The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

learn more… | top users | synonyms

3
votes
3answers
94 views

How to spoof my IP address to JavaScript and other security concerns

Many websites require JavaScript. However, enabling JS means that a website can run a JS snippet to retrieve the user's IP address (even if they are behind a proxy or VPN). So, how can I (the user) ...
0
votes
1answer
37 views

Is it possible to get a flash src after a redirect or an element inside an embed/object/iframe tag (cross-domain)?

The URL example.com/auth will automatically redirect the user (HTTP 302) to example.com/signed_in.SWF?token=SENSITIVE. Is it possible for an attacker to steal the token, using javascript or flash, in ...
6
votes
3answers
83 views

Automatic detection of a compromised web server

I'm trying to figure out if it is possible to automatically detect the the fact that the HTML or javascript files on a server have been tampered with or changed by an attacker. Our website, say ...
0
votes
0answers
56 views

Is there a list of web technologies, and the corresponding privacy risks and mitigations? [closed]

I'm looking for a consolidated list of web technologies, the risks, and mitigations. Does such a thing exist? For example, the basic stuff would be Javascript, IP address, proxy header information, ...
4
votes
2answers
216 views

Similarities among all/most malicious JavaScript

I'm working on a web app that notifies users on whether or not the JavaScript that they entered is malicious. I'm using this article (Examples of malicious javascript) for reference. Is it possible ...
0
votes
1answer
35 views

Can 3rd party JavaScript libraries access the http headers of the hosting html page

So, I have website, it uses a cookie stored in the http header of the downloaded html document to maintain the session while the end user is logged on and accessing there 'secure' data. This webpage ...
2
votes
0answers
31 views

Do any specific steps need to be taken into account for the user's browser and browser caching for a HIPAA compliant web application?

I'm currently writing a web application that will need to be HIPAA compliant. It is very JavaScript heavy, and ePHI will be sent over an encrypted connection in the form of JSON. The transmission ...
39
votes
4answers
6k views

Have computer criminals been known to exploit easily-edited websites like Wikipedia to embed malicious scripts?

When I was reading a page on Wikipedia several months ago (December 2014) I saw what looked like a pop-up window from BT, but I soon realized that when I closed the page the pop-up disappeared. I then ...
0
votes
1answer
32 views

xmlhttprequest with https - can I test the fingerprint before sending any data

I am making https calls in javascript via xmlhttprequest. I know the server and its public key in advance. For extra security, I would like to check the public key (or its fingerprint) if its is what ...
5
votes
1answer
104 views

Are there cases where malicious scripts on websites breached the sandbox of a browser so that files on the user's computer could be accessed?

Whenever a hosted script on a website tries to access a file on a user's computer the sandbox prevents it, but has there been any documented case where this sandbox obstacle was somehow overcome by ...
1
vote
0answers
40 views

Can static analysis of JavaScript be done?

Is it possible to statistically analyze JavaScript to find obfuscated JavaScript? Any algorithms or equations with coefficients that can find obfuscated JavaScript?
2
votes
1answer
92 views

How to trace source of clickjacking attack within a website using developer tools?

When surfing a popular Wordpress website on my mobile, clicking on a link to an article within would sometimes open a new window to a malicious website or launch the Apps Store. I am interested to ...
1
vote
1answer
33 views

Selective JavaScript commands - Avoiding vulnerabilities explotation

I remember the times when JavaScript usage was so innocent. A small pop-up here a dialog message there. Nowadays JavaScript "steals" data by exploiting vulnerabilities on "mature" browsers such as ...
2
votes
2answers
50 views

http_only for cookies with JWT tokens

I'm trying to figure out how to use JWTs that are transmitted in cookies for an SPA It needs to be in cookies because we want non-ajax requests to also send the jwt, and it should "just work" for all ...
0
votes
0answers
27 views

Problem with SSL JavaScript [migrated]

I have a small problem with the script, it is not working on SSL. Below is the code: <link rel="stylesheet" type="text/css" href="{$base_dir}modules/wnsocialsidebars/css/social.css" /> ...
0
votes
3answers
111 views

Is this code javascript vulnerable to DOM based XSS?

