The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.
3
votes
1answer
240 views
Is this code harmful? Why?
Code: http://pastebin.com/kJ8ZGP82
That code gets retrived from http://ui.sidepage.co for every HTTP page I visit (not HTTPS) and load it into the body tag of the page.
Is it harmful in any way? ...
-1
votes
1answer
159 views
how to secure my login user id and passwords specially for facebook [closed]
i think they hack me with facebook cookies.
i dont get what exactly is going on with me. every time i get the login notification from another ip location.i want to secure my cookies and i wanted to ...
1
vote
2answers
340 views
HTTP Response Splitting
Is this apart of a HTTP Response Splitting attack ? Here below is some code that gets put into a web browser after clearing the url while on the website
javascript: var xhr = new XMLHttpRequest(); ...
3
votes
4answers
88 views
What is the technique to determine if a user is “reading” a page called? (similar to “infinite scroll”)
When I read an article at Salon.com I notice that the "overflow content" (where I need to scroll down) is loaded on demand. I can't imagine this being a useful bandwidth savings technique, so the ...
0
votes
2answers
146 views
Is a browser with disabled scripts and disabled java enough against malware
Is a browser like Firefox with disabled scripts (for example via a plugin like no-script) and disabled java enough to be protected against dryve-by-malware from the internet.
Of course this does not ...
-1
votes
1answer
111 views
Idea feedback wanted - easy and secure web notes manager (javascript) [closed]
I have an idea for a web app that I'd like to discuss. I like it a lot but chances are that I missed some evident security hole. Or, maybe it just sucks.
The idea is a web-based secure text notes ...
1
vote
2answers
104 views
Should the Keygen element be used to create a certificate for mutual auth TLS? What alternatives are there?
I'm interested in using mutual auth TLS to improve the security of my javascript based webservices . I've looked at the Keygen element and given all its issues, not sure if this can even be used for ...
1
vote
4answers
958 views
Playing with Referrer Header
There are 2 sites:
http://www.site1.com
http://www.site2.com
http://www.site1.com contains link to http://www.site2.com as
<a href="http://www.site2.com/">link<a/>
When user clicks ...
1
vote
1answer
85 views
How does window.w3ssss hack occur
Recently a .Net MVC 2 application on our server was infected with a virus / hack, it added some Javascript to the index.aspx pages of the site.
While we have cleaned it up, I have not been able to ...
1
vote
2answers
113 views
How do I holistically protect a web service from network and MITM attacks?
I have several financial web services that are accessed over HTTPS, however the client devices may be accessing the web services over untrusted WiFi, through questionable proxies, and possibly ToR ...
1
vote
2answers
549 views
What does scorecardsresearch.com/beacon.js - added by Disqus.com - do?
I recently added Disqus to my site. Looking at the "scripts" tab on Firebug, I noticed a script called, http://scorecardresearch.com/beacon.js (here is a prettified version - the script is not ...
10
votes
1answer
369 views
How can I embed iframe securely without restricting its functionality?
I'd want to embed an iframe from untrusted site into web application. Iframe:
should be able to run Javascript and browser plugins (Flash, etc.)
should not be able to access my web application ...
8
votes
2answers
125 views
Preventing user supplied javascript from posting to external server
I am writing an internal tool that will support plugins written by other developers. Ideally, these plugins would have a Javascript component to allow people to make widgets. Some of the pages these ...
4
votes
2answers
119 views
Can webpages recognize that I saved my password?
If you save your logins in Firefox, username and password are auto-filled-in in corresponding webpages as soon as you visit them (if you have more than 1 account saved, you'd have to select a username ...
3
votes
0answers
59 views
Is the use of JavaScript for cryptography ever appropriate in the browser? [duplicate]
Possible Duplicate:
How secure is aSSL (javascript)? Does it effectively mimic SSL?
After some searching around, I realized we don't have an easily visible canonical question about this on ...
3
votes
1answer
106 views
How can I use certificates to secure my webservices? What is available to javascript?
I have a few web services that are accessed over public wifi connections and I think it would be a good idea to issue certificates to encrypt data, prevent MITM, and invalid impersonation (beyond what ...
