Tagged Questions

0
votes
1answer
115 views

Stopping js malware injection on our Wordpress site

This had been added to our wordpress site, specifically in the footer.php. hxxp://pkktjuchlrv.peguards.cc/02b31ac5iq/get.js It is malware as defined by google, i belive it is tracking code. We have ...
12
votes
2answers
1k views

What does this injected code do?

One of my sites has just been hacked as this code has been inserted into random(?) files and places within the files. Does anyone understand what it is trying to do? I would welcome anything that may ...
0
votes
1answer
203 views

Sanitizing JavaScript to prevent XSS

I'm going through a vulnerability remediation exercise for a client and am trying to figure out how to best mitigate this particular hole. There's a script on our site that calls up content into a new ...
3
votes
1answer
1k views

DOM Based XSS attacks: what is the most dangerous example?

I knew that XSS attacks (“non-persistent” and “persistent”) can hijack user session, deface websites, conduct phishing attack, etc. However, I can't understand what is dangerous of DOM Based XSS if ...
0
votes
1answer
529 views

“pagesinxt.com” links in the sourcecode, am I being hacked?

At this moment I am being hacked and I do not know to stop it. Let me explain... My website is hosted in a VPS where I am the only person who has access to it. The page is builtwith ...
3
votes
4answers
254 views

javascript self-injection: is it dangerous?

I have a toy web app that can be described roughly as a per-user key-value store. After logging in, the user can view and modify her set of key-value pairs. The keys and values are stored in a DB on ...
3
votes
2answers
237 views

Can a whitespace regex character be used to perform a javascript injection?

if I want to validate the input of a <textarea>, and want it to contain, for example, only numerical values, but even want to give users the possibility to insert new lines, I can selected ...
15
votes
2answers
347 views

What risks should I be aware of before allowing advertisements being placed on my website?

The thought of having a 3rd party send javascript, and images to end users seems to be a scary thought, but that is exactly what we are doing when I place advertisements onto my site. Does serving ...
2
votes
2answers
360 views

Is it possible to take down a site using javascript in the URL bar?

If a site is written poorly enough, is it possible to take it down or severely mess with it using only javascript in the URL bar?