Questions tagged [websites]

Applications or informational pages, distributed via HTTP or HTTPS, using a web server. Pages are typically interconnected by hyperlinks and may contain forms or even entire applications.

Filter by
Sorted by
Tagged with
-8
votes
2answers
232 views

HTTP websites vs HTTPS websites [closed]

Why do we say that an http website is not secure compared to an https website?
14
votes
1answer
6k views

Is a plain password in the URL a potential security threat? [duplicate]

I'm in no way a security expert, in fact I'm just your average Joe with a question. I was on my car insurance website, I registered and as I logged in I saw my password, not encrypted, in plain ...
3
votes
4answers
707 views

Why don't web apps use custom security questions?

From my own reading, security questions on websites seem to have a reputation in the industry for being outdated and insecure, the basic information they need being easily available to anyone who can ...
1
vote
0answers
143 views

Is this link dangerous with source?

I received a suspicious email from a friend of mine with stange name of the form first.last@zs3.szczecin.pl, where first and last are his/her first and last names. But the domain is totally awkward. ...
1
vote
2answers
1k views

Risks of using unecrypted cookies

I am in the process of making a curated news website and I'm wondering about the safety/security of using unencrypted cookies to store basic user information (first name and zipcode). What are the ...
0
votes
2answers
78 views

Downloading software from websites that lacks a padlock

Some websites don't have a padlock symbol to the left of the URL in Firefox. The only symbol is the letter "i" in the center of a circle - colored in gray. How do I know whether it's safe to ...
1
vote
1answer
151 views

Have a HTTP or HTTPS website?

There were some questions regarding this topic, but none of them discussed if there is some expection, and if http is just enough for some kind of websites. I've seen lot of school/high school ...
0
votes
2answers
2k views

What vulnerabilities are there for a website that does not use SSL for a login page (or any pages)

I see many websites that do not implement SSL either when logging in or at all. I know that you can simply sniff traffic on those sites and therefore see the user/pass in plaintext but what other ...
0
votes
1answer
456 views

Is there any checklist for website security? [closed]

Is there a standard checklist to audit an organization's website security?
3
votes
4answers
2k views

How does a virus infect our computer just by visiting a website

I wondered how a virus infects our computer just by visiting a website, without user's assistance at all. I know that a malicious website can exploit some browsers' vulnerable features, such as ...
-1
votes
2answers
223 views

Why do websites insist that credit card numbers are entered as a single 16 digit number? [closed]

My bank cards all have a 16 digit card number on the front, written as 4 blocks of 4 digits, for example: 1234 5678 9012 3456 Any time I enter my credit card number on a website, however, I have to ...
4
votes
3answers
94 views

Data overflow instead of hiding

I was wondering, if instead of using a private way (like browsing incognito or even using TOR), is it a decent idea to use a program that visits as much random websites as possible (with a bandwidth ...
2
votes
1answer
108 views

Security Vulnerabilities and Risks for an Information only website (XSS)

My website is an information only website and all the information on it is available to all those who visit the website. There is no sensitive data. And we do not store any user submitted data nor ...
0
votes
1answer
52 views

Where to expose flaws in security? [duplicate]

Some websites have ridiculous security flaws. Thankfully the public is slowly becoming more aware, and many sites are fixing the more obvious ones, like lack of HTTPS, poor password creation ...
8
votes
3answers
2k views

Did XSS reach its end-of-life with the introduction of the HTTP X-XSS-Protection header?

With the introduction of the HTTP X-XSS-Protection header it seems to me that the vulnerability impact (read: amount of possibly affected users with modern browsers) is drastically reduced. Firstly, ...
3
votes
1answer
1k views

Getting subscribers on website from nowhere?

I have a weird question and I hope I am asking in the right place. Recently I checked some statistics on my website after a while and noticed that the number of email subscribers had jumped from about ...
2
votes
2answers
238 views

How to categorise web vulnerabilities in a report?

