The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

learn more… | top users | synonyms

0
votes
3answers
77 views

Is this code javascript vulnerable to DOM based XSS?

Code : <script> document.theform.reference.onchange = function(){ var id = document.theform.reference.selectedIndex; var url = document.theform.reference[id].value; ...
4
votes
4answers
103 views

Famous XSS attacks over JavaScript [on hold]

I'm about to graduate in "Computer Science", and I'm writing thesis about the Javascript vulnerabilities. In particular, I'm analyzing the JS vulnerabilities that allow XSS attacks. I would like to ...
5
votes
3answers
109 views

What to do when iPhone is successfully phished

My girlfriend watched "some" pages on her iPhone and facebook.you-won.com page appeared. She didn't know how to get rid of that JavaScript alert, so she clicked OK. After that she closed the page, and ...
0
votes
1answer
57 views

Is injecting malicious file with browser localstorage possible?

Lets say, I visited a "malicioussite.com" and the server had a "malicious.js" in it whose job is to write malicious code to my browser localStorage and save it to the my computer then execute it to ...
9
votes
4answers
2k views

Why disable JavaScript in Tor? [duplicate]

Why it is not advisable to use JavaScript with Tor? Yet with JavaScript, you cannot get the IP address of the user except through an external website. How could using JavaScript with Tor expose one's ...
9
votes
1answer
574 views

Why can't you steal the synchroniser token to do CSRF? [duplicate]

I'm reading up on CSRF and I came across synchroniser tokens. I don't understand why you can't do a CSRF to get the token to do a real CSRF. Example: bank.com has a form like this at ...
-4
votes
1answer
41 views

Some good resources to learn about Javascript DoM based Cross site scripting? [closed]

I'm learning Web Application Security, Please post some good resources to learn about DOM based XSS (Basics to advaned) Thanks... -Dave
0
votes
2answers
66 views

Random characters and letters form obsfuscation

I know that this question has been asked many times, but would JavaScript encryption work if I just added 100 random numbers and letters to the password? That would be hard to reverse engineer, ...
2
votes
1answer
70 views

Google Analytics use of JSONP, what are the security risks?

These days Google Analytics uses a JSONP request to load ga.js into user's web pages via a callback function. According to the Wikipedia, JSONP can "inject any content into a website." What exactly ...
1
vote
1answer
44 views

What kind of attacks do Javascript WebWorkers protect against?

What kind of attack are prevented by running code submitted by the user in a Javascript Web Worker? Do they prevent attacks like XSS, or is it better to use some other sandboxing method to protect ...
2
votes
1answer
89 views

How sharing location via web actually works? (It gets my exact house address)

I know that this could be a repeated question, but I'm freaked out right now, Maybe Im old or out of the 2015 technologies, but i just visited this page: http://whatismyipaddress.com. As I know, ...
3
votes
2answers
61 views

Is it neccessary to use X-FRAME-OPTIONS to prevent ClickJacking attacks?

I use this Javascript Code, and it works perfectly: if (top.location != location) top.location.href = location.href Many researchers told me to not use this. Can any one bypass it? Are there ...
14
votes
4answers
2k views

What are the security issues with “eval()” in JavaScript?

Every time that someone mentions eval(), everyone says that there are "security issues" with it, but nobody ever goes into detail about what they are. Most modern browsers seem to be able to debug ...
0
votes
3answers
106 views

What are the different payloads used for XSS vulnerability? [closed]

I am new to information security field. I am searching for XSS vulnerabilities. In XSS mostly they use <script>alert('XSS')</script> payload for attacking a websites. In the case of ...
1
vote
1answer
221 views

XSS payload to capture login credentials

I am trying to solve this exercise http://pentesteracademylab.appspot.com/lab/webapp/jfp/3. The objective of this is to "Post the Username and Password to Attacker Controlled Server". There is a url ...
-3
votes
1answer
49 views

Session hijacking [closed]

I know one way of doing session hijacking 1.copying the session value from the chrome browser and pasting the cookie value to firefox browser Is there any other way of doing session hijacking ? If ...
1
vote
1answer
45 views

