0
votes
1answer
246 views

How do I inject JavaScript into a JPG image and execute it when uploaded?

I've recently joined a security project, and received a task to demonstrate the risk related to an end-user uploading an image containing embedded (malicious) JavaScript code. I used EXIFeditor to ...
0
votes
2answers
185 views

Is it possible to modify a support .js file in a web application by injection?

Let's say there is a web application needing a JavaScript support file .js to be loaded in the head of the html document. <!DOCTYPE html> <html> <head> <meta ...
-2
votes
1answer
182 views

Injected Images

I want to learn all about that. How can we inject code into an image? Is the code must be php? Or is javascript or HTML works too? How I find documentation about this article? I'm a newbie about ...
0
votes
2answers
1k views

Stopping js malware injection on our Wordpress site

This had been added to our wordpress site, specifically in the footer.php. hxxp://pkktjuchlrv.peguards.cc/02b31ac5iq/get.js It is malware as defined by google, i belive it is tracking code. We have ...
11
votes
2answers
2k views

What does this injected code do?

One of my sites has just been hacked as this code has been inserted into random(?) files and places within the files. Does anyone understand what it is trying to do? I would welcome anything that may ...
0
votes
1answer
571 views

Sanitizing JavaScript to prevent XSS

I'm going through a vulnerability remediation exercise for a client and am trying to figure out how to best mitigate this particular hole. There's a script on our site that calls up content into a new ...
4
votes
2answers
6k views

DOM Based XSS attacks: what is the most dangerous example?

I knew that XSS attacks (“non-persistent” and “persistent”) can hijack user session, deface websites, conduct phishing attack, etc. However, I can't understand what is dangerous of DOM Based XSS if ...
1
vote
1answer
897 views

“pagesinxt.com” links in the sourcecode, am I being hacked?

At this moment I am being hacked and I do not know to stop it. Let me explain... My website is hosted in a VPS where I am the only person who has access to it. The page is builtwith ...
5
votes
4answers
562 views

Is JavaScript self-injection dangerous?

I have a toy web application that can be described roughly as a per-user key-value store. After logging in, the user can view and modify her set of key-value pairs. The keys and values are stored in a ...
3
votes
2answers
372 views

Can a whitespace regex character be used to perform a javascript injection?

if I want to validate the input of a <textarea>, and want it to contain, for example, only numerical values, but even want to give users the possibility to insert new lines, I can selected ...
17
votes
2answers
570 views

What risks should I be aware of before allowing advertisements being placed on my website?

The thought of having a 3rd party send javascript, and images to end users seems to be a scary thought, but that is exactly what we are doing when I place advertisements onto my site. Does serving ...
2
votes
2answers
697 views

Is it possible to take down a site using javascript in the URL bar?

If a site is written poorly enough, is it possible to take it down or severely mess with it using only javascript in the URL bar?