Code : <script> document.theform.reference.onchange = function(){ var id = document.theform.reference.selectedIndex; var url = document.theform.reference[id].value; ...
4
votes
4answers
137 views

Famous XSS attacks over JavaScript [closed]

I'm about to graduate in "Computer Science", and I'm writing thesis about the Javascript vulnerabilities. In particular, I'm analyzing the JS vulnerabilities that allow XSS attacks. I would like to ...
5
votes
3answers
135 views

What to do when iPhone is successfully phished

My girlfriend watched "some" pages on her iPhone and facebook.you-won.com page appeared. She didn't know how to get rid of that JavaScript alert, so she clicked OK. After that she closed the page, and ...
0
votes
1answer
65 views

Is injecting malicious file with browser localstorage possible?

Lets say, I visited a "malicioussite.com" and the server had a "malicious.js" in it whose job is to write malicious code to my browser localStorage and save it to the my computer then execute it to ...
9
votes
4answers
2k views

Why disable JavaScript in Tor? [duplicate]

Why it is not advisable to use JavaScript with Tor? Yet with JavaScript, you cannot get the IP address of the user except through an external website. How could using JavaScript with Tor expose one's ...
9
votes
1answer
591 views

Why can't you steal the synchroniser token to do CSRF? [duplicate]

I'm reading up on CSRF and I came across synchroniser tokens. I don't understand why you can't do a CSRF to get the token to do a real CSRF. Example: bank.com has a form like this at ...
0
votes
2answers
76 views

Random characters and letters form obsfuscation

I know that this question has been asked many times, but would JavaScript encryption work if I just added 100 random numbers and letters to the password? That would be hard to reverse engineer, ...
2
votes
1answer
88 views

Google Analytics use of JSONP, what are the security risks?

These days Google Analytics uses a JSONP request to load ga.js into user's web pages via a callback function. According to the Wikipedia, JSONP can "inject any content into a website." What exactly ...
1
vote
1answer
48 views

What kind of attacks do Javascript WebWorkers protect against?

What kind of attack are prevented by running code submitted by the user in a Javascript Web Worker? Do they prevent attacks like XSS, or is it better to use some other sandboxing method to protect ...
2
votes
1answer
103 views

How sharing location via web actually works? (It gets my exact house address)

I know that this could be a repeated question, but I'm freaked out right now, Maybe Im old or out of the 2015 technologies, but i just visited this page: http://whatismyipaddress.com. As I know, ...
3
votes
2answers
78 views

Is it neccessary to use X-FRAME-OPTIONS to prevent ClickJacking attacks?

I use this Javascript Code, and it works perfectly: if (top.location != location) top.location.href = location.href Many researchers told me to not use this. Can any one bypass it? Are there ...
14
votes
4answers
2k views

What are the security issues with “eval()” in JavaScript?

Every time that someone mentions eval(), everyone says that there are "security issues" with it, but nobody ever goes into detail about what they are. Most modern browsers seem to be able to debug ...
0
votes
3answers
119 views

What are the different payloads used for XSS vulnerability? [closed]

I am new to information security field. I am searching for XSS vulnerabilities. In XSS mostly they use <script>alert('XSS')</script> payload for attacking a websites. In the case of ...
1
vote
1answer
248 views

XSS payload to capture login credentials

I am trying to solve this exercise http://pentesteracademylab.appspot.com/lab/webapp/jfp/3. The objective of this is to "Post the Username and Password to Attacker Controlled Server". There is a url ...
-3
votes
1answer
58 views

Session hijacking [closed]

I know one way of doing session hijacking 1.copying the session value from the chrome browser and pasting the cookie value to firefox browser Is there any other way of doing session hijacking ? If ...
1
vote
1answer
50 views

Common characters/statements in obfuscated JavaScript [closed]

I'm trying to compile a list of common characters and statements in obfuscated JavaScript. I'm using http://aw-snap.info/articles/js-examples.php for obfuscated JS examples, but I cannot distinguish ...
-1
votes
2answers
102 views

Obfuscated JS Code That Breaks On De-Obfuscating Or Debugging [closed]

How can I de-obfuscate this JavaScript? I see it opens a new window at www.google.com, but what else does it do? I can't open it in debugger it just doesn't work then? And is it malicious? Here is ...
9
votes
5answers
1k views

How to do client side hashing of password using BCrypt? [duplicate]