1
vote
4answers
292 views
Are malicious scripts in batch files detected by antiviruses?
we have many scripts in shared folders in our IT Department.
Are malicious scripts in batch files detected by antiviruses?
4
votes
4answers
244 views
Is it possible to make an xss with only html tags
I'm not aware of all the xss tricks..
While programming in Ruby on Rails, using a sanitize method to allow only certain tags and it makes its best to clear all the other tags and scripts
the ...
1
vote
2answers
191 views
I need explanation on how serious these vulnerabilities are?
I have found two vulnerabilities on my college site and I want to report them but don't know if these are "really" vulnerabilities :
RFI inside SWF file.
Example: ...
12
votes
3answers
465 views
How secure is aSSL (javascript)? Does it effectively mimic SSL?
Some of you may be familiar with the aSSL project, which uses AJAX/PHP to mimic the SSL protocol. It uses RSA 512 or 1024 for the keys, and AES for the actual data. It looks impressive to me in ...
0
votes
0answers
116 views
Encryption in Messaging/RAbbitMQ/SOA [closed]
I'm a student and now 2nd time poster, please excuse any lacking detail on my part.
For my exams I'm doing a cross-platorm application using RabbitMQ for messaging. It'll serve as POC for both SOA ...
3
votes
4answers
257 views
javascript self-injection: is it dangerous?
I have a toy web app that can be described roughly as a per-user key-value store. After logging in, the user can view and modify her set of key-value pairs. The keys and values are stored in a DB on ...
3
votes
2answers
242 views
Can a whitespace regex character be used to perform a javascript injection?
if I want to validate the input of a <textarea>, and want it to contain, for example, only numerical values, but even want to give users the possibility to insert new lines, I can selected ...
0
votes
0answers
54 views
open source web development plugins,scripts store information? [closed]
I'm wondering if open source plugins like wordpress,drupal or jquery and many more detect for example what websites are using their plugin.
If so, is there any plugin which can detect which website ...
5
votes
1answer
142 views
Cufon or Prototype as an attack vector for Blackhole exploit kit?
I've been asked to look into the security of a client site that's apparently throwing antiviral messages when visited.
Specifics:
It's being detected as a Blackhole exploit kit inside of a Cufon ...
0
votes
1answer
376 views
How to escape user input in a value of javascript object?
How to properly escape user-controlled input when it's inserted as a value in JSON object?
<script>
$(document).ready(function() {
new MyObject({
key1: "user_input",
key2: ...
5
votes
1answer
1k views
Iframe javascript Keylogger
Is it possible for a website to have a javascript keylogger and also contain an iframe that goes to a "client" site.
Can the the JS log all key strokes done on the client site?
Can the (host) iframe ...
7
votes
4answers
160 views
Limited JavaScript app scenario: Attack vectors and mitigation
I'm going to be developing a single page JavaScript app which allows input via a textarea. This input is never sent to the server, never shown to another user, and will only be persisted in browser ...
7
votes
3answers
576 views
How to validate if a JavaScript library is secure?
I'm the main developer for an Open Source JavaScript library. That library is used in the company I work for, for several clients. Every now and then there is a client that feels paranoid about ...
8
votes
2answers
187 views
User-specific Subdomains : JavaScript security
If I provide a public-facing website for users on my website at their own subdomain (e.g. bob.myapp.com) under their own control, can I allow them to execute arbitrary JavaScript without putting my ...
-1
votes
4answers
132 views
How secure is this login page? [closed]
Unfortunately I cant link to the page (it internal). But I can describe it!
This is a lightspeed systems policy enforcement login page (content filter).
The page is http and there is no iframe with ...
2
votes
3answers
1k views
Javascript Malware: How does it work, and how can it be mitigated?
I am wondering how malware gets served through Javascript. I've noticed a few illegitimate pop-ups while visiting some financial websites. I wonder how malware exploits work against the application ...
1
vote
1answer
437 views
How to prevent the following clickjacking attack?
The Security attribute was implemented to prevent XSS attacks in iFrames by disabling any JS implemented in the iFrame source, therefore indeed eliminating XSS attacks, but also disabling any security ...
