Tagged Questions
2
votes
3answers
124 views
Why is the Samy Worm considered XSS?
Last night I was browsing notable computer attacks and came across the Samy worm, which apparently affected a huge portion of the MySpace network -- over one million users in under 24 hours, according ...
11
votes
3answers
302 views
Cross Site Scripting without special chars
I'm testing a web application and I found a XSS vulnerability. I can break a tag and inject some code to the application but nothing potentialy dangerous for the client.
The application has a filter ...
7
votes
2answers
127 views
Best practices for integrating external javascript?
I'm looking for some standard pieces of advice on how to integrate external JavaScript into a website. For example, on mywebsite.com:
<script ...
2
votes
2answers
82 views
Is it safer to store the XSRF value inside your JavaScript?
To protect yourself against XSRF, you need to have a separate token on a page.
See: Coding Horror: Preventing CSRF and XSRF Attacks, by Jeff Atwood
As the posting suggests, its best to have those ...
10
votes
5answers
481 views
CSRF protection with Session Id
To protect against CSRF, couldn't my page javascript just dynamically insert the session id from the cookie into the body of each HTTP request right before it's sent?
The server would then just ...
3
votes
2answers
125 views
XSS: Parsing Javascript
Reading about DOM based XSS from http://www.webappsec.org/projects/articles/071105.shtml
It illustrates some examples like:
...
0
votes
1answer
314 views
Security Testing AngularJS Web Application
An angularjs application stores user input to local/sessionStorage and retrieves it later to fill the form fields or display that content later. If a javascript is submitted as user input, it gets ...
6
votes
3answers
318 views
Is there a way to bypass Django's XSS escaping with “unicode”?
Django (the Python web framework) escapes output to prevent XSS (Cross Site Scripting) attacks. It replaces ', ", <, >, & with their HTML safe versions.
However this presentation on slide ...
1
vote
1answer
255 views
bypass a regex filtration to perform an xss attack
Does the regex [\w/$!.*-]+$ stop the injection of payloads like :
"><script>alert(4)</script>
" onload="alert(4)"
...
-1
votes
1answer
157 views
can someone break my anti dom based xss from the window location? [closed]
can someone break my anti dom based xss from the window location ?
function parseparameters()
{
var href = window.location.href;
var id = href.indexOf('#');
if (id ...
-1
votes
1answer
116 views
some questions about DOM based XSS [closed]
Is it possible to do a DOM based xss attack with window.location.protocol?
How can we use dom based xss with document.title?
How can we bypass the escape javascript function if it is used?
thank ...
0
votes
1answer
262 views
Sanitizing JavaScript to prevent XSS
I'm going through a vulnerability remediation exercise for a client and am trying to figure out how to best mitigate this particular hole. There's a script on our site that calls up content into a new ...
1
vote
2answers
203 views
Can XSS vulnerabilities present in 3rd party js libraries be used to attack the app that uses the lib?
I am using various 3rd party libs like cordova.js, jquery, jquery mobile, mobilizer and so on, in a an android mobile app.. These libs are found to have various XSS vectors through insecure use of ...
3
votes
1answer
1k views
DOM Based XSS attacks: what is the most dangerous example?
I knew that XSS attacks (“non-persistent” and “persistent”) can hijack user session, deface websites, conduct phishing attack, etc.
However, I can't understand what is dangerous of DOM Based XSS if ...
2
votes
1answer
124 views
Newline XSS vulnerability
So I was experimenting with XSS using new line (%0A) character.
So I got to the usual vector: '%0Aalert(/xss/)//
and one thing came to my mind. What if you can't insert a quote?
A new line will break ...
2
votes
2answers
338 views
Is XSS possible here? Challenge
Is possible to bypass my regex and execute any javascript?
<script>
function json(a){
if (/^\s*$/.test(a) ? 0 : /^[\],:{}\s\u2028\u2029]*$/.test(a.replace(/\\["\\\/bfnrtu]/g, ...
1
vote
2answers
659 views
What does scorecardsresearch.com/beacon.js - added by Disqus.com - do?
I recently added Disqus to my site. Looking at the "scripts" tab on Firebug, I noticed a script called, http://scorecardresearch.com/beacon.js (here is a prettified version - the script is not ...
4
votes
4answers
261 views
Is it possible to make an xss with only html tags
I'm not aware of all the xss tricks..
While programming in Ruby on Rails, using a sanitize method to allow only certain tags and it makes its best to clear all the other tags and scripts
the ...
1
vote
2answers
198 views
I need explanation on how serious these vulnerabilities are?
I have found two vulnerabilities on my college site and I want to report them but don't know if these are "really" vulnerabilities :
RFI inside SWF file.
