The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

learn more… | top users | synonyms

9
votes
1answer
590 views

XSS Technique - & JavaScript Include

I was looking through the OWASP XSS Filter Evasion Cheat Sheet, and there was one technique that was completely new to me: & JavaScript includes <BR SIZE="&{alert('XSS')}"> I ...
9
votes
3answers
255 views

Are bookmarklets safe with facebook data?

I usually play mafia wars and use bookmarklet like Spockholm, Arum, etc. Can these bookmarklet get my facebook data when I run them, they usually ask to unframe the facebook page. I was just ...
9
votes
4answers
2k views

My ISP is injecting strange codes to every website I visit

Here's the code at the bottom of every page: <script type="text/javascript">if(self==top){var idc_glo_url = (location.protocol=="https:" ? "https://" : "http://");var idc_glo_r = ...
9
votes
4answers
2k views

Why disable JavaScript in Tor? [duplicate]

Why it is not advisable to use JavaScript with Tor? Yet with JavaScript, you cannot get the IP address of the user except through an external website. How could using JavaScript with Tor expose one's ...
9
votes
3answers
1k views

localStorage for apps over https. What expectations are there?

I run an online gradebook. To keep student data private, I transfer all data over https. Now, I'd like to use localStorage to avoid redundant calculations and server requests. However, according to ...
9
votes
2answers
687 views

User-specific Subdomains : JavaScript security

If I provide a public-facing website for users on my website at their own subdomain (e.g. bob.myapp.com) under their own control, can I allow them to execute arbitrary JavaScript without putting my ...
9
votes
2answers
2k views

Cordova/Phonegap: RefreshToken in localstorage

I am (partly) following a tutorial to develop a cordova app, based on angularJS. The author stores the refresh token in local storage, which was said to be very bad practice in one of the comments on ...
8
votes
4answers
690 views

Session Hijacked in case javascript blocked [closed]

If I blocked Javascript to be executed. Then what are the ways by which XSS can occur and what are possible threats in case of intranet application.
8
votes
3answers
2k views

How bad is a Self Contained XSS attack?

Some of you might be familiar with this attack called Self Contained XSS. I recently stumbled upon this article about it. So how bad this kind of attack can be, even though this doesn't have access to ...
8
votes
3answers
214 views

Preventing user supplied javascript from posting to external server

I am writing an internal tool that will support plugins written by other developers. Ideally, these plugins would have a Javascript component to allow people to make widgets. Some of the pages these ...
8
votes
5answers
361 views

Is it a risk to highlight text while reading a webpage?

Whenever a user selects or highlights text on a webpage, an OnClick() event is generated. Some of the web browser security models depends on explicit end user interaction, such as OnClick(), before a ...
8
votes
1answer
5k views

Iframe javascript Keylogger

Is it possible for a website to have a javascript keylogger and also contain an iframe that goes to a "client" site. Can the the JS log all key strokes done on the client site? Can the (host) iframe ...
7
votes
5answers
10k views

Hiding JavaScript source code

In a web-app should one strive to hide as much of the code as possible, for example from view source? In particular I was wondering should JavaScript be hidden, especially ones used for Ajax? I was ...
7
votes
3answers
1k views

How serious are XSS attacks

A website I visit allows this kind of attack, to be implemented with GET in the URL <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT> Along with many others on this page: ...
7
votes
4answers
2k views

Escaping JavaScript constants

how can untrusted values be included in a html-page as javascript string constants? Although the case i am asking uses JSF and Rails, I think this is a general problem independent of the server side ...
7
votes
5answers
24k views

Playing with Referrer Header

There are 2 sites: http://www.site1.com http://www.site2.com http://www.site1.com contains link to http://www.site2.com as <a href="http://www.site2.com/">link<a/> When user clicks ...
7
votes
4answers
856 views

Security attacks on PHP web applications

I know about following security attacks on php applications (html,php,js). XSS SQL Injection CSFR Session Hijacking /Fixation Code Injection Remote file injection Should i know about any other or ...
7
votes
1answer
2k views

What possible use does an iFrame have for security?

