HTML (HyperText Markup Language) is a language used to created web pages.

learn more… | top users | synonyms

2
votes
4answers
93 views

Is converting `<` to `&lt;` sufficient to prevent execution of JavaScript from arbitrary HTML?

This is kind of a bar-bet question. An acquaintance of mine has made the claim that, given an arbitrary glob of HTML, it can be completely prevented from executing JavaScript if, before slapping it ...
1
vote
1answer
78 views

Arbitrary code execution by opening a webpage by IE?

I came across this piece of HTML code today: <!doctype html> <html> <meta http-equiv="X-UA-Compatible" content="IE=EmulateIE8" > <head> </head> <body> <SCRIPT ...
-4
votes
2answers
49 views

What is the best exploit of XSS within 100 characters? [closed]

I found a vulnerable php script on my website. The script allows an user input (textarea), which is not encoded by htmlspecialchars(). Therefore it is possible to add html and javascript code. The ...
5
votes
2answers
750 views

Should every output element be filtered, or just those which contain user-editable data? [duplicate]

I'm combing through a legacy app updating SQL to prevent Injections and XSS vulnerabilities. I know to apply PHP's htmlspecialchars() anything that is directly passed to a script and displayed on a ...
-1
votes
0answers
72 views

Is this XSS filter i.e <[space][0-9a-z]/> can be bypassed?

I was testing a web application that had an stored XSS vulnerability. After reporting the project team, they came up with a filter <[space][a-z1-9]/> (for example will be converted into < img ...
2
votes
1answer
144 views

Is preventing XSS/HTML Injection really this simple?

A colleague suggested to me just to prevent letter characters from occurring immediately after an opening angle bracket as a way to protect against XSS and HTML injection. Obviously, this doesn't ...
1
vote
3answers
73 views

Make all form inputs safe but allow any type of input including code

Pastebin allow you to (along with plenty of other sites) input code into there forms. I know that this can be a huge security threat if not done properly so I would like to know how they go about ...
0
votes
1answer
83 views

How to get the information from the iframe displayed (ClickJack) to the user back to the attacker?

Just for knowledge I want to know how to get the information from the i-frame displayed to the user back to the attacker? Scenario : Suppose You are an attacker and you want to grab the private ...
-3
votes
1answer
80 views

Feedback Form Exploitation possible or not? [closed]

how an attacker can exploit the below provided feedback form in a company website containing the company’s domain? the feedback form does not store data into a database. The server side code only ...
2
votes
1answer
86 views

XSS: alert() not executed on different OS/computer

I've encountered a strange behavior while I was performing a security audit of a web application. Some user controlled inputs were displaying their values, unencoded, into the page that processed the ...
2
votes
1answer
70 views

encodeURIComponent in a unquoted HTML attribute

My gut feeling is that the following should be attackable: $("<td><a href=somefile.php?url="+encodeURIComponent(somevar)+">Download Here</a></td>"); In contrast to ...
54
votes
1answer
3k views

“Allow __ to be fullscreen?”

I have been asking myself for a while what's the purpose of that popup showing up in pretty much all the modern browsers upon entering the full-screen mode of a video or website. It appears to be a ...
4
votes
4answers
1k views

Is this an attack and how can I fix it?

I don't know where to start in searching the forum for existing threads that might cover my issues. I recently received a spoof email pretending to be from a client for whom I've just started to do ...
1
vote
3answers
315 views

How can I bypass double quotes in a attribute based xss attack

The code that I have is: <input type="text" name="some_name" value="<?php echo CHtml::encode($str); ?>" /> $str is the input data. 'CHtml::encode()' is Yii's way of encoding special ...
0
votes
2answers
74 views

Can a static (HTML only) site be vulnerable to XXE?

First of all sorry if I am asking a trivial question. As far as I know, XML is used for representing document structures. Can entirely static sites accepting no user inputs at all be vulnerable to ...
1
vote
1answer
85 views

Is it safe to call an untrusted service with jquery.ajax and dataType 'jsonp'

From what I understand, the JSON-P technique generates a script tag into the DOM of an HTML page to get across the single-origin restrictions imposed on the XMLHttpRequest JavaScript API for AJAX ...
0
votes
0answers
132 views

Exploit circulating Facebook with a .pnh file embedded in a <img> tag

Not sure how long this link will be up, but this is the page where users get redirected after trying to read a fake news post in someone timeline. [WARNING: ACCESS IN A CONTROLLED ENVIRONMENT] ...
2
votes
4answers
370 views

HTML Entities to hide Email Addresses

I'm on WordPress trying to keep spambots from grabbing email addresses that may be in The Content. WordPress has a nifty little function simply called antispambot() which will convert the email ...
1
vote
1answer
126 views

Are HTML Entities inherently unsafe?