I am migrating an old application which used MD5 hashing to Spring Security with BCrypt encoding of passwords. I want to encode the password on new user creation page, change password page and on ...
7
votes
1answer
159 views

Javascript phishing attack sucker: Do I need to be worried? [closed]

So, I'm an idiot. I opened a javascript phishing attack file. I would really, really appreciate some help with decoding the Javascript to figure out whether I'm in trouble, and what sort. I'm on OS X ...
1
vote
1answer
94 views

Any standard tests to prevent hacking? [closed]

I am very new in programming world so my question may sound weird. I am useing selenium to test an application, yesterday one of my colleagues found this issue that if someone enters this: <script ...
2
votes
0answers
54 views

How to indicate that content in an iframe is untrusted

As part of a website I am developing, untrusted content is displayed in a sandboxed iframe. The content is loaded using the srcdoc attribute, but the iframe is sandboxed using sandbox="allow-scripts", ...
0
votes
2answers
108 views

Hiding (Obfuscating) Java script [closed]

So i heard that obfuscating java script is useless and waste of time because anyone with a little of skill can decode your code. So i want to test that. This code will display a alert box saying hey ...
1
vote
1answer
66 views

Dom based Xss Query - location.hash

I was just looking at Dom based xss and wondering if hash value is written to a variable in javascript context can lead to Cross site scripting. The code looks something like this: <script> var ...
4
votes
2answers
285 views

Can a website make an HTTP request to “localhost”? How does it get around the cross-domain policy?

I found this website which talks about fixing a Redis vulnerability by exploiting that same vulnerability. The website in question has a "patch me" button, and if you have a password-less Redis ...
5
votes
4answers
346 views

XSS using JSF**k

I was reading about JSf**k. From their website: JSF**k is an esoteric and educational programming style based on the atomic parts of JavaScript. It uses only six different characters to write and ...
5
votes
4answers
942 views

Client side encryption - only web browser available

I am creating an enterprise application, the server side runs a whole set of different apps, On the client side, there is only a webpage, no applet or anything else. Unfortunately data created by the ...
3
votes
3answers
113 views

Any Security Risks for using mailto:?

I use a PHP script which performs a database search and when no result are found, user is presented with a mailto link with this format mailto:example@test.com?subject=SEARCHED_QUERY_HERE The ...
5
votes
1answer
128 views

Video site requests Adblocker to be shut off, next day I have 3 “weird” bookmarks

I was on a site trying to view a video and the site requested that I turn off my adblocker to view the video. So I did and then the next day I noticed that I had 3 "weird" bookmarks in my bookmark ...
2
votes
0answers
77 views

Suspicious web-application requests containing encoded JavaScript function(?)

I've been seeing some odd traffic in the logs for a web-application (Apache) that I'm wondering about, and I'm hoping that someone here has seen this before. The raw requests were variations of: ...
0
votes
1answer
179 views

RSA/ECB/PKCS1Padding: Encypting a Session Key Javascript

How to do ECB mode when dealing with RSA? I dont understand it. The Aadhar authentication doc (http://uidai.gov.in/images/FrontPageUpdates/aadhaar_authentication_api_1_6.pdf Page 33) says that we have ...
0
votes
0answers
60 views

injecting javascript in webviews in Android

I am relatively new to mobile application security. Currently I am supposed to audit an android application which uses a webview to display some static FAQ page in an activity. The webview in ...
0
votes
3answers
127 views

Preventing SSL strip attack

Is it possible to detect a ssl strip attack by checking whether the page deliverd is https or http using javascript?I am assuming that the response page is https page instead of http?
3
votes
3answers
198 views

Can a browser JavaScript console ever be an issue?

I'm sure most of you are familiar with the JavaScript-based game Candy Box. As you probably know, one can cheat this game's candy system by sending commands to the console. For instance, if you ...
2
votes
0answers
123 views

How does JavaScript Injection work?

I was watching a DefCon talk and the speaker was saying he was able to infect JavaScript cache files, once the user visited his website/server. From there he was able to load scripts from other sites ...
1
vote
1answer
56 views

Angular security in $scope

For our app when a user logged in we are issuing him a token which is stored in session and we are using $rootScope to store his details. This what we are doing if(sessionStorage.loggedIn && ...