The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

learn more… | top users | synonyms

1
vote
2answers
18 views

Send CSRF token to javascript

Suppose I maintain a anti CSRF token at server side in a session How am I supposed to pass the token to client side application if my form generation is going to be dynamic(i.e. form will be created ...
0
votes
0answers
12 views

SCRAM'ish technology/library for replay-safe signing with shared secret

I have a JS File delivered over HTTPS and a randomly generated shared secret (which will expire after a while and be renewed via HTTPS) delivered via HTTPS. Both available on Side A and B of the ...
1
vote
1answer
98 views

Encrypted quiz data in PHP and JS

I'm developing a quiz with which you can win a few cool prizes. Therefore I'm afraid, that someone might try to hack/manipulate it. All participants have to be logged in and the website takes 15 ...
2
votes
2answers
93 views

High level design for secure web application

I'm looking for some advise on designing a secure web app for storing passwords. Why reinvent the wheel? Because I don't trust a 3rd party with all of my passwords. Here are my thoughts: There are ...
-1
votes
0answers
8 views

javaScript, function, priting my name (beginner) [migrated]

Good evening, everyone! I'm new to this site, I'm learning javaScript and I'm still a noob, I got stuck in this and I can't simply understand what's wrong. I have the following instructions: ...
2
votes
1answer
63 views

How is the QSS tag used as payload in an XSS attack?

I have received a report from a client that lists XSS vulnerabilities. The report shows reflected XSS vulnerabilities. In each vulnerability, the payload reflected is a single, unclosed <qss> ...
0
votes
1answer
47 views

Preventing socket.join(“room”) client-side, listening for private room leaving

i'm developing an application with Socket.IO that needs to authenticate if user can join a room. Client side: var socket = io('http://<?php echo $_SERVER['HTTP_HOST'];?>:3000'); ...
2
votes
2answers
50 views

Security of Firefox extensions such as Mailvelope

I am asking these question because I am not very familiar with javascript or the Firefox plugin/extension system. The specific context is the Mailvelope pgp extension but the questions are general and ...
2
votes
1answer
37 views

Spoofing of Server Sent Events

In the spec for Server Sent Events, it says Authors should check the origin attribute to ensure that messages are only accepted from domains that they expect to receive messages from. Otherwise, ...
-1
votes
2answers
86 views

Is JavaScript console vulnerable to XSS

Assume the content of the name variable below is controlled by an attacker. Is this line of code vulnerable to XSS? console.log(name) When I send an injection in name variable I see its value ...
4
votes
1answer
70 views

Suspecious js file sent as email attachment

I received a js file with following code in my spam folder but I decided to take a look into the file. Do anybody of you know what does this code might do? var evl='';function nr() { evl = '}; ' + ...
5
votes
1answer
265 views

Exploit SoakSoak injected in Wordpress

I have recently received an attack to my website and Google is warning visitors to not load the page. The malware is located in wp-includes/js/swfobject.js of my Wordpress and I had deleted it but ...
4
votes
1answer
86 views

Should I be worried about this url request I received on my site?

I was checking the weekend logs of my IIS server and noticed a strange request which was blocked: ...
48
votes
6answers
5k views

Does injecting querystring values directly into HTML pose a security risk?

Someone reported a bug on my site that I don't really consider an issue. My site has an URL akin to this: www.site.com/ajax/ads.asp?callback=[text injection] So filetype is application/json, and I ...
0
votes
2answers
98 views

How can this web server be compromised?

A linux server has Node.js installed with the http-server package. The server will respond to requests on port 80 with a file in the same directory named index.html. An interesting characteristic of ...
0
votes
1answer
54 views

Verify CDN javascript's integrity

CDNs speed up the loading of websites by allowing caching for frequently used javascript libraries like jquery. How do we know if they have modified the javascript before serving it to my clients? ...
1
vote
2answers
55 views

What's the best way to secure the responses in a single page web app after logout?

