The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

learn more… | top users | synonyms

6
votes
3answers
1k views

What's wrong with my own authentication scheme?

So I want to write my own authentication scheme for a web-app server, as follows. I assume this is a Bad Idea from either security or cost-effectiveness reasons and I know the conventional wisdom is ...
2
votes
2answers
12 views

Would usage of jCryption 3.0 + SSL have mitigated the Heartbleed vulnerability?

I came across a project called jCryption 3.0, which encrypts data between the client and server, without using SSL. If a website's JavaScript had used jCryption 3.0 to encrypt login form fields before ...
2
votes
2answers
102 views

Hacked HTML page - what's in the comment following the obfuscated code?

Chrome just warned me about malicious content when visiting a site - so I visited it. The source code is like the following: <html> <head> <link href="images/DPT2.ico" title="Dynamic ...
0
votes
2answers
52 views

SQL Injection and JavaScript Regex Bypass

me for learning SQLI. But I got stuck at this one regex which seems to be unbreakable : document.loginForm.username.value = document.loginForm.username.value.replace(/[^a-zA-Z0-9]/g, ""); If someone ...
0
votes
3answers
78 views

Does this reflected XSS vulnerability pose any real threat?

I have a web site where users can enter some text into a textbox and that text is immediately rendered in a div using javascript (strictly front end). If a user enders something like this: This is ...
3
votes
1answer
33 views

user data accessible through javascript in browser

There are websites which display user information, such as browser version and operating system This website goes even further, and displays some additional information, such as desktop resolution, ...
1
vote
3answers
105 views

hiding javascript in image

I have read a post in thehackernews and searched the net to find how it worked. How can anyone add javascript in an image such that when the image is displayed it can run a script. Can this be done ...
1
vote
1answer
65 views

BeeF - How does it work?

I'm mainly server sided. I haven't worked with JS that much before. My coworker was talking about beef and how it basically controls the victims browser just by a simple xss attack I was wondering ...
2
votes
4answers
212 views

Why aren't we all compromised on the internet?

Well, I've been thinking about this for a while now. Within the last decade, we've used various ways to make our websites look dynamic and live. For example, in JavaScript, it's quite easy to send ...
2
votes
2answers
230 views

Is this password generator safe?

128-bit entropy is required http://nxtra.org/nxt-client/js/passphrasegenerator.js With all new browsers (Chrome, Firefox, IE 11) it uses crypto.getRandomValues which should be safe, but with IE 10 ...
0
votes
1answer
57 views

Review of approach to client-side only hashing and encryption for web application

Background: I have little knowledge of hashing and encryption, so please bear with me. I have posted a related question here: ...
0
votes
1answer
52 views

Sending passwords securly over the net: javascript? [closed]

I believe SSL is decrypted and encrypted from your computer to the receiver right? Well is it possible to use any type of encryption (Stanford crypto lib?) to get a password safely over the net these ...
1
vote
0answers
56 views

Are HTTPOnly Cookies submitted via XmlHTTPRequest with withCredentials=True?

I have a two part question here. I have a javascript webapp accessing privileged REST endpoints. I would like to protect against CSRF. Currently, I have a login system built which returns a login ...
1
vote
0answers
105 views

How to secure my REST implementation for an ember.js app

I've been searching and searching for what seems days and have not come up with any definitive answer on a solution to my problem. To explain without going into terrible detail I am building a store, ...
1
vote
2answers
86 views

Digital Signatures of XML, PDF and Office Documents on every platform

I'm trying to develop a website that performs digital signatures on client-side and then sent the signed document to the server-side. I want to do the signatures on client, due to the fact of not ...
1
vote
1answer
190 views

File upload vulnerability

I am trying to pentest a webapp challenge. Is the following control code vulnerable to file upload? I would like to upload a php shell... I am able to upload shell.php.jpg file but I receive the ...
1
vote
3answers
92 views

Authorization with MD5 imlemented in Javascript

I want to use MD5 function (JavaScript library) to hash password before send it to server during logging in to website and during registration proces. I want to ask is it a secure method? I can't ...
2
votes
2answers
123 views

DOM XSS attack failing in Firefox

I am trying to perform DOM XSS attack to exploit a vulnerability of localhost webpage. I am able to perform the attack successfully on IE-11 and Chrome. But Firefox is preventing me to perform the ...
0
votes
2answers
90 views

JS code vulnerable?