Common characters/statements in obfuscated JavaScript [closed]

I'm trying to compile a list of common characters and statements in obfuscated JavaScript. I'm using http://aw-snap.info/articles/js-examples.php for obfuscated JS examples, but I cannot distinguish ...
0
votes
0answers
37 views

Key characters that help in finding obfuscated JavaScript [migrated]

I need figure out how to detect obfuscated JavaScript purely on static analysis. Here is an example of a piece of obfuscated JavaScript that I need to detect just by static analysis. ...
-1
votes
2answers
87 views

Obfuscated JS Code That Breaks On De-Obfuscating Or Debugging [closed]

How can I de-obfuscate this JavaScript? I see it opens a new window at www.google.com, but what else does it do? I can't open it in debugger it just doesn't work then? And is it malicious? Here is ...
9
votes
5answers
969 views

How to do client side hashing of password using BCrypt? [duplicate]

I am migrating an old application which used MD5 hashing to Spring Security with BCrypt encoding of passwords. I want to encode the password on new user creation page, change password page and on ...
7
votes
1answer
124 views

Javascript phishing attack sucker: Do I need to be worried? [closed]

So, I'm an idiot. I opened a javascript phishing attack file. I would really, really appreciate some help with decoding the Javascript to figure out whether I'm in trouble, and what sort. I'm on OS X ...
1
vote
1answer
93 views

Any standard tests to prevent hacking? [closed]

I am very new in programming world so my question may sound weird. I am useing selenium to test an application, yesterday one of my colleagues found this issue that if someone enters this: <script ...
2
votes
0answers
52 views

How to indicate that content in an iframe is untrusted

As part of a website I am developing, untrusted content is displayed in a sandboxed iframe. The content is loaded using the srcdoc attribute, but the iframe is sandboxed using sandbox="allow-scripts", ...
0
votes
2answers
107 views

Hiding (Obfuscating) Java script [closed]

So i heard that obfuscating java script is useless and waste of time because anyone with a little of skill can decode your code. So i want to test that. This code will display a alert box saying hey ...
1
vote
1answer
49 views

Dom based Xss Query - location.hash

I was just looking at Dom based xss and wondering if hash value is written to a variable in javascript context can lead to Cross site scripting. The code looks something like this: <script> var ...
4
votes
2answers
157 views

Can a website make an HTTP request to “localhost”? How does it get around the cross-domain policy?

I found this website which talks about fixing a Redis vulnerability by exploiting that same vulnerability. The website in question has a "patch me" button, and if you have a password-less Redis ...
5
votes
4answers
334 views

XSS using JSF**k

I was reading about JSf**k. From their website: JSF**k is an esoteric and educational programming style based on the atomic parts of JavaScript. It uses only six different characters to write and ...
5
votes
4answers
891 views

Client side encryption - only web browser available

I am creating an enterprise application, the server side runs a whole set of different apps, On the client side, there is only a webpage, no applet or anything else. Unfortunately data created by the ...
3
votes
3answers
95 views

Any Security Risks for using mailto:?

I use a PHP script which performs a database search and when no result are found, user is presented with a mailto link with this format mailto:example@test.com?subject=SEARCHED_QUERY_HERE The ...
5
votes
1answer
124 views

Video site requests Adblocker to be shut off, next day I have 3 “weird” bookmarks

I was on a site trying to view a video and the site requested that I turn off my adblocker to view the video. So I did and then the next day I noticed that I had 3 "weird" bookmarks in my bookmark ...
2
votes
0answers
73 views

Suspicious web-application requests containing encoded JavaScript function(?)

I've been seeing some odd traffic in the logs for a web-application (Apache) that I'm wondering about, and I'm hoping that someone here has seen this before. The raw requests were variations of: ...
0
votes
1answer
111 views

RSA/ECB/PKCS1Padding: Encypting a Session Key Javascript

How to do ECB mode when dealing with RSA? I dont understand it. The Aadhar authentication doc (http://uidai.gov.in/images/FrontPageUpdates/aadhaar_authentication_api_1_6.pdf Page 33) says that we have ...
0
votes
0answers
49 views

injecting javascript in webviews in Android

I am relatively new to mobile application security. Currently I am supposed to audit an android application which uses a webview to display some static FAQ page in an activity. The webview in ...
0
votes
3answers
107 views

Preventing SSL strip attack

Is it possible to detect a ssl strip attack by checking whether the page deliverd is https or http using javascript?I am assuming that the response page is https page instead of http?
3
votes
3answers
182 views

Can a browser JavaScript console ever be an issue?