When submitting HTML that contains entities to the OWASP HTMLSanitzer, entities are converted. For example: BEFORE: <p>blah blah blah &diams;</p> The resulting HTML ends up ...
8
votes
3answers
1k views

Allowing users to input a safe subset of HTML

I recently posted this question on Code Review and it was recommended that I ask you guys about it. Basically, this will be used to allow users to generate formatted content. It gets put inside of ...
2
votes
3answers
636 views

Why are scripts injected through innerHTML not executed whilst onerror and other on<event> attributes on elements are? - Google XSS Challenge 2

SPOILER ALERT : Do not continue if you do not want to be spoiled I am currently doing the Google XSS Challenge Level 2 . I am injecting XSS code that is inserted into the document using ...
1
vote
1answer
149 views

How to prevent XSS when transferring web page content within XML

I have an ASP.NET web application which uses HTTPS and XML based request-response. It seems a user's session cookie can be retrieved via XSS, if the request/response is intercepted and malicious ...
2
votes
2answers
525 views

Content-Security-Policy hash of script

<?php header("Content-Security-Policy: default-src 'sha256-".base64_encode(hash('sha256', 'console.log("Hello world");', true))."'"); ?> <script>console.log("Hello world");</script> ...
0
votes
1answer
148 views

Why is it a bad idea to escape HTML before escaping SQL? [duplicate]

From the security perspective (and not usability as it's discussed here http://stackoverflow.com/questions/3648430/is-it-a-bad-idea-to-escape-html-before-inserting-into-a-database-instead-of-upon), ...
1
vote
1answer
949 views

Is it safe to use localstorage to store session variables and user password? [closed]

I'm trying to make a web application in Java with a login/session system using com.sun.net.httpserver and as far I know, it does not have an inbuilt method to this. So, I had the following idea: 1 - ...
2
votes
2answers
396 views

Hacked HTML page - what's in the comment following the obfuscated code?

Chrome just warned me about malicious content when visiting a site - so I visited it. The source code is like the following: <html> <head> <link href="images/DPT2.ico" title="Dynamic ...
0
votes
1answer
172 views

Is it html escape enough for mitigating all xss, if html is going to be generated only in client side?

If all html in a site is generated in client side (attributes, urls, styles everything will be concatenated in javascript and set as innerHTML), is it doing only html escape enough for mitigating all ...
1
vote
2answers
1k views

Is jQuery.val() enough to prevent XSS

Is obtaining the value of a textarea/input with the jQuery function .val() XSS-proof? <html> <textarea id="t1"></textarea> <script> var toBeDisplayed = ...
1
vote
1answer
101 views

HTTP security headers on non HTML (images, JavaScript, etc)

Let's say, the HTTP security headers below are applied to all HTML pages of a site: HTTP Strict Transport Security (HSTS) X-Frame-Options (XFO) X-XSS-Protection X-Content-Type-Options Is it OK to ...
2
votes
3answers
244 views

OWASP escaping recommendation - why /?

In OWASP recommendations regarding escaping untrusted input for HTML element content, they list the following: & --> &amp; < --> &lt; > --> &gt; " --> &quot; ' ...
40
votes
4answers
9k views

Should websites be allowed to disable autocomplete on forms or fields?

