HTML (HyperText Markup Language) is a language used to created web pages.

learn more… | top users | synonyms

2
votes
1answer
121 views

Exploiting mailto links

Supposing that the user has the power to include any content after mailto: snippet, are there any possible security vulnerabilities? Example: The user says their email address is foo. The link on ...
5
votes
1answer
107 views

How do I securely embed an <img> tag using a user-given URL?

If I hypothetically wanted to allow users to use an avatar from an arbitrary URL like this: <img class="avatar" src="{user input}" /> There are many problems that I can think about: There ...
1
vote
1answer
35 views

Safe to render data directly to DOM from localStorage? XSS attack possible?

I read that localstorage is susceptible to XSS attacks. I currently store JSON Web Token (JWT) in localstorage, and I access and display data about the user through localstorage: var localstore = ...
-3
votes
2answers
67 views

How to prevent user from removing disabled attribute and manually editing role?

So I am supposing the user has general knowledge of HTML. I have this code: <select name="role" id="role" disabled> <option value="Admin">Admin</option> <option ...
3
votes
2answers
374 views

Set the max length for input

Suppose I have a form, and one of this form inputs I set the max length to 15: <input type="text" name="username" maxlength="15"> Now the attacker wants to override this limit, to do that he ...
2
votes
1answer
80 views

What are some useful tags and payloads for HTML injection on CSP-protected sites?

I'm pen-testing a website that fixed most of its XSS vulnerabilities by just adding a Content Security Policy. There are still HTML injections in several places. I've tried to get a ...
21
votes
2answers
1k views

Does this CSS code expose if a message is read, and how long they have been reading it?

This email analytics company offers an 'engagement metric' that shows how much time someone spends looking at an email, whether the email is printed or deleted. They also claim it works in pretty ...
3
votes
1answer
144 views

How can I successfully perform an xss attack on a dummy website? [closed]

in my security course, we were told to practice an xss attack using firefox on this website; http://permalink.co/ No worries, this is a website specifically setup for us to practice ...
3
votes
1answer
73 views

What methods can be used to prevent the browser (IE11 specifically) from storing credentials / autocomplete

Going through Pen Test and it was asked of us to disable auto complete in our CC payment fields. We tried adding autocomplete=off and also tried false on the input filed. A ny suggestions to ...
9
votes
2answers
2k views

How do the Stack Exchange sites protect themselves from XSS? [duplicate]

It seems to me that because Users can post questions and comments in them with HTML markup (possibly <script> tags), Stack Exchange sites would be very exposed to XSS attacks. How do they ...
2
votes
1answer
55 views

Sanitise specific HTML attribute values against XSS

We want to implement a "safe mode" in a Markdown parser called Parsedown. We have a MarkupEscaped option that disables HTML input, but this is not enough. In order to be safe, the parser needs to ...
5
votes
1answer
148 views

Why is a child window allowed to change the location of its parent?

Maybe a silly question. When opening a new tab via target="_blank", the page that loads in that tab is allowed to set a new location in the parent tab using: ...
1
vote
2answers
228 views

CAPTCHAs: How does simple math in cleartext prove you're human?

I'm intrigued that many sites use seemingly random numbers with a random operator as a security check to validate that you're not a bot. Forgive my ignorance in captcha technology, but what is ...
-1
votes
1answer
145 views

php execution possibility in img src

I am creating a simple application. There is an option to download a generated image. For that, my PHP code is: <?php if (isset($_GET['img_name'])){ ?> <html> <img src="<?php echo ...
2
votes
2answers
141 views

is it sufficient to convert '(single-quote) to ` &#039; `

Is it sufficient to convert ' to &#039; , > converted to &gt; and < converted to &lt; to avoid xss A bit of context: the payload would be going through the URL and landing in a ...
2
votes
5answers
1k views

Is converting `<` to `&lt;` sufficient to prevent execution of JavaScript from arbitrary HTML?

This is kind of a bar-bet question. An acquaintance of mine has made the claim that, given an arbitrary glob of HTML, it can be completely prevented from executing JavaScript if, before slapping it ...
1
vote
1answer
161 views

Arbitrary code execution by opening a webpage by IE?