I'm looking at code for an old login form I'm redesigning. It's a simple table with two input fields for username and password. But just before the end </table> tag there's a blank iFrame which ...
7
votes
2answers
18k views

Javascript and jQuery not secure over https

I am building an ASP.NET MVC 3 app which will run in Azure. Everything was working well, until I switched to https. Now most of my jQuery plugins and some other javascript are not secure. I'm using ...
7
votes
1answer
121 views

Javascript phishing attack sucker: Do I need to be worried? [closed]

So, I'm an idiot. I opened a javascript phishing attack file. I would really, really appreciate some help with decoding the Javascript to figure out whether I'm in trouble, and what sort. I'm on OS X ...
7
votes
1answer
756 views

Access to other local files from a local HTML file

I tried this question on programmers site with no luck Do you see any reason to block a local html file from accessing another local files located in the same folder? I mean, if a user downloaded an ...
7
votes
4answers
298 views

Limited JavaScript app scenario: Attack vectors and mitigation

I'm going to be developing a single page JavaScript app which allows input via a textarea. This input is never sent to the server, never shown to another user, and will only be persisted in browser ...
7
votes
2answers
605 views

Best practices for integrating external javascript?

I'm looking for some standard pieces of advice on how to integrate external JavaScript into a website. For example, on mywebsite.com: <script ...
7
votes
1answer
74 views

Unlock codes for a mobile app

This is for an Android (via Cordova/Phonegap) game project. My goal is to be able to provide a "promo code" that will allow anyone to unlock the game for free, but I want to limit each code to only ...
7
votes
1answer
689 views

Child iFrame hash verification of parent iFrame content

Consider the following scenario: Alice wishes to browse Victor's website while on the job at Initech. Victor's website is hosted on an alternative domain name system to which Initech's DNS does not ...
6
votes
3answers
1k views

What's wrong with my own authentication scheme?

So I want to write my own authentication scheme for a web-app server, as follows. I assume this is a Bad Idea from either security or cost-effectiveness reasons and I know the conventional wisdom is ...
6
votes
5answers
7k views

Obfuscating JavaScript code

Some Flash developers are afraid of JavaScript. Their point of view: Stealing JS source code is effortless, one would just 'view source' and copy it. Yes, you can decompile Flash bytecode, however it ...
6
votes
3answers
989 views

How secure are self decrypting HTML files for data storage?

I recently came across a JavaScript self decrypting archive. Is it secure enough to be used as a portable password storage tool? The author has even challenged it to be cracked.
6
votes
3answers
9k views

Secure jquery ajax calls from a non secure page

I could not find a clear answer, but if I have the following situation: I browse to a page let's say http://www.example.com/index.html Now I use a form on this page to do a postback with jquery's ...
6
votes
3answers
1k views

What authentication system (OpenID, Facebook, etc) permits Javascript-free and/or Cookie-Free operation?

I'm looking for an authentication system that relies on 3rd parties (ADFS, OpenID, SAML) but doesn't rely on cookies or Javascript... or at least can make them optional. My intent is to gracefully ...
6
votes
4answers
486 views

Is flash or javascript a bigger security concern?

Many flash website whitelisting extensions for chrome (such as flashblock and flashcontrol) use javascript in order to selectively block Adobe Flash from functioning. Thus, In order to get this ...
6
votes
3answers
523 views

Are there any tools to detect JavaScript-based WCF/AJAX calls?

I'd like to determine if a given JavaScript contains the logic to make a AJAX/WCF call, or determine if one is being executed at runtime. Does anything like this exist?
6
votes
3answers
459 views

Favicon Redirection Possible Security Flaw

I have the domain example.com When I enter the URL https://api.example.com, Chrome loads the page and also tries to load https://myapp.example.com/favicon.ico, and that request receives a 301 ...
5
votes
4answers
883 views

Client side encryption - only web browser available

I am creating an enterprise application, the server side runs a whole set of different apps, On the client side, there is only a webpage, no applet or anything else. Unfortunately data created by the ...
5
votes
1answer
5k views

Is this jQuery ajax call vulnerable to XSS?

