HTML (HyperText Markup Language) is a language used to create web pages using tags inline with the content to indicate to browsers how to display that content, using the tags to interpret formatting, images, scripts and other content.

learn more… | top users | synonyms

2
votes
2answers
76 views

Is wget'ing a single HTML file basically free of risk?

There is a lot of potentially malicious stuff on the web. In fact, there are so many things that can happen that browsing to a location you know nothing about can be dangerous, like http://www.example....
1
vote
3answers
72 views

How to redact HTML so it does not end up in PDF

I'm trying to create a redacted, printer-friendly version of a web page. I'd like the user to have the option of converting this printer-friendly page to a PDF and emailing it to someone else. My ...
0
votes
1answer
39 views

CSRF token generation and validation

I am trying to implement XSS best practices on a site I’m making. I am currently generating a secure token on my server and sending it back to the user as a form hidden field, then validating that ...
0
votes
0answers
24 views

Path Relative Style Sheet Injection: Switching on the quirks mode

This Portswigger article talks about PRSSI where an attacker can exploit relative URLs and trick browser to import HTML pages as stylesheets. My questions: Quirks mode must be enabled to exploit ...
1
vote
0answers
31 views

url-encoded original URL in error page via og:url meta tag - Risk assessment?

I'm asked to advise on a scenario where meta tags in a 404 error page include the Open Graph og:url, which is (I'm told) being populated by React libraries. The full url as presented to the server ...
3
votes
1answer
56 views

PIN Entry via HTML rendered Keypad

I have a web application that replaces a non-web predecessor. A low level set of users accessed basic functionality with touch panels in the non-web previous version of the product with the touch ...
0
votes
2answers
56 views

Can we consider injection of HTML tags without event attributes as XSS?

I'm wondering if we can consider the injection of HTML tags like a, image, img, video, audio, marquee or iframe without an event attribute as XSS? Since no JavaScript is involved and therefor no ...
2
votes
2answers
77 views

Why shouldn't I put user input in HTML comments?

The OWASP XSS Prevention Cheat Sheet has a list of locations where untrusted data should never be put: <script>...NEVER PUT UNTRUSTED DATA HERE...</script> directly in a script <!...
5
votes
1answer
54 views

Why don't web templating frameworks HTML escape all data by default?

I recently discovered an XSS vulnerability in an application that uses JSP to render pages. The vulnerable code in the JSP was something like this: <td>${customer.notes}</td> It was ...
0
votes
1answer
57 views

XSS to overcome HTML entities

In a search box (<input value=" *insert search term here* "...>), when I input " onmouseover="alert(1), the double quotes are converted to their entities, so it's not possible to break out of ...
3
votes
1answer
151 views

Browser exploits based purely on HTML + CSS

In 2011, Eli Fox-Epstein demonstrated a Rule 110 machine in HTML + CSS3. This led some to say that the combination of HTML + CSS3 is Turing complete. Regardless of whether HTML + CSS3 is technically ...
-1
votes
1answer
77 views

Svg width element XSS

I'm working on a svg image generator. Now I want to set the user width and height value. Can a user exploit this element tags? And what should I do to make this secure? <?php $user_input = $...
4
votes
1answer
123 views

Risks of HTML/JavaScript window.opener security flaw?

I do not know if you are aware of this flaw, but here is a basic example: somepage.html (pointing to malicious.html): <!DOCTYPE html> <html> <head> <meta charset="utf-8"> ...
3
votes
2answers
69 views

Signing Double Submit Cookies, where the value is a pseudo random string and a signature of it. Is this more secure?

I'm not sure if I am describing something that has already been proposed. If not, I would like to coin this "Signed Double Submit Cookies" as a method to improve the Double Submit Cookies technique ...
8
votes
3answers
992 views

Is a HTML form tag more exploitable than a HTML link in user submitted content?

