941

Avast Secure Browser follows the Chrome 95.0 specifications here: https://privacytests.org/

Also see the tenta.com/test & browser privacy test gives an overall score of 45/100. (webbrowsertools.com)

polonus

942

How to work webhint inside the browser’s development console?
Install the extension and then open Ctrl+Shift+I now. After that click hint at the top far right in the developer’s console.

Hint will go over the page opened and inform you with tips (hints/issues).

Example for: htxps://ai-techpark.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
CSS features with 2 warnings: ‘outline-offset’ is not supported by Internet Explorer.
‘content-type’ header charset value should be ‘utf-8’.

‘content-type’ header media type value should be ‘text/javascript’, not ‘application/x-javascript’.

HTML: Resource should use cache busting but URL does not match configured patterns.

JS: JavaScript content should be minified. Security header issues.

But there is more with the general site as scanned for by hackertarget wp scan:

Scanned https://hackertarget.com/wordpress-security-scan/ we will get 6 issues.

Outdated kernel software - outdated Word Press version, outdated plug-ins.

Not being disabled: User Enumeration
The first two user ID’s were tested to determine if user enumeration is possible.

Username Name
ID: 1 techpark
ID: 2 businesswire
It is recommended to rename the admin user account to reduce the chance of brute force attacks occurring. As this will reduce the chance of automated password attackers gaining access. Take note that if the author archives are enabled it is usually possible to enumerate all users within a WordPress installation.

And also here: Directory Indexing
In the test an attempt was made to list the directory contents of the uploads and plugins folders to determine if Directory Indexing is enabled. This is a common information leakage vulnerability that can reveal sensitive information regarding your site configuration or content.

Path Tested Status
/wp-content/uploads/ enabled
/wp-content/plugins/ disabled
Directory indexing is tested on the /wp-content/uploads/ and /wp-content/plugins/ directores. Note that other directories may have this web server feature enabled, so ensure you check other folders in your installation. It is good practice to ensure directory indexing is disabled for your full WordPress installation either through the web server configuration or .htaccess.

Linked sites and js resources all checked. But you can lint them using webhint one by one.

Retire.js (also a browser extension) finds:
jquery 1.12.4 Found in -https://ai-techpark.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp _____Vulnerability info:
Medium 2432 3rd party CORS request may execute CVE-2015-9251 1234
Medium CVE-2015-9251 11974 parseHTML() executes scripts in event handlers 123
Medium CVE-2019-11358 jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, …) because of Object.prototype pollution 123
Medium CVE-2020-11022 Regex in its jQuery.htmlPrefilter sometimes may introduce XSS 1
Medium CVE-2020-11023 Regex in its jQuery.htmlPrefilter sometimes may introduce XSS 1
jquery-migrate 1.4.1 Found in -https://ai-techpark.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1

Enjoy my good friends, enjoy - developer console a real trove of security information opens up gradually :wink:

pol

943

Its a shame that the old URL scanner link doesn’t work any more, -https://webhint.io/scanner/ I get a 404 error on that link now.

Not sure I would want to install a browser add-on to carry out these checks (if that is what it is doing).

944

@ DavidR,

Happens all the time. Webhint is not the only online scanner, that has disappeared over time. Some don’t even reappear as an extension for use inside the developer’s console. Google won’t allow online dom-xss scanners, but allows instances like questionable Punkspider.

So webhint has now been reduced to a community of approx. 4.000 developers.
Glad I could make it back to work for the website analysis I do here.

But the going gets more and more narrow all the time.
Just another script taken off of tampermonkey, because Googl insists on -180.upload.com, -4upfiles.com and -get.adobe.com
no longer being blocked by that particular script, and it seems “they call the shots globally”.

Alas, it is like it is,

polonus (volunteer 3rd party cold reconnaissance website security analyst and website error-hunter)

945

Another disadvantage of using extensions in the developer console is that it is not suited for webpage scanning,
as a website could be potentially malicious. Then an online third party scan could be the only secure option left
or using a special browser like Bobby’s Malzilla for instance with a specific VM.