7
votes
4answers
663 views
Generate cryptographically strong pseudorandom numbers in Javascript?
Is there any good way to generate cryptographically strong pseudorandom (or true random) numbers in Javascript?
The crucial requirement: if a.com's Javascript generates some random numbers, no one ...
3
votes
2answers
294 views
Implementing brute force attacks on hash values in Javascript
I'm working for my bachelor thesis at the end of which I aim to implement a proof-of-concept Javascript-based hash cracker. The idea is to work like this: Users can submit a hash value along with ...
11
votes
2answers
4k views
Securing a JavaScript Single Page App with RESTful backend
I'm currently in the process of building a JavaScript SPA and have been researching how to secure it. There is currently as RESTful API that is being completely interacted with through AJAX. We also ...
8
votes
5answers
206 views
Is it a risk to highlight text while reading a webpage?
Whenever a user selects or highlights text on a webpage, an OnClick() event is generated. Some of the web browser security models depends on explicit end user interaction, such as OnClick(), before a ...
1
vote
1answer
382 views
scanning my site for JavaScript/XSS vulnerabilities
It have had a report that my site may have a security issue and there is some JavaScript loading 10 times per second.
www.ayrshireminis.com
Is there anyway that I can "scan" my site to check if ...
1
vote
0answers
95 views
What are potential use cases of script that identifies browser? [closed]
Let's say I've found a way to produce a unique string for each and every browser using pure Javascript (which makes it an alternative to UA strings).
Now what I'd like to know is what are potential ...
1
vote
5answers
709 views
Is it secure to use jQuery on the server-side for user input validation?
I'm thinking about using jQuery on the server-side (node.js) to validate user input (filter tags, remove every attributes except href, rel, target & style, modify css rules which are applied ...
3
votes
2answers
466 views
Why do I get AV alerts when browsing a web page?
I'm using the latest version of Firefox and Windows is up to date. When I was browsing a webpage and clicked a link the browser displayed "connection has been reset" and AVAST poped-up saying "Alert!" ...
3
votes
1answer
135 views
Client-side cross-site access in SSL environment - when it's still possible to do?
I'm trying to imagine an secure sandboxed environment for an application which is big and unexplored, and may contain backdoors. It would live under chroot/virtual environment with no outgoing ...
1
vote
2answers
127 views
Why ban XSS instead of flagging it?
Consider a browser that allows an XMLHttpRequest downloaded from foo.net to make requests to bar.net, but attaches a XHR-Origin: http://foo.net (or possibly a more descriptive value like ...
1
vote
1answer
71 views
How to verify that a clientside-generated object is genuine?
I know that general best-practice states not to trust anything generated by the client.
With that in mind, I want to write an HTML5 app that utilises the browser to generate various objects ...
1
vote
2answers
2k views
Encrypting string in javascript and decryption in java
I would like to know if someone know any library to do encryption in javascript and decryption in java. I have already tried many API, But getting not not getting same values in java.
I want ...
1
vote
4answers
632 views
Shall I need to use MD5 algorithm in both JavaScript and PHP for login authentication?
I have a login form with username and password. I post this form data to a PHP file. For security reasons I want to encrypt my password in the database and network. Now I have done now following ...
6
votes
3answers
2k views
How can i find what hashing algorithm was used?
One of my clients has asked me to modify the login page that their board members use to access their materials. The problem here is that the person previously responsible for this has left no ...
0
votes
0answers
237 views
which scanner can detect scripts with malicious javascript on the server? [closed]
We've noticed several security warnings from antivirus software when visiting one of our customer's pages.
Besides other steps to improve security, we now want to scan the server's directories for ...
7
votes
4answers
920 views
Challenging challenge: client-side password hashing and server-side password verification
We have a website where users need to log in to access privileged information. Obviously we are using SSL, but I also want to avoid plaintext passwords from accidently ending up in server logs, or ...
-1
votes
1answer
204 views
Why don't G+, Facebook and Twitter use text editors to share? Why would someone receive each separately? [closed]
I've seen sites use text editors as below:
What is the risk in using these? G+ receives images individually, others receive it all at once. Could someone shed some light on it?
