputation in the industry for being outdated and insecure, the basic information they need being easily available to anyone who can ...
1
vote
0answers
142 views

Is this link dangerous with source?

I received a suspicious email from a friend of mine with stange name of the form first.last@zs3.szczecin.pl, where first and last are his/her first and last names. But the domain is totally awkward. ...
1
vote
2answers
828 views

Risks of using unecrypted cookies

I am in the process of making a curated news website and I'm wondering about the safety/security of using unencrypted cookies to store basic user information (first name and zipcode). What are the ...
0
votes
2answers
77 views

Downloading software from websites that lacks a padlock

Some websites don't have a padlock symbol to the left of the URL in Firefox. The only symbol is the letter "i" in the center of a circle - colored in gray. How do I know whether it's safe to ...
1
vote
1answer
141 views

Have a HTTP or HTTPS website?

There were some questions regarding this topic, but none of them discussed if there is some expection, and if http is just enough for some kind of websites. I've seen lot of school/high school ...
0
votes
2answers
920 views

What vulnerabilities are there for a website that does not use SSL for a login page (or any pages)

I see many websites that do not implement SSL either when logging in or at all. I know that you can simply sniff traffic on those sites and therefore see the user/pass in plaintext but what other ...
0
votes
1answer
394 views

Is there any checklist for website security? [closed]

Is there a standard checklist to audit an organization's website security?
3
votes
4answers
2k views

How does a virus infect our computer just by visiting a website

I wondered how a virus infects our computer just by visiting a website, without user's assistance at all. I know that a malicious website can exploit some browsers' vulnerable features, such as ...
-1
votes
2answers
208 views

Why do websites insist that credit card numbers are entered as a single 16 digit number? [closed]

My bank cards all have a 16 digit card number on the front, written as 4 blocks of 4 digits, for example: 1234 5678 9012 3456 Any time I enter my credit card number on a website, however, I have to ...
4
votes
3answers
92 views

Data overflow instead of hiding

I was wondering, if instead of using a private way (like browsing incognito or even using TOR), is it a decent idea to use a program that visits as much random websites as possible (with a bandwidth ...
2
votes
1answer
102 views

Security Vulnerabilities and Risks for an Information only website (XSS)

My website is an information only website and all the information on it is available to all those who visit the website. There is no sensitive data. And we do not store any user submitted data nor ...
0
votes
1answer
50 views

Where to expose flaws in security? [duplicate]

Some websites have ridiculous security flaws. Thankfully the public is slowly becoming more aware, and many sites are fixing the more obvious ones, like lack of HTTPS, poor password creation ...
8
votes
2answers
2k views

Did XSS reach its end-of-life with the introduction of the HTTP X-XSS-Protection header?

With the introduction of the HTTP X-XSS-Protection header it seems to me that the vulnerability impact (read: amount of possibly affected users with modern browsers) is drastically reduced. Firstly, ...
3
votes
1answer
881 views

Getting subscribers on website from nowhere?

I have a weird question and I hope I am asking in the right place. Recently I checked some statistics on my website after a while and noticed that the number of email subscribers had jumped from about ...
2
votes
2answers
200 views

How to categorise web vulnerabilities in a report?

What is a good way to categorise the vulnerabilities in IT security reports. Assuming it's about a web-based environments like: Websites, Web applications, Web shops, Any interface using web-...
1
vote
1answer
140 views

Is it possible to DNS-spoof Exchange ActiveSync?

My company's SSL Certificate for basically all their websites and Activesync servers have expired long ago. For my upcoming meeting's sake I need to explain how this is very insecure. Unfortunately I ...
3
votes
3answers
161 views

How to transfer a database of usernames and passwords to a friend

Caveat: I basically know nothing about information security, so I apologize in advance. I'll try to keep the question as general as possible. I have a website X over which I have administrator ...
1
vote
2answers
81 views

Who do I inform when a website is compromised

I often receive phishing emails claiming to be big companies like PayPal. When I check the link I remove anything which could be used to confirm that it was me who clicked and open the link in a ...
4
votes
3answers
691 views

why is thepiratebay.se listed as deceptive site in Chrome and other browsers

Why is thepiratebay.se listed as deceptive site in Chrome and other browsers? My Norton says nothing about fishing or malware. There is no doubt that some organisations doesn't like thepiratebay but ...
2
votes
2answers
151 views

What could a malicious website do if you don't update Adobe Flash?