Malware should be studied on a stand alone offline device, one not being connected to the Internet.

So there are a couple of online scanners left.
For instance, this one: https://www.web-malware-removal.com/website-malware-virus-scanner/

Checked a site and is OK, but has some server related issue:

[quote]
Server Details:

apache

Google and Web-Browser Content different! (an issue known as so-called “cloaking” (pol).
Google: 64539 bytes Firefox: 64743 bytes, Diff: 204 bytes

l" class=“rss_link”>rss twitter …

Suspicious links found
-https://www.certifiedsecure.com → ‘’
-https://www.certifiedsecure.com/live?q=secnl20211116 → ’ ’

HTML Source: View → -https://www.websicherheit.at/_d/hilite.php?url=https://www.security.nl

Console information received:

Failed to load resource: net::ERR_FILE_NOT_FOUND
hilite.php:1 Access to fetch at ‘-https://s-install.avcdn.net/aos/assets/prod/translations/Locale-en-US.json’ from origin ‘https://www.websicherheit.at’ has been blocked by CORS policy: No ‘Access-Control-Allow-Origin’ header is present on the requested resource. If an opaque response serves your needs, set the request’s mode to ‘no-cors’ to fetch the resource with CORS disabled.
s-install.avcdn.net/aos/assets/prod/translations/Locale-en-US.json:1 Failed to load resource: net::ERR_FAILED
userscript.html?name=AdRemover.user.js&id=2e3eadc0-39e9-4512-bab0-1e350c99d118:236 Starting AdRemover 8.5 on https://www.websicherheit.at/_d/hilite.php?url=https://www.security.nl …
userscript.html?name=AdRemover.user.js&id=2e3eadc0-39e9-4512-bab0-1e350c99d118:760 AdRemover 8.5 has finished it’s work! [89 ms]
VM42:69 Syntax error @ “Malware Script Detector v 1.1 Enhanced”!
##########################
JSHINT output:
##########################

SyntaxError: Unexpected identifier
at eval ()
at :4:80
at Object.t [as F_c] (:3:191)
at Object.E_u (:4:244)
at eval (eval at exec_fn (:2:115), :67:477)
at Object.create (eval at exec_fn (:2:115), :69:193)
at c (eval at exec_fn (:2:115), :7:231)
at :4:80
at i (eval at exec_fn (:2:115), :5:165)
at eval (eval at exec_fn (:2:115), :5:292)
eval @ VM42:69
VM42:69 Syntax error @ “Alert DOM-XSS Userscript”!
##########################
JSHINT output:
##########################

SyntaxError: Invalid regular expression flags
at eval ()
at :4:80
at Object.t [as F_c] (:3:191)
at Object.E_u (:4:244)
at eval (eval at exec_fn (:2:115), :67:477)
at Object.create (eval at exec_fn (:2:115), :69:193)
at c (eval at exec_fn (:2:115), :7:231)
at :4:80
at i (eval at exec_fn (:2:115), :5:165)
at eval (eval at exec_fn (:2:115), :5:292)
eval @ VM42:69
VM42:69 Uncaught SyntaxError: Unexpected identifier
at eval ()
at :4:80
at Object.t [as F_c] (:3:191)
at Object.E_u (:4:244)
at eval (eval at exec_fn (hilite.php:2), :67:477)
at Object.create (eval at exec_fn (hilite.php:2), :69:193)
at c (eval at exec_fn (hilite.php:2), :7:231)
at :4:80
at i (eval at exec_fn (hilite.php:2), :5:165)
at eval (eval at exec_fn (hilite.php:2), :5:292)
VM42:69 Uncaught SyntaxError: Invalid regular expression flags
at eval ()
at :4:80
at Object.t [as F_c] (:3:191)
at Object.E_u (:4:244)
at eval (eval at exec_fn (hilite.php:2), :67:477)
at Object.create (eval at exec_fn (hilite.php:2), :69:193)
at c (eval at exec_fn (hilite.php:2), :7:231)
at :4:80
at i (eval at exec_fn (hilite.php:2), :5:165)
at eval (eval at exec_fn (hilite.php:2), :5:292)
userscript.html?name=AdRemover.user.js&id=2e3eadc0-39e9-4512-bab0-1e350c99d118:260 Starting AdRemover 8.5 on
-https://www.websicherheit.at/_d/hilite.php?url=htxps://www.security.nl 4 seconds after page load …
102VM94 watch-expression-1.devtools:1 Timer ‘default’ already exists
(anonymous) @ VM94 watch-expression-1.devtools:1