If somebody can edit $("#field").val(), can they change the url property here to point to another location? $.ajax({ url: "http://mywebsite/script?param=" + $("#field").val(), dataType: "jsonp", ...
5
votes
3answers
460 views

Are CSRF Attacks Really Blind

I'm new to CSRF attacks but don't see how they are always blind. Let's say we are dealing with a site where the asset we need to protect is the HTTP response. Something like one's medical history. ...
5
votes
2answers
1k views

Web & insecure HTTP - Using RSA for encrypting passwords on the client side

I used client side password hashing in my register and login project. Its purpose is to prevent passive adversaries/eavesdroppers from discovering users' plaintext passwords when HTTP requests are in ...
5
votes
2answers
1k views

Is a JavaScript implementation of AES any less secure than other language implementations?

There are a few JavaScript AES implementations available such as Gibberish-aes So assuming the AES algorithm has been implemented correctly in this library then it should be as secure as any other ...
5
votes
2answers
1k views

Is it possible to create a secure chat web application relying on HTML5 web sockets?

Is it possible to create a secure chat web application using just HTML5 and Javascript? What possible security holes would there be if the server doesn't store the messages, just relay them using ...
5
votes
4answers
691 views

Is JavaScript self-injection dangerous?

I have a toy web application that can be described roughly as a per-user key-value store. After logging in, the user can view and modify her set of key-value pairs. The keys and values are stored in a ...
5
votes
2answers
8k views

DOM Based XSS attacks: what is the most dangerous example?

I knew that XSS attacks (“non-persistent” and “persistent”) can hijack user session, deface websites, conduct phishing attack, etc. However, I can't understand what is dangerous of DOM Based XSS if ...
5
votes
3answers
615 views

What are NoScript surrogates and should one disable them for more privacy in browsing?

NoScript has a feature of supplying its own "surrogate" scripts instead of well-known tracking/ad scripts (Google Analytics, for one). Does it matter for my privacy if I do not change the factory ...
5
votes
2answers
2k views

Risks of client-side encryption using Stanford Crypto Library

I'm building a simple web application for encrypted chat. Each message will undergo 256-bit AES encryption on the client side, using the Stanford Javascript Crypto Library. No unencrypted data or ...
5
votes
2answers
165 views

User entered Javascript security implications

I'm creating a web site that lets people create their own site using a subdomain. Are there any security implications by letting people add custom javascript to their pages? If so, which ones? XSS? ...
5
votes
3answers
5k views

Javascript Malware: How does it work, and how can it be mitigated?

I am wondering how malware gets served through Javascript. I've noticed a few illegitimate pop-ups while visiting some financial websites. I wonder how malware exploits work against the application ...
5
votes
1answer
147 views

Is it safe to allow untrusted field names in JSON?

When forming a JSON data structure, are there any security risks with allowing the field names to be chosen by an attacker? You can assume they'll be quoted properly. I'd like to know if allowing ...
5
votes
2answers
140 views

Protection against synthetic queries

Note: One, I am not sure if synthetic queries is right word for the risk I am talking about. Second, though I am considering 3-tier model of web-applications general answers are welcome in ...
5
votes
2answers
657 views

How to ensure that files uploaded by users do not contain any XSS code

I have been working on providing the security related to the XSS attacks. My website only allows following mime-types: XML, CSV, HTML, PLAIN, VND_WAP_WML, APPLICATION_ZIP, APPLICATION_PDF, ...
5
votes
1answer
429 views

Using javascript, is it possible to iterate through all cookies saved in the user browser and send them to me?

Again, I am new to the programming and security world. I should mention that it is just a theoretical question so I can anticipate this kind of attack. Using javascript, is it possible to iterate ...
5
votes
4answers
334 views

XSS using JSF**k

I was reading about JSf**k. From their website: JSF**k is an esoteric and educational programming style based on the atomic parts of JavaScript. It uses only six different characters to write and ...