I've read some of the great responses to storing and passing session keys in a single page web application (i.e., a web "site" that runs mostly on the client-side, getting data from the server by ...
2
votes
2answers
97 views

is it sufficient to convert '(single-quote) to ` &#039; `

Is it sufficient to convert ' to &#039; , > converted to &gt; and < converted to &lt; to avoid xss A bit of context: the payload would be going through the URL and landing in a ...
1
vote
1answer
89 views

Attack using weird characters followed by some javascript in a URL?

I'm seeing a very weird attack this morning from a pile of VPS instances spread out across the US. The URLs look like this: /js/bundles/,!0):this.element.propAttr( ...
2
votes
5answers
243 views

Is converting `<` to `&lt;` sufficient to prevent execution of JavaScript from arbitrary HTML?

This is kind of a bar-bet question. An acquaintance of mine has made the claim that, given an arbitrary glob of HTML, it can be completely prevented from executing JavaScript if, before slapping it ...
16
votes
2answers
2k views

Can JavaScript be used to capture the user's screen?

Can JavaScript be used to capture the user’s screen? If so, is this functionality available in any JS framework? (I do not need code examples: I am mainly asking to form an opinion about the security ...
0
votes
2answers
124 views

What's the best way to authenticate an user using a websocket?

I'm creating a multiplayer game(based in websockets) which runs directly from the browser and which has multiplayer functionality. Each player needs to have his own account(Username and password). ...
1
vote
1answer
129 views

What are the security risks associated with PDF files?

What are the security risks associated with PDF files? There is, of course, the general risk associated with any type of file: that whatever application is used to read it will have a bug that can be ...
6
votes
2answers
558 views

Cordova/Phonegap: RefreshToken in localstorage

I am (partly) following a tutorial to develop a cordova app, based on angularJS. The author stores the refresh token in local storage, which was said to be very bad practice in one of the comments on ...
0
votes
2answers
318 views

bot detection via browser fingerprinting

I've recently noticed that a few companies have begun to offer bot and scraping protection services based on the idea of browser fingerprinting to detect them, and then blocking the specific ...
1
vote
1answer
104 views

Is it dangerous to allow clients to run JavaScript on a Server

On a webpage I have been working on, we can archive certain webpages for a user. The user can give an address and this webpage is than visited on the server and archived. Lately, I noticed that ...
3
votes
2answers
45 views

Why browsers implement stricter policy for local files

I have a problem viewing HTML/JS/CSS files generated on disk. Specifically, several calls in javascript are blocked by Google Chrome. I googled and found an answer here: ...
0
votes
1answer
51 views

What are the major threats involved in storing the session identifiers in local storage instead of cookies?

I want to know the major security threats involved in storing the session variables in client side local storage, instead of storing it in the cookies. Can somebody give me a brief description?
1
vote
1answer
42 views

Javascript file detection

One common technique I use is xor bruteforcing on binary data. In this case, I would like a heuristic approach to determine whether or not any possible candidate plaintexts are javascript. This rules ...
0
votes
1answer
157 views

extracting JSESSIONID from document.cookie

I was trying cookie stealing on a java and spring based web application. Normally, a cookie can be obtained through <script>alert(document.cookie)</script>, but in the above code, cookie ...
3
votes
1answer
69 views

Is it any more secure to use a HTML form instead of a javascript popup?

Assuming both use session authentication, token validation and forced https: Is there any difference in security between submitting data via a JS popup <> ajax endpoint, and a standard web page ...
0
votes
1answer
102 views

Malicious JavaScript — Troj/JSRedir — Gumblar

I have a client with a website receiving AV warnings from Microsoft Security Essentials. A further investigation revealed that the site is blacklisted by Yandex.com, due to a report that the site ...
9
votes
4answers
1k views

My ISP is injecting strange codes to every website I visit

Here's the code at the bottom of every page: <script type="text/javascript">if(self==top){var idc_glo_url = (location.protocol=="https:" ? "https://" : "http://");var idc_glo_r = ...
7
votes
1answer
55 views

