The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

learn more… | top users | synonyms

4
votes
3answers
222 views

HOW is the malicious URL/payload is delivered to the user on a DOM based XSS attack?

Testing for DOM based XSS at OWASP reads: The first hypothetical example uses the following client side code: <script> document.write("Site is at: " + document.location.href + "."); ...
6
votes
1answer
119 views

Random Oracle in Javascript for password generation and recall

I use a lot of different sites, and my number one security issue is to never reuse a password. As it seems that every company out there like TalkTalk is as leaky as a sieve, I figure that's the right ...
4
votes
2answers
319 views

Stopping webpage compromise by preventing frame-busting

My website offers rich content to users. I often subscribe to third party vendors whose content I embed in my pages. How can I safely embed external domain's content on my webpage in an iframe without ...
1
vote
2answers
96 views

What would typically be considered an acceptable string entropy for passwords?

I have gained interest in creating a way to check password strength (think password strength meters - yes - another one). I've found many ways to award a score on a policy driven approach (one ...
0
votes
0answers
101 views

Adobe Flash-based site's UI misbehaves when it's accessed through a VPN. Is it leaking my real ip address?

Here is a setup: A Linux/Windows VM at home (will call it "hidden VM" from now on) which is placed into an isolated environment (it's located in its own isolated virtual network, and the only way ...
3
votes
1answer
39 views

Solution for Enterprise SW Eng. with Github and NPM [closed]

Can anyone share an architecture or framework that supports the use of Open Source software in enterprise software development environments? I'm seeking solutions to manage and mitigate the risk of ...
1
vote
1answer
181 views

Security of cross-origin XMLHttpRequest Javascript

I am building a Chrome extension that will be making cross origin "get" and "post" requests to a few third party websites. I have been researching this process for hours and I am becoming increasingly ...
2
votes
2answers
99 views

which encryption is used in this JS Variables

Which encryption method is used for these variable names: var g_license_info var g_server_time_obj Respectfully encrypted to: var ago05b4e111efe149737a67a177f00ffad2 var ...
21
votes
4answers
5k views

Suspicious JavaScript in website header

I am not sure if this is the correct place to ask a questions such as this, apologies if it isn't. I have found the below code in the header of one of my wordPress websites, I am pretty sure it is ...
7
votes
2answers
805 views

How does BeEF work and how can it be persistent

BeEF - the browser exploitation framework. I think (thought) I had a basic working understanding of how it works. Recently, though, I was watching, this DEFCON talk, where a hacker used a ...
2
votes
1answer
107 views

Mitigating reflected XSS in node/express requests for static assets

I've asked this on Stack Overflow because it is related to a programming problem (how to mititgate vulnerabilities in code) but I do have some broader questions, and a lack of understanding about how ...
0
votes
0answers
33 views

XSS script syntax problem

I have a server running on port 4444 on localhost that just echoes messages it receives. I have a JS script embedded in a message that is supposed to send the cookies of whoever looks at it. Here ...
2
votes
1answer
196 views

OAuth 2.0 client side redirect instead of HTTP redirect

I'm implementing an OAuth 2.0 authorisation server using the Authorization Code flow (i.e. users will authorise client apps to connect to our server). The auth server is the same as the resource ...
1
vote
2answers
870 views

can web application disable browser's password manager's remember feature for that application?

Is there anything a website code do to prevent any browser from remembering your password? I am aware that from browser's options, users can change setting to ask to remember password or not. But can ...
-1
votes
2answers
228 views

Things to look for a backdoor in web application source code (.PHP, .JS, etc files) [closed]

I am in the process of adding functionality to a web application and I will be receiving some source files (PHP, JS, and CSS) from a hired external developer. These files are not obfuscated or ...
0
votes
0answers
40 views

Widget to client web encryption on an uncontrolled LAN

I asked a broader question related to this on serverfault, but I think probably the specific case I'm thinking of might be best considered here. My basic problem is this: I am providing physical ...
2
votes
1answer
319 views

Hashing user passwords via Javascript client-side versus server-side hashing? [duplicate]

I got into a discussion with one of our senior developers over password hashing/transmission best practices and it left me curious as to what the industry standard best practice is. In the ...
-1
votes
3answers
1k views