I'm sure most of you are familiar with the JavaScript-based game Candy Box. As you probably know, one can cheat this game's candy system by sending commands to the console. For instance, if you ...
2
votes
0answers
110 views

How does JavaScript Injection work?

I was watching a DefCon talk and the speaker was saying he was able to infect JavaScript cache files, once the user visited his website/server. From there he was able to load scripts from other sites ...
1
vote
1answer
47 views

Angular security in $scope

For our app when a user logged in we are issuing him a token which is stored in session and we are using $rootScope to store his details. This what we are doing if(sessionStorage.loggedIn && ...
2
votes
2answers
57 views

Is is possible to create a “signature” for a piece of JavaScript

Bear with me, I may have asked this question in a botched way. So I need some JavaScript code that creates a signature of JavaScript that is stored in a string. Here is an example: presignature = ...
2
votes
1answer
72 views

What are the best practices for (token based) security in a webapp?

I am designing a web application using Spring MVC with REST controllers and Angular JS pages which communicate with these REST controllers. I've implemented a token based security/ authorization ...
-4
votes
1answer
57 views

Could blocking script in the url prevent DOM XSS? [closed]

On my site, if I were to block <script> from the url, could this prevent some cases of XSS? Any way someone could bypass that?
1
vote
1answer
98 views

Safe to render data directly to DOM from localStorage? XSS attack possible?

I read that localstorage is susceptible to XSS attacks. I currently store JSON Web Token (JWT) in localstorage, and I access and display data about the user through localstorage: var localstore = ...
6
votes
3answers
461 views

Favicon Redirection Possible Security Flaw

I have the domain example.com When I enter the URL https://api.example.com, Chrome loads the page and also tries to load https://myapp.example.com/favicon.ico, and that request receives a 301 ...
0
votes
0answers
71 views

Problem in 'underscore.js' “new Function()” when CSP header is set.

In underscore.js, template rendering causes violation of the 'unsafe-eval' property, with CSP error at following line: "render = new Function(settings.variable || 'obj', '_', source);" The solution ...
-1
votes
1answer
99 views

What to do if I suspect a website I visit and link to was compromised via an XSS?

EDIT: The script has been removed and apparently the vulnerability has been patched. My employer links to this resource: http://www.myplan.com/ I recently noticed a JavaScript alert was added into ...
0
votes
0answers
49 views

Securing REST API with HMAC and SPA

I'm developing a JS based SPA and the backend is a rest api which uses HMAC. The site/app doesn't have the concept of registered users but it has the concept of session. How do i make sure that the ...
3
votes
2answers
454 views

Set the max length for input

Suppose I have a form, and one of this form inputs I set the max length to 15: <input type="text" name="username" maxlength="15"> Now the attacker wants to override this limit, to do that he ...
1
vote
1answer
93 views

JS code giving xss vulnerability

Below is a piece of JS code: if(!(window.location.href.indexOf('?')> -1)){ id= window.location.href.slice(window.location.href.lastIndexOf('/') + 1); } ...
1
vote
3answers
72 views

External JS Security

I'm kinda new to security development. I've work mostly with backend processing stuff. I've been assign on how to secure external javascript that we import from facebook, twitter and google. One ...
1
vote
1answer
73 views

XSS inside a javascript

Can an XSS be craft inside the following JS. $(function () { $("#panel").find(".form").each(function (index) { var that = this; $(that).overload(); ...
1
vote
0answers
68 views

ASP.NET WCF security, javascript and handling sensitive information

I've come upon what I would call some "nasty" javascript coding (I come from a KnockoutJS / Angular / Web API 'world') in which WCF services are exposed to javascript by production URL's, i.e. ...