HTML (HyperText Markup Language) is a language used to create web pages using tags inline with the content to indicate to browsers how to display that content, using the tags to interpret formatting, images, scripts and other content.

learn more… | top users | synonyms

0
votes
0answers
7 views

Risk assessment? og:url meta tag, with url encoded original URL, in error page

I'm asked to advise on a scenario where meta tags in a 404 error page include the Open Graph og:url, which is (I'm told) being populated by React libraries. The full url as presented to the server ...
2
votes
2answers
925 views

Breaking out of attribute in double quotes

I have a piece of code that allows for [url]someurl[/url] BB-Code and replaces it with <a href="someurl">someurl</a> It takes two precautions to prevent XSS. It replaces <, &...
0
votes
3answers
126 views

Random characters and letters form obsfuscation

I know that this question has been asked many times, but would JavaScript encryption work if I just added 100 random numbers and letters to the password? That would be hard to reverse engineer, ...
3
votes
1answer
48 views

PIN Entry via HTML rendered Keypad

I have a web application that replaces a non-web predecessor. A low level set of users accessed basic functionality with touch panels in the non-web previous version of the product with the touch ...
4
votes
1answer
98 views

Risks of HTML/JavaScript window.opener security flaw?

I do not know if you are aware of this flaw, but here is a basic example: somepage.html (pointing to malicious.html): <!DOCTYPE html> <html> <head> <meta charset="utf-8"> ...
0
votes
2answers
50 views

Can we consider injection of HTML tags without event attributes as XSS?

I'm wondering if we can consider the injection of HTML tags like a, image, img, video, audio, marquee or iframe without an event attribute as XSS? Since no JavaScript is involved and therefor no ...
2
votes
2answers
65 views

Why shouldn't I put user input in HTML comments?

The OWASP XSS Prevention Cheat Sheet has a list of locations where untrusted data should never be put: <script>...NEVER PUT UNTRUSTED DATA HERE...</script> directly in a script <!...
5
votes
1answer
53 views

Why don't web templating frameworks HTML escape all data by default?

I recently discovered an XSS vulnerability in an application that uses JSP to render pages. The vulnerable code in the JSP was something like this: <td>${customer.notes}</td> It was ...
12
votes
1answer
984 views

How can I embed iframe securely without restricting its functionality?

I'd want to embed an iframe from untrusted site into web application. Iframe: should be able to run Javascript and browser plugins (Flash, etc.) should not be able to access my web application ...
7
votes
1answer
363 views

Safe to render data directly to DOM from localStorage? XSS attack possible?

I read that localstorage is susceptible to XSS attacks. I currently store JSON Web Token (JWT) in localstorage, and I access and display data about the user through localstorage: var localstore = //...
0
votes
1answer
52 views

XSS to overcome HTML entities

In a search box (<input value=" *insert search term here* "...>), when I input " onmouseover="alert(1), the double quotes are converted to their entities, so it's not possible to break out of ...
3
votes
1answer
135 views

Browser exploits based purely on HTML + CSS

In 2011, Eli Fox-Epstein demonstrated a Rule 110 machine in HTML + CSS3. This led some to say that the combination of HTML + CSS3 is Turing complete. Regardless of whether HTML + CSS3 is technically ...
-1
votes
1answer
59 views

Svg width element XSS

I'm working on a svg image generator. Now I want to set the user width and height value. Can a user exploit this element tags? And what should I do to make this secure? <?php $user_input = $...
3
votes
2answers
251 views

Is preventing XSS/HTML Injection really this simple?

A colleague suggested to me just to prevent letter characters from occurring immediately after an opening angle bracket as a way to protect against XSS and HTML injection. Obviously, this doesn't ...
-1
votes
1answer
101 views

Do html request message have secret information? [closed]

Recently, I read a paper which describes an attack on http response protocol. The attack is called CRIME or CRIME Extensions. It exploits TLS compression algorithm by checking the total payload of ...
3
votes
2answers
66 views

Signing Double Submit Cookies, where the value is a pseudo random string and a signature of it. Is this more secure?