If you click on "Activate Adobe Flash" when Firefox warns that "this plugin is vulnerable and should be updated", you can still use Adobe Flash. What could a website do to you if the "plugin is ...
0
votes
0answers
125 views

Benefits/negatives of password-less authentication

I am facing the following dilemma: I have a client who has a very basic admin panel, he uses this once or twice a week and cannot do much, mainly update content and add products. Currently, the ...
5
votes
2answers
383 views

Is an application backend expected to potentially log sensitive customer data when in debug mode?

As I am working on a website that asks customers to enter data such as their name, address, phone number, obviously customer data that needs to be protected. I do my best to not log such data (...
1
vote
1answer
81 views

Securing Web Contact Forms Against Spams

I created a web contact from with the following restrictions: An IP can send only 1 query per 8 hours. A generic text based bootstrap captcha for the form (I know this can be replaced with reCaptcha)...
0
votes
1answer
44 views

What patterns or practices exist to protect users from site admins deleting the user's information?

Here's my situation: Say you run a service online that stores information that users of the service would want to keep for a long time. This information could be notes, files, etc. but it is ...
27
votes
5answers
9k views

How can I safely check whether an email link leads to a malicious website?

Over the last few weeks, I've gotten several spam emails from different friends that only contained links to different websites. I would like to click on those links and see what's on the website. ...
2
votes
1answer
120 views

Website link shows a code variable

A website I frequently visit is showing an error message. The usual Click 'here' link actually shows Click '$host_variable.xxxxxxName' to navigate to a certain page. Is it a security flaw? ...
1
vote
1answer
100 views

School website exposes root FS, where to report?

I was googling for some PCI device code and stumbled upon an indexed /sys file on a web server. Poking around a bit, it seems that the complete root filesystem is exposed trough /uploads/ls. So I can ...
2
votes
1answer
4k views

Is there an XSS vector for hidden input fields without using the HTML accesskey?

I have some cases of cross-site scripting (XSS) in hidden HTML input fields. There are some known XSS vectors that can be used for example using the HTML accesskey. XSS in hidden inputs is ...
6
votes
2answers
2k views

Website login using database credentials

Is it secure to login to a website by using database usernames, for each user? Is it a bad practice? What can be the issues? The idea is to create the users and permissions at database level. EDIT: ...
16
votes
2answers
3k views

Website security - should I hire a developer? [closed]

I'm going to create a new website with Joomla! 3. Potentially, this site will get me some money through ads but I'm a little worried about what could be done to attack it. I say a little because I'm ...
154
votes
2answers
17k views

I found unknown PHP code on my server. How do I de-obfuscate the code?

We've been getting a lot of noise regarding hacked PHP files here, and it's taking a lot of time to answer these questions. In many cases, they are off-topic. We've had a discussion about this on ...
1
vote
2answers
963 views

IMEI.info knows my phone before I put sim

Recently I brought a Moto G3 turbo phone, which I suspect is a factory reset by a seller from other customer, and dispatched to me. I search net for getting in if its factory reset, but non tricks ...
1
vote
2answers
4k views

I unknowingly visited a hacked site, what are my next steps?

I stumbled onto a hacked site a short while ago. Firefox blocked Flash from running, but are there any other vectors I should be concerned about? I'm pretty sure I had an account on the forum in ...
-1
votes
1answer
107 views

Does the page that links to my login page need to https?

So I realise the login ajax call must be https, and the page that ajax call is made from should also be https to prevent a man in the middle potentially changing the page and changing the form that ...
8
votes
2answers
745 views

Is PCI-DSS Compliance Required with PayPal Donate/Payment Buttons on Websites?

Reading about PCI-DSS 3 recently: Would like confirmation what I am interpreting here - you need PCI-DSS SAQ-A to have credit card associated payment or donation URL links on a merchant's website? ...
1
vote
2answers
2k views

Find unlisted web pages on a site? [duplicate]

If I have a website with an index.html page that was just a landing page with no other links, and I also have another html page hosted on the same domain that has no links to it, is there any way ...