HTML (HyperText Markup Language) is a language used to create web pages using tags inline with the content to indicate to browsers how to display that content, using the tags to interpret formatting, images, scripts and other content.

learn more… | top users | synonyms

-1
votes
2answers
139 views

How to get the information from the iframe displayed (ClickJack) to the user back to the attacker?

Just for knowledge I want to know how to get the information from the i-frame displayed to the user back to the attacker? Scenario : Suppose You are an attacker and you want to grab the private ...
2
votes
1answer
123 views

Safe to render data directly to DOM from localStorage? XSS attack possible?

I read that localstorage is susceptible to XSS attacks. I currently store JSON Web Token (JWT) in localstorage, and I access and display data about the user through localstorage: var localstore = ...
1
vote
1answer
175 views

Are HTML Entities inherently unsafe?

When submitting HTML that contains entities to the OWASP HTMLSanitzer, entities are converted. For example: BEFORE: <p>blah blah blah &diams;</p> The resulting HTML ends up ...
0
votes
1answer
34 views

Is it possible to get a flash src after a redirect or an element inside an embed/object/iframe tag (cross-domain)?

The URL example.com/auth will automatically redirect the user (HTTP 302) to example.com/signed_in.SWF?token=SENSITIVE. Is it possible for an attacker to steal the token, using javascript or flash, in ...
0
votes
1answer
34 views

Can 3rd party JavaScript libraries access the http headers of the hosting html page

So, I have website, it uses a cookie stored in the http header of the downloaded html document to maintain the session while the end user is logged on and accessing there 'secure' data. This webpage ...
0
votes
0answers
177 views

Exploit circulating Facebook with a .pnh file embedded in a <img> tag

Not sure how long this link will be up, but this is the page where users get redirected after trying to read a fake news post in someone timeline. [WARNING: ACCESS IN A CONTROLLED ENVIRONMENT] ...