Can you please help me in order to understand what exactly do this code and if it is could be vulernerable? <script type="text/javascript"> function getUrlVars(){ var vars ...
1
vote
0answers
76 views

Hacking attempts:in.js

A client of mine keeps getting hacked by seemingly SQL injection where a script tag containing a link to an "in.js" file is added. Sometimes from a domain called sportserve.co.uk, other times from ...
1
vote
2answers
923 views

Possible attack on website

I am a developer and I therefor I have very little knowledge on security. So I need some help understanding the attack on website which we launched recently for one of our client. Website is built on ...
0
votes
1answer
116 views

exploit document.write with unsanitized user input

I'm trying to inject javascript into a js scriptfile but it's not working. I have the following setup: html file with javascript-file include (all inline js is blocked!) Welcome, <script ...
0
votes
1answer
57 views

Is it html escape enough for mitigating all xss, if html is going to be generated only in client side?

If all html in a site is generated in client side (attributes, urls, styles everything will be concatenated in javascript and set as innerHTML), is it doing only html escape enough for mitigating all ...
1
vote
2answers
180 views

Is jQuery.val() enough to prevent XSS

Is obtaining the value of a textarea/input with the jQuery function .val() XSS-proof? <html> <textarea id="t1"></textarea> <script> var toBeDisplayed = ...
1
vote
1answer
67 views

What is the best approach for securing log-in credentials on an HTML form?

I realize how basic this question is, but I have relied for years on mechanisms built into .NET to handle log in for me. These days, most of my work involves using client-side logic and calling API ...
0
votes
2answers
117 views

Is it possible to modify a support .js file in a web application by injection?

Let's say there is a web application needing a JavaScript support file .js to be loaded in the head of the html document. <!DOCTYPE html> <html> <head> <meta ...
3
votes
0answers
132 views

Is 'Forge' Javascript crypto library secure?

I need a client-side crypto library. I've seen https://github.com/digitalbazaar/forge linked many times on stackexchange. Forge seems to be the most complete and well-documented crypto library for JS. ...
1
vote
0answers
129 views

AngularJS Static Analysis Tools [closed]

I am setting up a software security initiative at a small software company. Part of this is selecting a static analysis tool for early and automated detection of security vulnerabilities. Many ...
4
votes
1answer
102 views

Why would a user agent string be executed?

I'm having trouble understanding how a particular XSS vulnerability might arise in the real world. Guides for two of the exercises on hackthissite.org: ...
9
votes
4answers
469 views

Does my UI need to be secure if my API is?

I'm working on a project that is creating two new, separate web modules (possibly even on different servers) to support a new web application, with one serving up a static JS-based UI and the other ...
1
vote
1answer
103 views

Is it safe to use createHTMLDocument to sanitize HTML?

i'm wondering how safe it is to use createHTMLDocument to do HTML sanitization. I've tried to implement it like this: function sanitize(string) { var elm = ...
0
votes
1answer
116 views

Hashing Passphrase in Client-Side JavaScript Rather than Server-Side — Is it Viable?

Yet another salting-and-hashing-for-web-sites question has been left on the doormat of Information Security's StackExchange. The oft-mentioned approach for website password-handling is to use a ...
1
vote
1answer
61 views

Base Programming for vulnerabilities

Hello, I am a beginner looking for some information. My question is the following: In order to understand certain security concepts is it essential that I understand the underlying languages? For ...
-2
votes
1answer
93 views

Injected Images

I want to learn all about that. How can we inject code into an image? Is the code must be php? Or is javascript or HTML works too? How I find documentation about this article? I'm a newbie about ...
1
vote
0answers
74 views

Can a Java servlet filter be used to pull out scripts that aren't whitelisted?

