Questions tagged [browser-hijacking]
69 questions
2
votes
0 answers
dll hijacking Related Questions
I read a about "dll hijacking" technology.
This usually occurs in the installation directory.(% Program Files%)
But, It is not possible to plant a DLL file in the "% Program Files%" path.
Because need UAC privilege.
Why is this a security issue?
As…
![](../../users/profiles/191917.webp)
y1026
- 21
- 1
2
votes
2 answers
Can browser bypass hosts configuration file?
for example, assume I have edited the hosts file with the following line:
127.0.0.1 malicious-site.com
if I happen to have installed a browser developed by people who owns this malicious website.
When I accidentally load a webpage which has a…
![](../../users/profiles/148651.webp)
Sajuuk
- 271
- 3
- 11
2
votes
1 answer
BeEF - What are the Indicators of Compromise (IOC)
If a phishing email came through with a link to a website hosting BeEF (or another such framework) what would be the Indicators of Compromise for such an attack.
Additionally, if systems were compromised what would be the best strategy to mitigate…
![](../../users/profiles/12253.webp)
pzirkind
- 707
- 6
- 12
2
votes
1 answer
Malicious script compromising browser extensions
In Firefox or Chrome,
is it possible for a web page script to compromise a user installed extension?
This might involve access to extension private data or obtain the same execution privileges as the compromised extension.
I am not interested in…
![](../../users/profiles/55476.webp)
antonio
- 845
- 2
- 8
- 15
2
votes
1 answer
Is JavaScript needed for browser code execution vulnerabilities?
Does JavaScript VM have to enabled in a vulnerable browser to exploit an arbitrary code execution bug?
There is a number of bugs in borwsers that don't seem to involve JavaScript. For example, CVE-2014-8967 or CVE-2015-6184. I understand what…
![](../../users/profiles/106551.webp)
kralyk
- 161
- 3
2
votes
1 answer
Why browser hijacker changes the homepage to yahoo
I have seen many browser hijacker like istartsurf, ask.com which changes the victim's search engine to yahoo. Why many(almost all) browser hijacker changes the search engines to yahoo. Is there any thing in yahoo.
![](../../users/profiles/95393.webp)
VISWESWARAN NAGASIVAM
- 273
- 2
- 15
1
vote
1 answer
How do I track IPs my computer is accessing?
Month or two my Mac OS machine in ~5% cases goes aviasales.ru instead of imgur.com links that I click. The history in newly opened tab has only the current Aviasales URL, and the link I click looks fine and goes to Imgur, when I click again. I…
![](../../users/profiles/25308.webp)
Nakilon
- 121
- 3
1
vote
1 answer
Interpreting anti-hacker-alliance analysis
One of security tools available for web browsing is (http://anti-hacker-alliance.com)
Please find below two readings:
a) Reading for IP 205.x.x.x that state among other-things "you are using proxy server"
b) Reading for my IP 41.x.x.x show 100.0 %…
![](../../users/profiles/58440.webp)
user176105
- 21
- 1
- 4
1
vote
1 answer
How can a browser hijacking attack change the browser's default homepage?
Some attacks on web browsers consist simply of advertising, so the default homepage of the browser is changed (which is just a small aspect of browser-hijacking).
My question: is installing (malicious) add-ons (via drive-by download attack) the…
user45139
1
vote
0 answers
Cookie hijacking query
I am trying to understand cookies and the hijacking/mitigation methods. I have noticed that some websites are more secure than others.
For example, I have two browsers (Edge and Firefox). I have installed Cookie-Editor onto the two browsers. Let's…
![](../../users/profiles/273229.webp)
0xab3d
- 111
- 2
1
vote
3 answers
Mistyped "google" and came to a suspicious page with a browser hijacker
I misspelt google as "googe" (very dumb, yes). It took me to a page that asked me to enter my birthdate. The URL was something along the lines of luj dott proasdf dott com
After going to malware index, it looks like it redirected to the same page as…
![](../../users/profiles/271945.webp)
mistes
- 111
- 2
1
vote
0 answers
Can a running SSH connection to a rootkit infected VPS be used to attack the remote client?
If a VPS running Debian 10 Xfce as a cloud desktop has been rootkit infected and there is an ongoing SSH connection with X2Go from a client to manage this server, is it possible for an attacker on the VPS to hijack the existing SSH connection in…
user264116
1
vote
1 answer
Mitigating physical cookie theft
Threat model:
Malicious user gaining physical access to browser cookies (e.g., 3rd party repair guy copying cookies to his own device or something like that). Let's say legit user did not clear cookies beforehand.
Possible mitigation:
Pre-authorize…
![](../../users/profiles/9317.webp)
IMB
- 2,888
- 6
- 28
- 42
1
vote
2 answers
Malware? Or a Browser Hijack by Google?
Today, clicking on links (via Chrome from my Google home page), I started seeing "https://beinternetawesome.withgoogle.com/en_us/" come up instead of the site I had attempted to load.
I'm trying to determine if this is due to typical/traditional…
![](../../users/profiles/170382.webp)
HumanJHawkins
- 121
- 7
1
vote
1 answer
Able to access other user information using valid session
So, I'ma login to the website using my valid account. But there is Web API (GET) using "application/x-www-form-urlencoded" or "parameter" that we can access without login. Some page needs to login to access it.
This is the case
Login…
![](../../users/profiles/232985.webp)
vreedom18
- 113
- 3