Questions tagged [websites]
Applications or informational pages, distributed via HTTP or HTTPS, using a web server. Pages are typically interconnected by hyperlinks and may contain forms or even entire applications.
278 questions
0 votes
0 answers
24 views
Is using a remember_token as a primary authentication token considered a critical security vulnerability? [duplicate]
I'm working on a web application and came across a scenario where a remember_token cookie is used by itself to authenticate a user on subsequent visits, completely bypassing the need for a password or ...
1 vote
1 answer
190 views
Risk of publishing an IBAN on a public website [closed]
What are the risks of publishing a company's IBAN account number on a public website, as long as the security measures for website maintenance have been taken by the IT supplier that hosts this ...
- 11
0 votes
1 answer
444 views
Do many experts argue that apps are generally more secure than websites? [closed]
The Guardian says: Many tech experts also argue that apps are generally more secure than websites and allow banks and others to carry out sophisticated ID verification using face, voice and ...
- 447
3 votes
1 answer
407 views
HTTP-fallback and site settings in Chrome?
I am testing a deep packet inspection based application to block certain undesirable websites in a corporate network, eg gambling - williamhill.es . We do this by matching ServerName (HTTPS) or Host (...
- 31
0 votes
1 answer
12k views
Is youareanidiot.cc safe? [closed]
I was quite an imbecile for opening this website. It seemed to be some kind of prank, and it was "you are an idiot" song playing. However after looking it up on Reddit, some users said it ...
- 109
3 votes
3 answers
2k views
of the cookies created by OTHER websites, which ones would the browser allow a website to access?
I know that sites can share some information between each other by sharing cookies amongst themselves. They have to be in some kind of agreement with each other I assume? Or can any random site read ...
- 201
0 votes
1 answer
69 views
Is there any reasonable security reason for an administrator to prevent modification of locally loaded websites?
As most people know, it is very easy to modify a webpage’s local cached content (HTML, JS) through Inspect Element or various other means. This could be probably be stopped through something like ...
- 4,815
2 votes
0 answers
56 views
What could this partially nonsense URL request to my site be? [duplicate]
Url requested: https://site.azurewebsites.net/fky_7143_tczf_ohced.aspx?group=CON&branch=A&[email protected]&page=stocks/Bep_EQ32_agepbb_abfgjc_ctkdcem.aspx?veBjt=09983&...
2 votes
2 answers
203 views
GPG Impersonation
I was watching Sun Knudsen's videos and in one of them, he talks about GPG. Specifically, he said that he has 3 locations where he provides fingerprints of his signatures. YouTube, Github and his ...
- 95
4 votes
1 answer
318 views
Site preventing Page-closing, CTRL+W, Window Button, etc
I was happily learning ReactJS when I accidentally clicked the URL for www.someurl.com. After all the redirects, the final page prevented me from leaving using CTRL+W, Windows key, Escape, Opening the ...
- 143
0 votes
1 answer
855 views
Is polyfill.io still an immediate threat?
Polyfill.io is malicious: https://dev.to/snyk/polyfill-supply-chain-attack-embeds-malware-in-javascript-cdn-assets-55d6 https://www.sonatype.com/blog/polyfill.io-supply-chain-attack-hits-100000-...
- 111
1 vote
1 answer
53 views
LAN and external website [closed]
Consider a situation such as: private LAN <-> firewall A <-> DMZ <-> firewall B <-> internet (https://forum.huawei.com/enterprise/en/dmz-and-reverse-proxy/thread/...
- 11
-1 votes
1 answer
148 views
If a vulnerability is discovered on a website, is it better to contact the business owner or site designer/owner? [closed]
There are plenty of questions on this site about how to report a vulnerability (such as SQLi or XSS,) but none of them really answer my question of who to. I understand for a big corporation (although ...
- 4,815
0 votes
1 answer
174 views
I have access to companies internal files through SSRF and Path traversal both but want to leverage it further to website takeover
I have access to companies internal files through SSRF and Path traversal both but want to leverage it further to website takeover. Thus I can increase the impact and get more bounty then what they ...
2 votes
1 answer
873 views
Why would website block password manager auto-fill?
I use a password manager and have a browser plugin installed for it to simplify entering passwords into websites. I recently encountered a website (enterprise SaaS solution I use at work), which ...
- 281