I have a content editor in a web application which allows administrators to add and edit content in certain areas of the application. The editor component I have used automatically removes any script ...
-1
votes
1answer
102 views

Do html request message have secret information? [closed]

Recently, I read a paper which describes an attack on http response protocol. The attack is called CRIME or CRIME Extensions. It exploits TLS compression algorithm by checking the total payload of ...
4
votes
1answer
39 views

table elements are not encrypted

I read a security book a while ago that said HTML table elements are sent plain text, even if the server connection is https. Is this accurate? I'm thinking about making an on-line purchase from a ...
57
votes
6answers
9k views

Anonymous surveys that aren't so anonymous

In the past I have completed an 'anonymous' survey at work only to find that my employer was able to garner a lot of not-anonymous information from this survey. Location, name of manager, etc. None ...
5
votes
4answers
79 views

Would an official <disablescripts> HTML (6?) element/wrapper combat XSS effectively?

Would it not be possible to use such a method to wrap areas where user input/output is expected (eg. comment boxes), so that even if a script is successfully injected through regex evasion, the script ...
0
votes
1answer
34 views

taking input from webform and piping into bash password prompt

I've been wanting to create a simple web application that would allow me to view certain text files that I've encryped with GnuPG residing on my webserver through any browser remotely. I've figured ...
1
vote
0answers
95 views

How to check if /run timeout /T 5 remote command execution worked in page html?

I was scanning a website using Zed Attack Proxy, when I found it is vulnerable to remote command execution, specifically timeout with the Referer header (shown in the request below). I have no idea ...
9
votes
2answers
151 views

Best practices when forwarding an email or copy / pasting from confidential information sources?

I get asked this a lot from older people, or for legal matters. They want to forward an email message they've received to another party, while removing any identifying information from the first party ...
2
votes
2answers
83 views

How do I prevent extra javascript from being added into HTML kiosk in public space?

I'm planning a project which is to be PCI compliant, but I am stuck on a particular vulnerability and I can't think of a way to protect against it. The scenario is that there is a kiosk installed in ...
2
votes
1answer
878 views

HTML iframe security exploit

Can somebody explain if there's something malicious in this HTML, The width and height of the iframe ares set to 1 and it's out of the view with top: -100px; statement. I believe it takes some some ...
0
votes
0answers
20 views

Sites to test login through jmeter [duplicate]

Im having a hard time looking for a site with a login system that can be probed with firebug, the POST request password specifically, i was just wondering if anyone here knows one or two sites that ...
3
votes
1answer
46 views

XSS Injection invalidate meta redirection tag

When injecting into the url part of an HTML META redirect like this: <meta http-equiv='refresh' content='0;URL=$URL' where $URL (note the missing quotes) is the part I can inject, is there any ...
1
vote
0answers
112 views

What vulnerability is this malicious document attempting to exploit

CLARIFICATION: I changed the title as people were interpreting this as a request to help understand the code. I explain what the code is doing below (critiques on this analysis are welcome.) I am ...
2
votes
2answers
2k views

If using htmlentities or htmlspecialchars functions is enough for block XSS attack

I know this question was discussed on net various times. and people give some example how to bypass these functions through passing some code. But here one issue, All example of htmlentities/...
2
votes
4answers
2k views

HTML password fields

Imagine you are in a HTML page which offers you the password change service. Some websites bring the previous password in a password field, which you can't read. Is it possible to retrieve the ...
2
votes
1answer
94 views

How to make the most secure text editor in Django?

As a follow up to this question, I'm wondering what is the most secure way (using either markup or markdown) to allow users to format their inputs and upload images in a Django app? I'm not asking ...
1
vote
3answers
185 views

Can these html tags and attribs make my site vulnerable?

I am developing a social website and want to allow user ONLY these html tags and attributes in their posts: tags: <img>, <b>, <strong>, <blockquote>, <a> attributes: '...
5
votes
3answers
123 views

Input validation: how to do it if I must accept HTML as part of my input?

I'm writing a service which receives FHIR data and it stores it. FHIR is an HL7 healthcare information standard format which contains HTML by definition, embedded into a JSON or XML, (to ensure human-...
2
votes
1answer
417 views

302 redirect and the body on the page (you are redirected to …)

I have page which take URL on query and string and it. Then, you get redirected using 302 to another page, and the response of the page contains HTML code and the redirect header. Like this: <html&...
1
vote
1answer
127 views

Is it possible to get a flash src after a redirect or an element inside an embed/object/iframe tag (cross-domain)?