I'm not sure if I am describing something that has already been proposed. If not, I would like to coin this "Signed Double Submit Cookies" as a method to improve the Double Submit Cookies technique ...
8
votes
3answers
981 views

Is a HTML form tag more exploitable than a HTML link in user submitted content?

I have a content editor in a web application which allows administrators to add and edit content in certain areas of the application. The editor component I have used automatically removes any script ...
6
votes
4answers
10k views

how can you inject malicious code into an innocent-looking URL?

I am learning about XSS attacks. Wikipedia says that in a non-persistent attack an attacker may provide an innocent-looking URL that "points to a trusted site but actually has an XSS vector." What ...
2
votes
5answers
1k views

Simple solution to XSS

I've got an idea as to how to defeat XSS so simple that it may work and was wondering if anybody had already done something similar. The goal here is not efficiency but security. In other words I ...
-1
votes
1answer
95 views

How to secure a script that generates an HTML file from other websites?

I have a ksh script (Korn Shell Script) that generates a static HTML file from websites. How can I ensure that the output HTML file will not contain any bad <script>'s (bad JavaScript)? It's OK ...
5
votes
4answers
1k views

Is this an attack and how can I fix it?

I don't know where to start in searching the forum for existing threads that might cover my issues. I recently received a spoof email pretending to be from a client for whom I've just started to do ...
4
votes
1answer
39 views

table elements are not encrypted

I read a security book a while ago that said HTML table elements are sent plain text, even if the server connection is https. Is this accurate? I'm thinking about making an on-line purchase from a ...
57
votes
6answers
9k views

Anonymous surveys that aren't so anonymous

In the past I have completed an 'anonymous' survey at work only to find that my employer was able to garner a lot of not-anonymous information from this survey. Location, name of manager, etc. None ...
5
votes
4answers
79 views

Would an official <disablescripts> HTML (6?) element/wrapper combat XSS effectively?

Would it not be possible to use such a method to wrap areas where user input/output is expected (eg. comment boxes), so that even if a script is successfully injected through regex evasion, the script ...
6
votes
1answer
314 views

How do I securely embed an <img> tag using a user-given URL?

If I hypothetically wanted to allow users to use an avatar from an arbitrary URL like this: <img class="avatar" src="{user input}" /> There are many problems that I can think of: There are ...
0
votes
1answer
30 views

taking input from webform and piping into bash password prompt

I've been wanting to create a simple web application that would allow me to view certain text files that I've encryped with GnuPG residing on my webserver through any browser remotely. I've figured ...
1
vote
0answers
81 views

How to check if /run timeout /T 5 remote command execution worked in page html?

I was scanning a website using Zed Attack Proxy, when I found it is vulnerable to remote command execution, specifically timeout with the Referer header (shown in the request below). I have no idea ...
9
votes
2answers
137 views

Best practices when forwarding an email or copy / pasting from confidential information sources?

I get asked this a lot from older people, or for legal matters. They want to forward an email message they've received to another party, while removing any identifying information from the first party ...
2
votes
2answers
83 views

How do I prevent extra javascript from being added into HTML kiosk in public space?

I'm planning a project which is to be PCI compliant, but I am stuck on a particular vulnerability and I can't think of a way to protect against it. The scenario is that there is a kiosk installed in ...
0
votes
3answers
181 views

The purpose of escaping html entities

By security principles, we are often taught to sanitize input fields for characters such as & or ' so that they cannot be used for SQL injections etc. However, now I have an issue: I really need ...
5
votes
3answers
121 views

Input validation: how to do it if I must accept HTML as part of my input?

I'm writing a service which receives FHIR data and it stores it. FHIR is an HL7 healthcare information standard format which contains HTML by definition, embedded into a JSON or XML, (to ensure human-...
9
votes
3answers
942 views

Any eventhandlers that apply to hidden elements?

I'm trying to XSS a search field and my attack vector is getting reflected like this: <input type="text" id="txtRpHiddenKeyword" style="display: none;" value="ATTACK VECTOR HERE" /> Only ...
2
votes
1answer
763 views

HTML iframe security exploit

Can somebody explain if there's something malicious in this HTML, The width and height of the iframe ares set to 1 and it's out of the view with top: -100px; statement. I believe it takes some some ...
79
votes
5answers
37k views

Should websites be allowed to disable autocomplete on forms or fields?