What is a good way to categorise the vulnerabilities in IT security reports. Assuming it's about a web-based environments like: Websites, Web applications, Web shops, Any interface using web-...
1
vote
1answer
150 views

Is it possible to DNS-spoof Exchange ActiveSync?

My company's SSL Certificate for basically all their websites and Activesync servers have expired long ago. For my upcoming meeting's sake I need to explain how this is very insecure. Unfortunately I ...
3
votes
3answers
161 views

How to transfer a database of usernames and passwords to a friend

Caveat: I basically know nothing about information security, so I apologize in advance. I'll try to keep the question as general as possible. I have a website X over which I have administrator ...
1
vote
2answers
82 views

Who do I inform when a website is compromised

I often receive phishing emails claiming to be big companies like PayPal. When I check the link I remove anything which could be used to confirm that it was me who clicked and open the link in a ...
4
votes
3answers
702 views

why is thepiratebay.se listed as deceptive site in Chrome and other browsers

Why is thepiratebay.se listed as deceptive site in Chrome and other browsers? My Norton says nothing about fishing or malware. There is no doubt that some organisations doesn't like thepiratebay but ...
2
votes
2answers
154 views

What could a malicious website do if you don't update Adobe Flash?

If you click on "Activate Adobe Flash" when Firefox warns that "this plugin is vulnerable and should be updated", you can still use Adobe Flash. What could a website do to you if the "plugin is ...
0
votes
0answers
129 views

Benefits/negatives of password-less authentication

I am facing the following dilemma: I have a client who has a very basic admin panel, he uses this once or twice a week and cannot do much, mainly update content and add products. Currently, the ...
5
votes
2answers
453 views

Is an application backend expected to potentially log sensitive customer data when in debug mode?

As I am working on a website that asks customers to enter data such as their name, address, phone number, obviously customer data that needs to be protected. I do my best to not log such data (...
1
vote
1answer
95 views

Securing Web Contact Forms Against Spams

I created a web contact from with the following restrictions: An IP can send only 1 query per 8 hours. A generic text based bootstrap captcha for the form (I know this can be replaced with reCaptcha)...
0
votes
1answer
45 views

What patterns or practices exist to protect users from site admins deleting the user's information?

Here's my situation: Say you run a service online that stores information that users of the service would want to keep for a long time. This information could be notes, files, etc. but it is ...
28
votes
5answers
12k views

How can I safely check whether an email link leads to a malicious website?

Over the last few weeks, I've gotten several spam emails from different friends that only contained links to different websites. I would like to click on those links and see what's on the website. ...
2
votes
1answer
122 views

Website link shows a code variable

A website I frequently visit is showing an error message. The usual Click 'here' link actually shows Click '$host_variable.xxxxxxName' to navigate to a certain page. Is it a security flaw? ...
1
vote
1answer
104 views

School website exposes root FS, where to report?

I was googling for some PCI device code and stumbled upon an indexed /sys file on a web server. Poking around a bit, it seems that the complete root filesystem is exposed trough /uploads/ls. So I can ...
3
votes
1answer
6k views

Is there an XSS vector for hidden input fields without using the HTML accesskey?

I have some cases of cross-site scripting (XSS) in hidden HTML input fields. There are some known XSS vectors that can be used for example using the HTML accesskey. XSS in hidden inputs is ...
6
votes
2answers
2k views

Website login using database credentials

Is it secure to login to a website by using database usernames, for each user? Is it a bad practice? What can be the issues? The idea is to create the users and permissions at database level. EDIT: ...
16
votes
2answers
3k views

Website security - should I hire a developer? [closed]

I'm going to create a new website with Joomla! 3. Potentially, this site will get me some money through ads but I'm a little worried about what could be done to attack it. I say a little because I'm ...
161
votes
2answers
20k views

I found unknown PHP code on my server. How do I de-obfuscate the code?