The URL example.com/auth will automatically redirect the user (HTTP 302) to example.com/signed_in.SWF?token=SENSITIVE. Is it possible for an attacker to steal the token, using javascript or flash, in ...
1
vote
3answers
56 views

What is a typical defense mechanism/setup against flooding back-end sql calls?

I'm interested in figuring out what is a typical scenario of preventing the following attack scenario: Back-end has as SQL server. Front end a simple "Hello World" HTML that passes an input (say user ...
10
votes
2answers
3k views

How to launch XSS code from an INPUT HTML tag upon page load?

Say I have the a website with the following code on it: <input type="text" id="search-text" name="query" value="?" /> Double quotes aren't escaped so I can break out of the value attribute, ...
0
votes
3answers
193 views

The purpose of escaping html entities

By security principles, we are often taught to sanitize input fields for characters such as & or ' so that they cannot be used for SQL injections etc. However, now I have an issue: I really need ...
2
votes
2answers
107 views

Can 3rd party JavaScript libraries access the http headers of the hosting html page

So, I have website, it uses a cookie stored in the http header of the downloaded html document to maintain the session while the end user is logged on and accessing there 'secure' data. This webpage ...
40
votes
4answers
6k views

Have computer criminals been known to exploit easily-edited websites like Wikipedia to embed malicious scripts?

When I was reading a page on Wikipedia several months ago (December 2014) I saw what looked like a pop-up window from BT, but I soon realized that when I closed the page the pop-up disappeared. I then ...
2
votes
1answer
445 views

XSS in Content-Disposition

Lets assume i have found a xss on site example.com, now to trigger an XSS, i use the following URL: https://example.com/a.php?v=%22%3E%3Cimg%20src=x Which results in following response: HTTP/1.1 ...
0
votes
3answers
126 views

Random characters and letters form obsfuscation

I know that this question has been asked many times, but would JavaScript encryption work if I just added 100 random numbers and letters to the password? That would be hard to reverse engineer, ...
-4
votes
2answers
77 views

How to ensure website from hackers and more? [closed]

I'm really new to security in Websites, for example... So can someone give me somewhere to start please? Sorry if it's not the right place to ask... :|
2
votes
1answer
104 views

What does this attack string do? How do I mitigate it?

Today I decided to run the apache-scalp script and it found a few issues. One was ranked as Impact 5, and I'd like to know if someone could explain what this does, and how to disable it? The request ...
3
votes
3answers
1k views

Why did I see an insecure browser warning on my page?

Originally I was under the impression that a particular page on a site I visited was showing an insecure content warning in my browsers due to the tags on the page having plan http href attributes. ...
3
votes
3answers
296 views

Any Security Risks for using mailto:?

I use a PHP script which performs a database search and when no result are found, user is presented with a mailto link with this format mailto:example@test.com?subject=SEARCHED_QUERY_HERE The ...
3
votes
1answer
406 views

Exploiting mailto links

Supposing that the user has the power to include any content after mailto: snippet, are there any possible security vulnerabilities? Example: The user says their email address is foo. The link on ...
6
votes
1answer
323 views

How do I securely embed an <img> tag using a user-given URL?

If I hypothetically wanted to allow users to use an avatar from an arbitrary URL like this: <img class="avatar" src="{user input}" /> There are many problems that I can think of: There are ...
7
votes
1answer
369 views

Safe to render data directly to DOM from localStorage? XSS attack possible?

I read that localstorage is susceptible to XSS attacks. I currently store JSON Web Token (JWT) in localstorage, and I access and display data about the user through localstorage: var localstore = //...
-3
votes
2answers
576 views

How to prevent user from removing disabled attribute and manually editing role?

So I am supposing the user has general knowledge of HTML. I have this code: <select name="role" id="role" disabled> <option value="Admin">Admin</option> <option value="...
3
votes
2answers
984 views

Set the max length for input

Suppose I have a form, and one of this form inputs I set the max length to 15: <input type="text" name="username" maxlength="15"> Now the attacker wants to override this limit, to do that he ...