I came across this piece of HTML code today: <!doctype html> <html> <meta http-equiv="X-UA-Compatible" content="IE=EmulateIE8" > <head> </head> <body> <SCRIPT ...
-4
votes
2answers
264 views

What is the best exploit of XSS within 100 characters? [closed]

I found a vulnerable php script on my website. The script allows an user input (textarea), which is not encoded by htmlspecialchars(). Therefore it is possible to add html and javascript code. The ...
5
votes
2answers
771 views

Should every output element be filtered, or just those which contain user-editable data? [duplicate]

I'm combing through a legacy app updating SQL to prevent Injections and XSS vulnerabilities. I know to apply PHP's htmlspecialchars() anything that is directly passed to a script and displayed on a ...
2
votes
1answer
172 views

Is preventing XSS/HTML Injection really this simple?

A colleague suggested to me just to prevent letter characters from occurring immediately after an opening angle bracket as a way to protect against XSS and HTML injection. Obviously, this doesn't ...
1
vote
3answers
134 views

Make all form inputs safe but allow any type of input including code

Pastebin allow you to (along with plenty of other sites) input code into there forms. I know that this can be a huge security threat if not done properly so I would like to know how they go about ...
-1
votes
2answers
128 views

How to get the information from the iframe displayed (ClickJack) to the user back to the attacker?

Just for knowledge I want to know how to get the information from the i-frame displayed to the user back to the attacker? Scenario : Suppose You are an attacker and you want to grab the private ...
-3
votes
1answer
90 views

Feedback Form Exploitation possible or not? [closed]

how an attacker can exploit the below provided feedback form in a company website containing the company’s domain? the feedback form does not store data into a database. The server side code only ...
2
votes
1answer
110 views

XSS: alert() not executed on different OS/computer

I've encountered a strange behavior while I was performing a security audit of a web application. Some user controlled inputs were displaying their values, unencoded, into the page that processed the ...
2
votes
1answer
355 views

encodeURIComponent in a unquoted HTML attribute

My gut feeling is that the following should be attackable: $("<td><a href=somefile.php?url="+encodeURIComponent(somevar)+">Download Here</a></td>"); In contrast to ...
56
votes
1answer
3k views

“Allow __ to be fullscreen?”

I have been asking myself for a while what's the purpose of that popup showing up in pretty much all the modern browsers upon entering the full-screen mode of a video or website. It appears to be a ...
4
votes
4answers
1k views

Is this an attack and how can I fix it?

I don't know where to start in searching the forum for existing threads that might cover my issues. I recently received a spoof email pretending to be from a client for whom I've just started to do ...
2
votes
3answers
1k views

How can I bypass double quotes in a attribute based xss attack

The code that I have is: <input type="text" name="some_name" value="<?php echo CHtml::encode($str); ?>" /> $str is the input data. 'CHtml::encode()' is Yii's way of encoding special ...
1
vote
2answers
106 views

Can a static (HTML only) site be vulnerable to XXE?

First of all sorry if I am asking a trivial question. As far as I know, XML is used for representing document structures. Can entirely static sites accepting no user inputs at all be vulnerable to ...
1
vote
1answer
141 views

Is it safe to call an untrusted service with jquery.ajax and dataType 'jsonp'

From what I understand, the JSON-P technique generates a script tag into the DOM of an HTML page to get across the single-origin restrictions imposed on the XMLHttpRequest JavaScript API for AJAX ...
0
votes
0answers
159 views

Exploit circulating Facebook with a .pnh file embedded in a <img> tag

Not sure how long this link will be up, but this is the page where users get redirected after trying to read a fake news post in someone timeline. [WARNING: ACCESS IN A CONTROLLED ENVIRONMENT] ...
2
votes
4answers
787 views

HTML Entities to hide Email Addresses

I'm on WordPress trying to keep spambots from grabbing email addresses that may be in The Content. WordPress has a nifty little function simply called antispambot() which will convert the email ...
1
vote
1answer
161 views

Are HTML Entities inherently unsafe?