We could also audit using Lighthouse and node.js.
Final results:

Webpage Score
Malware A Spam A Phishing A
External Status
Blacklisting A Google Spam A
Server C

polonus

946

Thanks for the link, I will check it out soon no doubt.

947

But before you start, study a particular subject - like for instance the ins and outs of DOM-XSS sinks and sources.
Also read from stackoverflow and other resources. A researcher/error-hunter should read-inform-read-inform
to get familiar with all the aspects of what he or she is doing.

Whenever you are into a form of particular specific scanning,
be ready to make yourself familiar with resources, for instance by using spreadsheets.

For DOM-XSS sinks and sources like these examples:
https://docs.google.com/spreadsheets/d/1Mnuqkbs9L-s3QpQtUrOkPx6t5dR3QyQo24kCVYQy7YY/edit#gid=0

Above particular spreadsheet is meant to work on a specific native jQuery version.

pol

948

Next to a website address (URL or uri) one should also always check the corresponding IP (could be several) for that particular website.

IP could be on a banlist, check: https://www.dnsqueries.com/en/check_banned_ip.php
Also check here: http://www.brightcloud.com/tools/url-ip-lookup.php
or here: https://www.threatcrowd.org/ip.php?ip=216.58.208.33 (random example)
or here: https://hetrixtools.com/ or http://webyzer.net/ip/181.224.138.136 (random example)
or here: https://www.abuseipdb.com/check/46.126.113.90 (random example)
or here: https://www.ip-tracker.org/lookup.php?ip=102.66.223.235 (random example)

Also at VT we could find a lot of information just giving in and query for a particular IP.
And where I also regularly report: https://ip-46.com/ IP v4 v6 Intelligence, (fine resources :wink: ),

Good hunt,

polonus (volunteer 3rd party cold recon website security analyst and website error-hunter)

949

Before visiting a Magento wenshop website, it is a good idea to scan it at magereport.com.

Maybe some webshops might have been splendidly deveoped at first, but weren’t updated in time:
random example: https://www.magereport.com/scan/?s=https://hoegl.com/ (outdated Magento version)

There are always threats around the corner: https://www.ncsc.gov.uk/news/guidance-for-retailers-to-prevent-websites-becoming-black-friday-cyber-traps

polonus

950

We all may have used these well-known free online website malware scanners at some moment in time:
Re: https://geekflare.com/online-scan-website-security-vulnerabilities

This is a not so well-known website privacy scanner: https://themarkup.org/blacklight?url=

For those on tor looking for “bad relays”: https://metrics.torproject.org/ also: https://intelx.io/ (blocked to be used inside tor)

Enjoy, my good friends, enjoy,

pol

951

To eventually detect traces of a Pegasus snoopware compromittal,
now MVT (Mobile Verification Toolkit) has been developed for android.
Re: http://github.com/mvt-project/mvt

polonus

952

Check your Word Press plug-ins for vulnerability and latest updates.

55,9% of Word Press CMS websites are being hacked through vulnerable plugins.