Why no support for TCP Sockets in JavaScript [closed]

I know there are now WebSockets, but what is the issue with providing a socket API to allow interacting with existing protocols? I mean, after all, I can use a hidden flash object to do the same ...
2
votes
2answers
1k views

If using htmlentities or htmlspecialchars functions is enough for block XSS attack

I know this question was discussed on net various times. and people give some example how to bypass these functions through passing some code. But here one issue, All example of ...
1
vote
2answers
202 views

CSRF by manipulating HTTP headers from client side using JavaScript

I am trying to do CSRF vulnerability analysis for my website. My website uses an anti-CSRF-token which is sent by the server to the client with the session cookie and then Javascript in the client ...
1
vote
2answers
598 views

With javascript in the browser, how can I sign some data without directly manipulating a private key?

With JavaScript in the browser, I need to digitally sign some data. I'm looking at the new Crypto.Subtle api, specifically the sign() and importKey() methods. I want, very reasonably I feel, to ...
1
vote
2answers
421 views

Is this sanitizer vulnerable to XSS?

To have a simple and secure editor for text fields of a django app, I have this snippet to sanitize input html into django code: from bs4 import BeautifulSoup def sanitize_html(value): ...
2
votes
3answers
530 views

How to spoof my IP address to JavaScript and other security concerns

Many websites require JavaScript. However, enabling JS means that a website can run a JS snippet to retrieve the user's IP address (even if they are behind a proxy or VPN). So, how can I (the user) ...
1
vote
1answer
113 views

Is it possible to get a flash src after a redirect or an element inside an embed/object/iframe tag (cross-domain)?

The URL example.com/auth will automatically redirect the user (HTTP 302) to example.com/signed_in.SWF?token=SENSITIVE. Is it possible for an attacker to steal the token, using javascript or flash, in ...
7
votes
3answers
143 views

Automatic detection of a compromised web server

I'm trying to figure out if it is possible to automatically detect the the fact that the HTML or javascript files on a server have been tampered with or changed by an attacker. Our website, say ...
7
votes
2answers
1k views

Similarities among all/most malicious JavaScript

I'm working on a web app that notifies users on whether or not the JavaScript that they entered is malicious. I'm using this article (Examples of malicious javascript) for reference. Is it possible ...
2
votes
2answers
99 views

Can 3rd party JavaScript libraries access the http headers of the hosting html page

So, I have website, it uses a cookie stored in the http header of the downloaded html document to maintain the session while the end user is logged on and accessing there 'secure' data. This webpage ...
2
votes
0answers
80 views

Do any specific steps need to be taken into account for the user's browser and browser caching for a HIPAA compliant web application?

I'm currently writing a web application that will need to be HIPAA compliant. It is very JavaScript heavy, and ePHI will be sent over an encrypted connection in the form of JSON. The transmission ...
40
votes
4answers
6k views

Have computer criminals been known to exploit easily-edited websites like Wikipedia to embed malicious scripts?

When I was reading a page on Wikipedia several months ago (December 2014) I saw what looked like a pop-up window from BT, but I soon realized that when I closed the page the pop-up disappeared. I then ...
0
votes
1answer
106 views

xmlhttprequest with https - can I test the fingerprint before sending any data

I am making https calls in javascript via xmlhttprequest. I know the server and its public key in advance. For extra security, I would like to check the public key (or its fingerprint) if its is what ...
5
votes
1answer
153 views

Are there cases where malicious scripts on websites breached the sandbox of a browser so that files on the user's computer could be accessed?

Whenever a hosted script on a website tries to access a file on a user's computer the sandbox prevents it, but has there been any documented case where this sandbox obstacle was somehow overcome by ...
2
votes
0answers
57 views

Can static analysis of JavaScript be done?

Is it possible to statistically analyze JavaScript to find obfuscated JavaScript? Any algorithms or equations with coefficients that can find obfuscated JavaScript?
4
votes
2answers
299 views

How to trace source of clickjacking attack within a website using developer tools?