I might be asking a similar question to this: Whitelisting DOM elements to defeat XSS But I think my proposed solution is different and I was wondering if I could get the community to comment on ...
2
votes
1answer
243 views

XSS cookie stealing without redirecting to another page

I'm practicing in VM following the OWASP guide. I know that is possible to steal the cookie by redirecting to "False" page etc. but I would like to steal the cookie without redirecting on another ...
0
votes
2answers
109 views

Have I crossed my t's and dotted my lower-case j's? (or, implementing AES, please help get some eyes on my code)

So, I used the crypto module in node.js to implement a secure key generator and encrypt/decrypt functions. Knowing that security's best friend is a spotlight on the implementation, I want to throw it ...
3
votes
1answer
80 views

Danger of hidden html form uploading users local files without their knowledge

Is there a danger that a webpage could have a hidden form with a file upload input and js script that would try and take a random guesses at files on a users system and attach them to the form and ...
0
votes
1answer
663 views

Javascript http to https redirect - how vulnerable/how secure? [duplicate]

If I had a website http://site.com redirecting to https://site.com via javascript (with a HTTP/1.1 403 Forbidden), what are the attack vectors I could be vulnerable too? Why is this not a good ...
0
votes
1answer
68 views

Self-changing javascript characters in text editors

On Windows Server 2008-R2, certain javascript files are exhibiting the same behavior. Text can be copied from other files and pasted into new ones. In both NotePad++ and Windows' default notepad, ...
0
votes
1answer
104 views

Custom rest api / client security scheme

Right off the bat, I'd like to know if there is a widely used library or standard that I could adopt to replace my "custom" scheme. I am certain that I, as one person, cannot produce something better ...
0
votes
2answers
566 views

Ways to completely spoof browser user agent and hiding OS to a webserver

This is a follow-up to the following question: Can a website determine what OS or web browser a visitor is using if the useragent is blanked/changed? If I have understood the answers correctly, a ...
2
votes
1answer
62 views

Chrome inline JavaScript string interpreatation

If you have an HTML file that contains the following code : <!doctype html> <html lang="en"> <head> <meta charset="UTF-8"> </head> ...
2
votes
1answer
276 views

Cross site Scripting in HTTP Method?

Lately, I've noticed that many web server configurations reflect the method of an HTTP request sent with a non implemented method in the body of the server's response. For example, A request sent ...
2
votes
2answers
256 views

Risks of client-side encryption using Stanford Crypto Library

I'm building a simple web application for encrypted chat. Each message will undergo 256-bit AES encryption on the client side, using the Stanford Javascript Crypto Library. No unencrypted data or ...
0
votes
1answer
315 views

UTF-7 XSS attacks in modern browsers

I've recently read about utf-7 XSS-attacks (i.e. Ned Batchelders article at http://nedbatchelder.com/blog/200704/xss_with_utf7.html) but could not get any UTF-7 attack to work in modern browsers. (I ...
5
votes
2answers
114 views

Any eventhandlers that apply to hidden elements?

Im trying to XSS a search field and my attack vector is getting reflected like this: <input type="text" id="txtRpHiddenKeyword" style="display: none;" value="ATTACK VECTOR HERE" /> Only ...
-1
votes
2answers
79 views

Protecting sensitive content in JS source code and Ajax cals [closed]

I've been trying to see how to properly protect important content that's passed in ajax calls with java script. Considering JavaScript can be viewed at any point, it is inevitable that some of your ...
0
votes
2answers
147 views

NGO Joomla! site: Infected with malware? JavaScript injection?

Please help us with this NGO site running Joomla! 1.5. They can't pay a security professional right now, so maybe you guys can help isolate the problem? If you go to http://casatrespatios.org you ...
12
votes
4answers
795 views

How do I protect myself from clickjacking attacks?

I've seen many friends getting clickjacked on Facebook and similar sites. How does one detect and prevent clickjacking? How should I teach my friends to do the same?