Currently, there is an HTML form/input attribute called autocomplete, which, when set to off, disables autocomplete/autofill for that form or element. Some banks seem to use this to prevent password ...
5
votes
3answers
430 views

Escaping rich text editor output

When having a rich text editor on a web application, what is the best way to escape HTML entities and prevent XSS attacks but keep the formatting (<b>, <i>, <u>, ...etc.) ?
3
votes
1answer
178 views

Danger of hidden html form uploading users local files without their knowledge

Is there a danger that a webpage could have a hidden form with a file upload input and js script that would try and take a random guesses at files on a users system and attach them to the form and ...
10
votes
1answer
260 views

Should Content in <noscript> Blocks Be Escaped

The title pretty much says it all. It seems counter-intuitive to escape inside a <noscript> block because any js that an attacker is able to inject there shouldn't be executed. But, I'm still ...
2
votes
1answer
100 views

Chrome inline JavaScript string interpreatation

If you have an HTML file that contains the following code : <!doctype html> <html lang="en"> <head> <meta charset="UTF-8"> </head> ...
5
votes
2answers
151 views

Any eventhandlers that apply to hidden elements?

Im trying to XSS a search field and my attack vector is getting reflected like this: <input type="text" id="txtRpHiddenKeyword" style="display: none;" value="ATTACK VECTOR HERE" /> Only ...
3
votes
1answer
678 views

OWASP Recommendation on Client-Side Password Hashing

The OWASP Application Security FAQ recommends the use of JavaScript to produce a salted hash of the password client-side with JavaScript prior to sending it to the server. Is this something truly ...
4
votes
3answers
3k views

Is it possible for a hacker to bypass upload php file?

I wanna give a filtering system in my script. here it is : <?php $allowedExts = array("gif", "jpeg", "jpg", "png","bmp"); $temp = explode(".", $_FILES["file"]["name"]); $extension = end($temp); ...
1
vote
2answers
124 views

How to “normalize” an html file?

Given an HTML file, the content of which was generated from various websites, it could have potential security problems, like: <script>alert("XSS alert!")</script> Q: What can we do to ...
4
votes
2answers
116 views

To What Extent does an Attacker Have Access to the Browser History through the CSS Pseudoclass :visited Styles?

I have read this article on how a scripted web page is able to obtain the visited history of a user browsing the page. However, I can't find any clear information in the article describing the extent ...
2
votes
1answer
144 views

Sandboxing user input html

I want to render user uploaded HTML (consisting of possibly many files with images, custom css, custom js, all uploaded in a zip file) for preview purpose. The user that submits the html will be the ...
2
votes
3answers
2k views

Javascript containing a long hexadecimal string and eval: is this suspicious?

At the bottom of the index.php file for a simple “contact us” form, I found the following (some whitespace and newlines added): try {if(window.document)--document.getElementById('12')} catch(qq) ...
3
votes
1answer
394 views

How can I check the iframe on my website is secure or not?

My website has an iframe used for loading my client's websites (only 5).How can I make sure the iframe is secure? Also by editing iframe src It allows to load any other websites.How can I prevent it?
3
votes
2answers
311 views

Injecting information in a web page (Gmail). Does it raise security problem?

I am developing a Google Chrome extension which encrypts/decrypts emails for Gmail users. So, I detect encrypted emails when the user opens an email on using tags. Once an encrypted email has been ...
1
vote
1answer
74 views

Couldn't websites that want to track our activity just store the data in the DOM?

For example as the value of an attribute of a html tag. <div cookie='id=1234'></div> Then if the user deletes the cookies while at least one page of the website is open, a javascript ...
7
votes
6answers
659 views

Cleartext password in HTML

Is there any problem with outputing a user's password to the HTML in an hidden field (see use case below before flaming xD)? The use case is a registration form with two steps. The user fills in the ...
4
votes
3answers
987 views

Sharing Nmap scan results in a web page

Is there a tool that allow the sharing of nmap scan results ? I know nmap can produce XML and I can easily convert them in HTML. I would like to know if there is a tool with more features. For ...
3
votes
4answers
3k views

how can you inject malicious code into an innocent-looking URL?

I am learning about XSS attacks. Wikipedia says that in a non-persistent attack an attacker may provide an innocent-looking URL that "points to a trusted site but actually has an XSS vector." What ...
7
votes
3answers
2k views

Is there a way to bypass Django's XSS escaping with “unicode”?

Django (the Python web framework) escapes output to prevent XSS (Cross Site Scripting) attacks. It replaces ', ", <, >, & with their HTML safe versions. However this presentation on slide ...
7
votes
1answer
1k views

What possible use does an iFrame have for security?

I'm looking at code for an old login form I'm redesigning. It's a simple table with two input fields for username and password. But just before the end </table> tag there's a blank iFrame which ...