Currently, there is an HTML form/input attribute called autocomplete, which, when set to off, disables autocomplete/autofill for that form or element. Some banks seem to use this to prevent password ...
0
votes
0answers
20 views

Sites to test login through jmeter [duplicate]

Im having a hard time looking for a site with a login system that can be probed with firebug, the POST request password specifically, i was just wondering if anyone here knows one or two sites that ...
3
votes
1answer
44 views

XSS Injection invalidate meta redirection tag

When injecting into the url part of an HTML META redirect like this: <meta http-equiv='refresh' content='0;URL=$URL' where $URL (note the missing quotes) is the part I can inject, is there any ...
1
vote
0answers
112 views

What vulnerability is this malicious document attempting to exploit

CLARIFICATION: I changed the title as people were interpreting this as a request to help understand the code. I explain what the code is doing below (critiques on this analysis are welcome.) I am ...
2
votes
2answers
2k views

If using htmlentities or htmlspecialchars functions is enough for block XSS attack

I know this question was discussed on net various times. and people give some example how to bypass these functions through passing some code. But here one issue, All example of htmlentities/...
2
votes
2answers
104 views

Can 3rd party JavaScript libraries access the http headers of the hosting html page

So, I have website, it uses a cookie stored in the http header of the downloaded html document to maintain the session while the end user is logged on and accessing there 'secure' data. This webpage ...
5
votes
5answers
2k views

Sharing Nmap scan results in a web page [closed]

Is there a tool that allow the sharing of nmap scan results ? I know nmap can produce XML and I can easily convert them in HTML. I would like to know if there is a tool with more features. For ...
2
votes
4answers
2k views

HTML password fields

Imagine you are in a HTML page which offers you the password change service. Some websites bring the previous password in a password field, which you can't read. Is it possible to retrieve the ...
1
vote
3answers
180 views

Can these html tags and attribs make my site vulnerable?

I am developing a social website and want to allow user ONLY these html tags and attributes in their posts: tags: <img>, <b>, <strong>, <blockquote>, <a> attributes: '...
2
votes
1answer
90 views

How to make the most secure text editor in Django?

As a follow up to this question, I'm wondering what is the most secure way (using either markup or markdown) to allow users to format their inputs and upload images in a Django app? I'm not asking ...
2
votes
1answer
374 views

302 redirect and the body on the page (you are redirected to …)

I have page which take URL on query and string and it. Then, you get redirected using 302 to another page, and the response of the page contains HTML code and the redirect header. Like this: <html&...
1
vote
1answer
120 views

Is it possible to get a flash src after a redirect or an element inside an embed/object/iframe tag (cross-domain)?

The URL example.com/auth will automatically redirect the user (HTTP 302) to example.com/signed_in.SWF?token=SENSITIVE. Is it possible for an attacker to steal the token, using javascript or flash, in ...
1
vote
3answers
54 views

What is a typical defense mechanism/setup against flooding back-end sql calls?

I'm interested in figuring out what is a typical scenario of preventing the following attack scenario: Back-end has as SQL server. Front end a simple "Hello World" HTML that passes an input (say user ...
10
votes
2answers
2k views

How to launch XSS code from an INPUT HTML tag upon page load?

Say I have the a website with the following code on it: <input type="text" id="search-text" name="query" value="?" /> Double quotes aren't escaped so I can break out of the value attribute, ...
40
votes
4answers
6k views

Have computer criminals been known to exploit easily-edited websites like Wikipedia to embed malicious scripts?

When I was reading a page on Wikipedia several months ago (December 2014) I saw what looked like a pop-up window from BT, but I soon realized that when I closed the page the pop-up disappeared. I then ...
2
votes
1answer
423 views

XSS in Content-Disposition

Lets assume i have found a xss on site example.com, now to trigger an XSS, i use the following URL: https://example.com/a.php?v=%22%3E%3Cimg%20src=x Which results in following response: HTTP/1.1 ...
3
votes
3answers
269 views

Any Security Risks for using mailto:?

I use a PHP script which performs a database search and when no result are found, user is presented with a mailto link with this format mailto:example@test.com?subject=SEARCHED_QUERY_HERE The ...