Hackers can run all sorts of malicious activities like stealing data, run unwanted ads, defacing websites etc.
Furthermore this may redirect visitors, leads to injected spam and content, installed malcreations (malware),
creation of roque admin accounts, all wreaking havoc on website revenues and your online reputation.

Also various bad may happen with bad configuration seen after install, that means
‘user enumeration’ not set as disabled, and also ‘directory listing’ not set as disabled.

There are over 50.000 Word Press plugins and new ones created every day,
and also some left by their developers (left vulnerable code).

Those attacked recently Duplicator, ThemeGrill Demo Importer, Profile Builder, various WooCommerce plugins, ThemeREX,
Async JS, Modern Events Calendar, Google Maps plug-in. (info source - malware dot com dot blog).

Do a quick and dirty at https://hackertarget.com and perform a free Word Press security scan there.
Do a passive scan: https://hackertarget.com/wordpress-security-scan/

Another low-impact scanner: http://wprecon.com/

polonus (volunteer 3rd party cold recon website security analyst and website error–hunter)

953

No desktop no add-ons
adds up to

https://d1ka0itfguscri.cloudfront.net/Lh/2021/12/11/13/41/crlXIpV2tC0/preview.jpg

954

Go on testing and analyzing with a robots.txt tester and validator:
https://www.websiteplanet.com/webtools/robots-txt/?url=forum.avast.com

No results for this one, because the forum is not indexable; only links to be followed.

But here 1 error and 8 warnings: https://www.websiteplanet.com/webtools/robots-txt/?url=wordpress.com

Good informative info for website developers,

pol

955

The following test page should give you an error inside the browser:
https://pinning-test.badssl.com/

This site is preloaded with a bad HPKP pin.
Checks your https-security is OK. No guv-snooping certs implemented?

Excellent test: https://www.ssllabs.com/ssltest/analyze.html?d=pinning-test.badssl.com

And for other online scanners: https://geekflare.com/ssl-test-certificate/

OK inside your browser? Re: https://www.howsmyssl.com/

pol

956

Many fine tools grouped here: https://dnschecker.org/website-server-software.php

polonus

957

CSP not implemented according to best policies:
Even on a site like:
https://transparencyreport.google.com/safe-browsing/search?url=forum.avast.com

Result CSP Protection Active CSP Reporting Full CSP Validity Valid

XSS Strong CSP Protection
Clickjacking No CSP Protection
Formjacking Weak CSP Protection