When surfing a popular Wordpress website on my mobile, clicking on a link to an article within would sometimes open a new window to a malicious website or launch the Apps Store. I am interested to ...
2
votes
1answer
77 views

Selective JavaScript commands - Avoiding vulnerabilities exploitation

I remember the times when Javascript usage was so innocent; a small pop-up here, a dialog message there. Nowadays Javascript "steals" data by exploiting vulnerabilities on "mature" browsers such as ...
2
votes
2answers
418 views

http_only for cookies with JWT tokens

I'm trying to figure out how to use JWTs that are transmitted in cookies for an SPA It needs to be in cookies because we want non-ajax requests to also send the jwt, and it should "just work" for all ...
1
vote
3answers
267 views

Is this code javascript vulnerable to DOM based XSS?

Code : <script> document.theform.reference.onchange = function(){ var id = document.theform.reference.selectedIndex; var url = document.theform.reference[id].value; ...
3
votes
4answers
637 views

Famous XSS attacks over JavaScript [closed]

I'm about to graduate in "Computer Science", and I'm writing thesis about the Javascript vulnerabilities. In particular, I'm analyzing the JS vulnerabilities that allow XSS attacks. I would like to ...
4
votes
3answers
770 views

What to do when iPhone is successfully phished

My girlfriend watched "some" pages on her iPhone and facebook.you-won.com page appeared. She didn't know how to get rid of that JavaScript alert, so she clicked OK. After that she closed the page, and ...
0
votes
1answer
116 views

Is injecting malicious file with browser localstorage possible?

Lets say, I visited a "malicioussite.com" and the server had a "malicious.js" in it whose job is to write malicious code to my browser localStorage and save it to the my computer then execute it to ...
8
votes
4answers
4k views

Why disable JavaScript in Tor? [duplicate]

Why it is not advisable to use JavaScript with Tor? Yet with JavaScript, you cannot get the IP address of the user except through an external website. How could using JavaScript with Tor expose one's ...
11
votes
1answer
790 views

Why can't you steal the synchroniser token to do CSRF? [duplicate]

I'm reading up on CSRF and I came across synchroniser tokens. I don't understand why you can't do a CSRF to get the token to do a real CSRF. Example: bank.com has a form like this at ...
0
votes
2answers
100 views

Random characters and letters form obsfuscation

I know that this question has been asked many times, but would JavaScript encryption work if I just added 100 random numbers and letters to the password? That would be hard to reverse engineer, ...
3
votes
1answer
510 views

Google Analytics use of JSONP, what are the security risks?

These days Google Analytics uses a JSONP request to load ga.js into user's web pages via a callback function. According to the Wikipedia, JSONP can "inject any content into a website." What exactly ...
1
vote
1answer
84 views

What kind of attacks do Javascript WebWorkers protect against?

What kind of attack are prevented by running code submitted by the user in a Javascript Web Worker? Do they prevent attacks like XSS, or is it better to use some other sandboxing method to protect ...
2
votes
1answer
257 views

How sharing location via web actually works? (It gets my exact house address)

I know that this could be a repeated question, but I'm freaked out right now, Maybe Im old or out of the 2015 technologies, but i just visited this page: http://whatismyipaddress.com. As I know, ...
3
votes
2answers
501 views

Is it neccessary to use X-FRAME-OPTIONS to prevent ClickJacking attacks?

I use this Javascript Code, and it works perfectly: if (top.location != location) top.location.href = location.href Many researchers told me to not use this. Can any one bypass it? Are there ...
14
votes
4answers
4k views

What are the security issues with “eval()” in JavaScript?

Every time that someone mentions eval(), everyone says that there are "security issues" with it, but nobody ever goes into detail about what they are. Most modern browsers seem to be able to debug ...
1
vote
3answers
790 views

What are the different payloads used for XSS vulnerability? [closed]

I am new to information security field. I am searching for XSS vulnerabilities. In XSS mostly they use <script>alert('XSS')</script> payload for attacking a websites. In the case of ...
1
vote
1answer
467 views

XSS payload to capture login credentials

I am trying to solve this exercise http://pentesteracademylab.appspot.com/lab/webapp/jfp/3. The objective of this is to "Post the Username and Password to Attacker Controlled Server". There is a url ...
-3
votes
1answer
103 views

Session hijacking [closed]

I know one way of doing session hijacking 1.copying the session value from the chrome browser and pasting the cookie value to firefox browser Is there any other way of doing session hijacking ? If ...