Tagged Questions
3
votes
4answers
283 views
how can you inject malicious code into an innocent-looking URL?
I am learning about XSS attacks. Wikipedia says that in a non-persistent attack an attacker may provide an innocent-looking URL that "points to a trusted site but actually has an XSS vector." What ...
10
votes
1answer
367 views
How can I embed iframe securely without restricting its functionality?
I'd want to embed an iframe from untrusted site into web application. Iframe:
should be able to run Javascript and browser plugins (Flash, etc.)
should not be able to access my web application ...
4
votes
2answers
253 views
Workarounds for :visited CSS History reconnaissance
Several years ago it was possible to use
a:visited {
background: url('/log.php');
}
to figure out on what website user has been previously. But now it is restricted by browsers. Is there any ...
2
votes
4answers
303 views
Clickjacking: can't browsers just forbid/reject placing transparent elements over frames?
Why not? Seems like this is only used for clickjacking, the solution should be simple enough.