Example: ...
0
votes
1answer
394 views
How to escape user input in a value of javascript object?
How to properly escape user-controlled input when it's inserted as a value in JSON object?
<script>
$(document).ready(function() {
new MyObject({
key1: "user_input",
key2: ...
1
vote
1answer
396 views
scanning my site for JavaScript/XSS vulnerabilities
It have had a report that my site may have a security issue and there is some JavaScript loading 10 times per second.
www.ayrshireminis.com
Is there anyway that I can "scan" my site to check if ...
1
vote
2answers
131 views
Why ban XSS instead of flagging it?
Consider a browser that allows an XMLHttpRequest downloaded from foo.net to make requests to bar.net, but attaches a XHR-Origin: http://foo.net (or possibly a more descriptive value like ...
3
votes
2answers
308 views
Are sandboxes overrated?
I've stumbled upon the following on the blog of the NoScript developer Giorgio Maone.
First, he quotes the following ArsTechnica article about an XSS bug in Adobe Flash:
As useful as sandboxes ...
2
votes
3answers
228 views
sanitizing likes/unlikes in application?
I've got a function in my app where users can click on a "thumbs up" image and a like is recorded in the database; all that's recorded is the user's ID and the ID of the post that the user liked.
I ...
2
votes
1answer
542 views
javascript:alert(“test”); command does not work
Hello! As I have done before and also have read in many web sites, that just simply writing:
javascript:alert(document.cookie);
should work on any web page.
But now, I was not able to execute it. I ...
1
vote
2answers
3k views
Best Approach for removing XSS Vulnerability
I have been developing a Webobjects application, and I found that my application is vulnerable to XSS through URL, but not when malicious input like <script>alert("hi")</script> is input ...
2
votes
2answers
490 views
Removing Google Analytics cookie string from URL - security hole?
On our site, we use google analytics and we have to put the GA cookie in the URL since we have a two letter domain and IE imposes some cookie limitations on those. This means that when going between ...
5
votes
1answer
2k views
Is this jQuery ajax call vulnerable to XSS?
If somebody can edit $("#field").val(), can they change the url property here to point to another location?
$.ajax({
url: "http://mywebsite/script?param=" + $("#field").val(),
dataType: "jsonp",
...
7
votes
3answers
582 views
How bad is a Self Contained XSS attack?
Some of you might be familiar with this attack called Self Contained XSS. I recently stumbled upon this article about it. So how bad this kind of attack can be, even though this doesn't have access to ...
0
votes
2answers
308 views
DOM XSS : Need Help
I was trying my hands at DOM based XSS. I came across a scenario where user controlled string from the URL is included in javascript as below
var userControlled=substring of URL;
...
8
votes
1answer
601 views
Closing an HTML element without using literal slashes?
I'm investigating a vulnerability in an application that echoes a user-supplied filename without sanitizing the filename.
E.g. a file named test-<script>alert("evil");.txt will result in that ...
6
votes
3answers
544 views
How serious are XSS attacks
A website I visit allows this kind of attack, to be implemented with GET in the URL
<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
Along with many others on this page: ...
20
votes
2answers
1k views
JavaScript written only with brackets?
I once saw JavaScript code which was only written as multiple brackets (). Does anybody remember this kind of code? There was also an online converter to convert "normal" JS into this style of code. I ...
15
votes
1answer
1k views
Does the practice of blocking an off-site “Referer:” HTTP requests improve website security?
Is there any benefit for a security-paranoid website to disallow HTTP requests that have a Referer: from 3rd party sites?
The pitch is that if such a HTTP request were to come in, then certain XSS ...
3
votes
5answers
260 views
Is it possible to see if a script on a website steals session cookies?
I'm looking as some web analytics solutions, I know it sounds paranoid. but cookie-based web analytics need for you to paste their JavaScript code on your web-site.
I don't like the idea too much of ...
12
votes
5answers
1k views
Solution to allow JavaScript input but prevent XSS
We have a simple Blog system that allows users to input html and JavaScript to build a blog page. I'm aware that allowing javascript open up the door to xss attacks. We do however need to allow users ...
3
votes
2answers
1k views
How to protect from new Javascript Injection technique that doesn't use eval()?
There is a new Javascript injection technique that is generating chatter on the forums mentioned here
Here is the code sample:
String.prototype.code = function(){ return (new Function('with(this) { ...
0
votes
1answer
168 views
Replicating javascript actions from different website (XSS?)
I've got html / javascript code on my site like this:
<a ...
6
votes
4answers
879 views
Escaping JavaScript constants
how can untrusted values be included in a html-page as javascript string constants? Although the case i am asking uses JSF and Rails, I think this is a general problem independent of the server side ...