We've been getting a lot of noise regarding hacked PHP files here, and it's taking a lot of time to answer these questions. In many cases, they are off-topic. We've had a discussion about this on ...
1
vote
2answers
976 views

IMEI.info knows my phone before I put sim

Recently I brought a Moto G3 turbo phone, which I suspect is a factory reset by a seller from other customer, and dispatched to me. I search net for getting in if its factory reset, but non tricks ...
1
vote
2answers
4k views

I unknowingly visited a hacked site, what are my next steps?

I stumbled onto a hacked site a short while ago. Firefox blocked Flash from running, but are there any other vectors I should be concerned about? I'm pretty sure I had an account on the forum in ...
-1
votes
1answer
107 views

Does the page that links to my login page need to https?

So I realise the login ajax call must be https, and the page that ajax call is made from should also be https to prevent a man in the middle potentially changing the page and changing the form that ...
8
votes
2answers
917 views

Is PCI-DSS Compliance Required with PayPal Donate/Payment Buttons on Websites?

Reading about PCI-DSS 3 recently: Would like confirmation what I am interpreting here - you need PCI-DSS SAQ-A to have credit card associated payment or donation URL links on a merchant's website? ...
1
vote
2answers
4k views

Find unlisted web pages on a site? [duplicate]

If I have a website with an index.html page that was just a landing page with no other links, and I also have another html page hosted on the same domain that has no links to it, is there any way ...
2
votes
1answer
193 views

Could somebody explain how the ASDA site is vulnerable?

I'm sure many of you will have seen the CSRF exploit highlighted by Paul Moore that ASDA have known about for two years (Paul's blog) I am trying to find an explanation as to WHY the website is ...
1
vote
1answer
1k views

Unauthorized access to a page - when or if you should return 401 HTTP status code

When a user requests a page that they don't have access to; should you return a 401 HTTP status code and a page to notify the user. In the past I have worked under the idea thats bad practice, as ...
1
vote
2answers
620 views

Are third party authentification provider included via iframe by default considered (in)secure?

Authentification provider X is used by many non-related websites like A, B and C as (sole) authentification provider. X therefor provides a framework for athentification which includes a login form ...
6
votes
1answer
473 views

The Peer-To-Peer Web

Good Morning Guys, I'm currently looking into the Project Maelstorm (BitTorrent Peer-To-Peer Web Browser Project), and a question popped up in mind. When on a P2P network, users share the file which ...
4
votes
2answers
99 views

Using identifiers in URLs to authenticate users

Someone I know is registered on a community website where they can exchange messages etc. Taking a look at the email notification they receive when something new has been posted, contains an image ...
1
vote
0answers
47 views

Few sites are shown as Certificate is obsolete in Chrome(https is struck off). But they're marked as green in IE [duplicate]

For example, for few sites the 'https' part of website is when loaded through Chrome (installed in workplace) states that the connection is certified but it also states that the resources in the page ...
1
vote
3answers
193 views

Why are websites obviously run for nefarious reasons not taken offline asap?

Although the question has a much broader scope an example case is my posted question: Should I worry if I have tried to ssh into a 'fake' dyndns.org site? (with ssh keys) In summary the ...
3
votes
3answers
429 views

Are people trying to hack my website?

On my website I added a little function, that logs IP, client/browser information, path, and a time stamp. Today I checked my database, and I had a lot of weird requests. Here are a few of them: ...
1
vote
1answer
884 views

How to add a malicious file scanner to live server?

One of my WordPress websites recently got hacked, and I had to download the full website to my local PC and clean it. As soon as I downloaded the website, my antivirus software found the malicious ...
-1
votes
2answers
178 views

Is it dangerous to interrupt session on a web-site?

For example if I just close page or browser or anything else (without clicking "log out" on a site) - can this somehow endanger my account (info leaking or illegal access to an account) ?
0
votes
1answer
61 views

CDN information [closed]

If I have a website that is content based, and the web server accesses a CMS to determine what to display on the site for a particular page. This is not particularly fast and it requires computing ...
1
vote
2answers
484 views

Problems with the security certificate

On my phone when I try and access my regular websites, I get the error message " there are problems with the security certificate of this website". More often than not I still proceed onto the website....