Unlock codes for a mobile app

This is for an Android (via Cordova/Phonegap) game project. My goal is to be able to provide a "promo code" that will allow anyone to unlock the game for free, but I want to limit each code to only ...
1
vote
2answers
92 views

Do browser add-ons increase security risk due to possible vulnerabilities

A large amount of people use add-ons such as NoScript or AdBlock to avoid exploitation by malicious JavaScript from advertisments. This decreases the risk of becoming the victim of web-exploits. But ...
0
votes
2answers
68 views

Detect Different Machine using Browser [closed]

Some web apps like Facebook and Gmail detect the first time we try to login from a device. Assuming that a browser can't read machine name, and MAC ADDRESS. What kind of variables are they collecting ...
8
votes
4answers
604 views

Session Hijacked in case javascript blocked [closed]

If I blocked Javascript to be executed. Then what are the ways by which XSS can occur and what are possible threats in case of intranet application.
0
votes
1answer
78 views

Techniques for bypassing zero length check in javascript?

I am working on a node.js application that allows users to sign up for accounts using social media. When they do this an entry is created in our database with their email address, and a blank ...
2
votes
1answer
92 views

XSS: alert() not executed on different OS/computer

I've encountered a strange behavior while I was performing a security audit of a web application. Some user controlled inputs were displaying their values, unencoded, into the page that processed the ...
1
vote
1answer
113 views

If CORS is set to * your browser can't read the response if cookies are sent over. Why is the wildcard considered insecure? [duplicate]

If this header is set Access-Control-Allow-Origin: * javascript can make a request to the domain and read the response if and only if no cookies are sent over, otherwise the javascript cannot read ...
15
votes
3answers
5k views

What does this javascript file do? Is this a virus?

While searching on Google I found a website that shows one set of content to the Google Bot and an other to users (by redirecting to a new domain), and also a very suspicious Javascript file. Maybe ...
2
votes
1answer
126 views

encodeURIComponent in a unquoted HTML attribute

My gut feeling is that the following should be attackable: $("<td><a href=somefile.php?url="+encodeURIComponent(somevar)+">Download Here</a></td>"); In contrast to ...
4
votes
2answers
216 views

How can document.referrer be used for XSS?

A very simple example... <div id="cat"></div> <script> document.getElementById("cat").innerHTML = document.referrer; </script> or <script src="' + document.referrer + ...
0
votes
0answers
43 views

securing my API: concept of accesstokens

first of all I want to excuse for the bad spelling and grammar. English is not my mothertongue. I have built a JSON communication between frontend(website) and my NodeJS webserver. I want to keep in ...
2
votes
1answer
157 views

How does this website prevent directing away from it

I'm using the latest version of Firefox with Ghostery and Adblock plus installed. This website somehow prevents navigation away from it. How does it do this and how can it be protected against? I ...
1
vote
1answer
133 views

Can location.pathname lead to XSS?

<div id="cat"></div> <script> $("#cat").html(location.pathname); </script> I think that example would work, but anyway, if location.pathname has to be a valid page, can this ...
11
votes
2answers
2k views

Where do I find JavaScript malware?

I am looking for JavaScript malware. I need it just for local tests on my computer for a project I am working on. Are there any Internet resources where I could find this?
9
votes
1answer
509 views

XSS Technique - & JavaScript Include

I was looking through the OWASP XSS Filter Evasion Cheat Sheet, and there was one technique that was completely new to me: & JavaScript includes <BR SIZE="&{alert('XSS')}"> I ...
1
vote
1answer
119 views

Could I XSS a page that filters &,",< and > characters and has Content-Type set to UTF-8?

I am trying to pentest a dummy website that has a form with a TEXTAREA input on one page. When the form is submitted, the contents of the form are displayed on a second page. However, the second page ...
0
votes
2answers
163 views

Apache Server Maintains HTTPS Connection To Mysterious Server (Hijacking?)

I've been on a shared webhosting plan for 10 years and I recently moved all of my sites (various WordPress sites and associated plugins, all in PHP, a MediaWiki site, and a lot of static stuff) to my ...