When submitting HTML that contains entities to the OWASP HTMLSanitzer, entities are converted. For example: BEFORE: <p>blah blah blah &diams;</p> The resulting HTML ends up ...
8
votes
3answers
2k views

Allowing users to input a safe subset of HTML

I recently posted this question on Code Review and it was recommended that I ask you guys about it. Basically, this will be used to allow users to generate formatted content. It gets put inside of ...
3
votes
3answers
2k views

Why are scripts injected through innerHTML not executed whilst onerror and other on<event> attributes on elements are? - Google XSS Challenge 2

SPOILER ALERT : Do not continue if you do not want to be spoiled I am currently doing the Google XSS Challenge Level 2 . I am injecting XSS code that is inserted into the document using ...
1
vote
1answer
257 views

How to prevent XSS when transferring web page content within XML

I have an ASP.NET web application which uses HTTPS and XML based request-response. It seems a user's session cookie can be retrieved via XSS, if the request/response is intercepted and malicious ...
3
votes
3answers
1k views

Content-Security-Policy hash of script

<?php header("Content-Security-Policy: default-src 'sha256-".base64_encode(hash('sha256', 'console.log("Hello world");', true))."'"); ?> <script>console.log("Hello world");</script> ...
0
votes
1answer
198 views

Why is it a bad idea to escape HTML before escaping SQL? [duplicate]

From the security perspective (and not usability as it's discussed here http://stackoverflow.com/questions/3648430/is-it-a-bad-idea-to-escape-html-before-inserting-into-a-database-instead-of-upon), ...
1
vote
1answer
1k views

Is it safe to use localstorage to store session variables and user password? [closed]

I'm trying to make a web application in Java with a login/session system using com.sun.net.httpserver and as far I know, it does not have an inbuilt method to this. So, I had the following idea: 1 - ...
2
votes
2answers
730 views

Hacked HTML page - what's in the comment following the obfuscated code?

Chrome just warned me about malicious content when visiting a site - so I visited it. The source code is like the following: <html> <head> <link href="images/DPT2.ico" title="Dynamic ...
0
votes
1answer
311 views

Is it html escape enough for mitigating all xss, if html is going to be generated only in client side?

If all html in a site is generated in client side (attributes, urls, styles everything will be concatenated in javascript and set as innerHTML), is it doing only html escape enough for mitigating all ...
1
vote
2answers
2k views

Is jQuery.val() enough to prevent XSS

Is obtaining the value of a textarea/input with the jQuery function .val() XSS-proof? <html> <textarea id="t1"></textarea> <script> var toBeDisplayed = ...
1
vote
1answer
112 views

HTTP security headers on non HTML (images, JavaScript, etc)

Let's say, the HTTP security headers below are applied to all HTML pages of a site: HTTP Strict Transport Security (HSTS) X-Frame-Options (XFO) X-XSS-Protection X-Content-Type-Options Is it OK to ...
2
votes
3answers
350 views

OWASP escaping recommendation - why /?

In OWASP recommendations regarding escaping untrusted input for HTML element content, they list the following: & --> &amp; < --> &lt; > --> &gt; " --> &quot; ' ...
49
votes
4answers
19k views

Should websites be allowed to disable autocomplete on forms or fields?

Currently, there is an HTML form/input attribute called autocomplete, which, when set to off, disables autocomplete/autofill for that form or element. Some banks seem to use this to prevent password ...
5
votes
2answers
666 views

Escaping rich text editor output

When having a rich text editor on a web application, what is the best way to escape HTML entities and prevent XSS attacks but keep the formatting (<b>, <i>, <u>, ...etc.) ?
3
votes
1answer
223 views

Danger of hidden html form uploading users local files without their knowledge

Is there a danger that a webpage could have a hidden form with a file upload input and js script that would try and take a random guesses at files on a users system and attach them to the form and ...
10
votes
1answer
295 views

Should Content in <noscript> Blocks Be Escaped

The title pretty much says it all. It seems counter-intuitive to escape inside a <noscript> block because any js that an attacker is able to inject there shouldn't be executed. But, I'm still ...
2
votes
1answer
123 views

Chrome inline JavaScript string interpreatation

If you have an HTML file that contains the following code : <!doctype html> <html lang="en"> <head> <meta charset="UTF-8"> </head> ...
5
votes
2answers
227 views

Any eventhandlers that apply to hidden elements?

Im trying to XSS a search field and my attack vector is getting reflected like this: <input type="text" id="txtRpHiddenKeyword" style="display: none;" value="ATTACK VECTOR HERE" /> Only ...