General
Weak CSP Protection
Summary
6 Fatal Errors
10 Warnings
6 Info
4 Valid
Content Security Policy (CSP)
Edit CSP
script-src
‘nonce-aPfse2kvXXXXXXBu8VkzKA’
‘report-sample’
‘unsafe-inline’;
object-src
‘none’;
base-uri
‘self’;
worker-src
‘self’;
report-uri
/cspreport;
General
CSP
report-uri
Add another ‘report-uri’ to get better violation reports.
form-action
This directive does not fallback to ‘default-src’. Can you restrict ‘form-action’ to ‘none’ or ‘self’?
Necessary Directives
CSP
default-src
‘default-src’ is missing. Add it for more fine-grained control and reporting.
CSP
base-uri
CSP
frame-ancestors
In order to add Clickjacking protection, either ‘frame-ancestors’, ‘frame-src’ or ‘child-src’ should be strictly defined.
‘frame-ancestors’ directive, is more powerful and flexible than the X-Frame-Options, and considered necessary in order to properly prevent Clickjacking attacks. Can you restrict ‘frame-ancestors’ to ‘none’ or ‘self’?
As strict as ‘frame-ancestors’, ‘frame-src’ and ‘child-src’ will be (‘self’, ‘none’ or strict path allowlist), Clickjacking protection will be strongest.
CSP
upgrade-insecure-requests
Add ‘upgrade-insecure-requests’ to protect from ManInMiddle attacks. Another (more strict) option is to use ‘block-all-mixed-content’ to block mixed content resources (rather than updgrade to secure).
Scripting Directives
CSP
script-src
CSP
style-src
‘style-src’ is missing and recommended to increase general protection. Can you set ‘none’ or a specific file/path?
CSP
object-src
CSP
worker-src
Frames Directives
CSP
child-src
In order to add Clickjacking protection, either ‘frame-ancestors’, ‘frame-src’ or ‘child-src’ should be strictly defined.
As strict as ‘frame-ancestors’, ‘frame-src’ and ‘child-src’ will be (‘self’, ‘none’ or strict path allowlist), Clickjacking protection will be strongest.
For backward compatability, both ‘child-src’ and ‘frame-src’ should exist in order to protect Clickjacking, Formjacking, Data Exfiltration and more.
CSP
frame-src
In order to add Clickjacking protection, either ‘frame-ancestors’, ‘frame-src’ or ‘child-src’ should be strictly defined.
As strict as ‘frame-ancestors’, ‘frame-src’ and ‘child-src’ will be (‘self’, ‘none’ or strict path allowlist), Clickjacking protection will be strongest.
For backward compatability, both ‘child-src’ and ‘frame-src’ should exist in order to protect Clickjacking, Formjacking, Data Exfiltration and more.
Content Directives
CSP
img-src
In order to add general protection, either ‘img-src’ or ‘connect-src’ should be strictly defined.
‘img-src’ is missing. Add it for more fine-grained control and reporting.
CSP
connect-src
In order to add general protection, either ‘img-src’ or ‘connect-src’ should be strictly defined.
‘connect-src’ is missing. Add it for more fine-grained control and reporting.
CSP
font-src
‘font-src’ is missing. Add it for more fine-grained control and reporting.
CSP
manifest-src
‘manifest-src’ is missing. Add it for more fine-grained control and reporting.
CSP
media-src
‘media-src’ is missing. Add it for more fine-grained control and reporting.
CSP
prefetch-src
‘prefetch-src’ is missing. Add it for more fine-grained control and reporting.


resulting in a B-Grade protection.

polonus

958

Website security analysis - Snyk: https://snyk.io/test/website-scanner/?test=
Best result = A, bad result = F.

pol

959

Hi folks on the avast support forums. From me best wishes for the coming New Year 2022.
May you stay free of any mishap both offline as well as online.

This time my question was: "“Who is behind CloudFlare?”.

Whenever you do an IP look-up at a CloudFlare protected website, like for instance shodan.io,
CloudFlare may block you as a visitor. This is whenever they cannot fully identify you.
You cannot go there anonymously. No tor-users are allowed on their platform either,
even when you aren’t into any mischief.
You are banned until you can give proof of who you really are as a human being (real IP).

In such cases it can be interesting to know who is behind a certain CloudFlare reversed proxy address.
You can look it up at: https://securitytrails.com/list/ip/104.18.12.238 (example for shodan.io) (random example by me, pol).

Mind to do your look-ups at securitytrails.com not from behind a proxy, else you also meet with their endless captcha,
even when you are not a bot and strictly a human anonymous. They also are CloudFlare driven.

It is a pity the extension to see whether one was safe from NSA spoofing on a particular website,
is now no longer available as a Google’s or cromium extension.
Their new extension and api restricting settings will make blocking etc. much harder.
Coming to a browser near you in the forecoming months, I think May 2022.

A couple of extension developers have already thrown the towel into the developer’s ring.
Well the going gets narrow, as some clamps seem to be coming down.

It is a pity really and actually a shame for the last bit of end-user-autonomy.
I use a London-based in-browser proxy by Digital Ocean in the browser
and have experienced above scenario various times.

polonus

960

Learn more device info via your browser of choice here:
https://www.deviceinfo.me/

Scan, scroll down and enjoy.

An ip-scan for malicious and suspicious IP and percentages on ranges:
https://maltiverse.com/ip/161.35.53.213 (random example)

polonus