The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.
3
votes
2answers
300 views
Are sandboxes overrated?
I've stumbled upon the following on the blog of the NoScript developer Giorgio Maone.
First, he quotes the following ArsTechnica article about an XSS bug in Adobe Flash:
As useful as sandboxes ...
1
vote
3answers
259 views
Client side scripts through proxies
If you're trying to hide your IP address using VPN/proxies can a website using client side scripting record your real ip? If yes is there any alternative to blocking all scripts as that breaks ...
2
votes
1answer
154 views
Is DWR (Direct Web Remoting) Secure?
Is DWR considered secure, or what may be required to secure Direct Web Remoting?
Are there better options for hardened asynchronous communication?
1
vote
1answer
118 views
Is the javascript browser tool at printfriendly.com secure for my browser
I use Win Xp Home with SP3 and am pretty aware of security problems. I use Palemoon 12.1, a version of Firefox optimized for windows.
I usually use printfriendly bookmarklet to create printable pages ...
2
votes
3answers
220 views
sanitizing likes/unlikes in application?
I've got a function in my app where users can click on a "thumbs up" image and a like is recorded in the database; all that's recorded is the user's ID and the ID of the post that the user liked.
I ...
3
votes
5answers
494 views
Clicked on fake “Download Now!” ad on file transfer site (legal file for legit purposes) by accident; does anyone know what measures I should take?
I was sent a file by a coworker via "sendshare" - my first time using the service. The page loaded a bit slowly and the ads came in before the actual download link. I was in a hurry to get the file - ...
2
votes
1answer
518 views
javascript:alert(“test”); command does not work
Hello! As I have done before and also have read in many web sites, that just simply writing:
javascript:alert(document.cookie);
should work on any web page.
But now, I was not able to execute it. I ...
1
vote
4answers
1k views
Prevent Users from Downloading Javascript, Images
A lot of times I see that resource XXXXX.gif or XXXXX.js can't be saved when I try to save a webpage in Firefox.
So this made me think, can I implement a similar thing for my website as well?
...
0
votes
3answers
969 views
Set Cookie in XHR response : How different browsers handle this?
If I send a XHR request to example.com and response has Set-Cookie: dummyCookie=dummy in response.
How different browsers handle this?
Does any version of any browser set the cookie for ...
1
vote
2answers
361 views
AVG Website Scan, Chance of 'Potential Threat'?
In a recent question I asked about investigating websites for viruses.
The answers were very helpful, I ended up using the AVG website scanner. First I used it on our website and found it was clean, ...
0
votes
2answers
2k views
Best Approach for removing XSS Vulnerability
I have been developing a Webobjects application, and I found that my application is vulnerable to XSS through URL, but not when malicious input like <script>alert("hi")</script> is input ...
4
votes
4answers
2k views
Is WebGL a security concern?
Is WebGL a potential security problem due to the low level access it provides?
For example, a web page can attempt to compile and run any shader source it wants.
It seems that security would ...
2
votes
4answers
505 views
Without using SSL, what's the most secure way to make an AJAX request to a PHP page?
It was suggested over at stackoverflow that I try my question here. This is it verbatim:
So, it's impossible to do AJAX requests securely without using SSL. I get it. You can either view-source the ...
1
vote
0answers
304 views
A proposal for Data Transmission and Password Encryption [closed]
I need to implement a sensitive data protection scheme which can meet the requirements on secure data transmission, protection and storage, assuming mutually trusted third party is not available, that ...
2
votes
2answers
452 views
Removing Google Analytics cookie string from URL - security hole?
On our site, we use google analytics and we have to put the GA cookie in the URL since we have a two letter domain and IE imposes some cookie limitations on those. This means that when going between ...
1
vote
3answers
589 views
what's the absolute worst damage javascript could do to a client?
Assuming I have a defenseless client computer running Windows 7 that will happily allow any javascript code it comes across on the internet, what's the worst damage that could be inflicted?
I'm ...
3
votes
2answers
331 views
HTML Vulnerabilities
My question is three-fold.
Background
I was asked to do some vulnerability scans on a website with some holes (I think). On a particular page, I was able to escape the text field and write on the ...
5
votes
2answers
5k views
Javascript and jQuery not secure over https
I am building an ASP.NET MVC 3 app which will run in Azure. Everything was working well, until I switched to https. Now most of my jQuery plugins and some other javascript are not secure.
I'm using ...
5
votes
1answer
2k views
Is this jQuery ajax call vulnerable to XSS?
If somebody can edit $("#field").val(), can they change the url property here to point to another location?
$.ajax({
url: "http://mywebsite/script?param=" + $("#field").val(),
dataType: "jsonp",
...
3
votes
2answers
345 views
Can one get infected through visiting a site with a PHP script on it and if yes, how?
I can imagine a clientside JavaScript that gets executed in a vulnerable browser to do some harm, but how can this be done with PHP?
Since it's serverside it shouldn't have access to the visitor's ...
6
votes
3answers
575 views
How secure are self decrypting HTML files for data storage?
I recently came across a JavaScript self decrypting archive. Is it secure enough to be used as a portable password storage tool? The author has even challenged it to be cracked.
7
votes
3answers
572 views
How bad is a Self Contained XSS attack?
Some of you might be familiar with this attack called Self Contained XSS. I recently stumbled upon this article about it. So how bad this kind of attack can be, even though this doesn't have access to ...
10
votes
1answer
1k views
Best way to secure javascript front end/REST back end architecture web site?
I would like to build the following project:
public REST API back end which can be accessed by any authenticated client.
front end with static files in HTML/CSS/Javascript with Backbone.js jQuery ...
8
votes
5answers
2k views
How to scan Javascript for malicious code?
We're planning to give the possibility to write community-driven extensions in javascript for our public webapp and let people to customize their instances of the application. The problem is to ...
8
votes
4answers
1k views
Mobile Carrier Javascript Injection
So it appears that T-Mobile in the UK are injecting a javascript file into the head of files that are transfered over their mobile data network.
The file in question is 1.2.3.8/bmi-int-js/bmi.js ...
9
votes
3answers
739 views
localStorage for apps over https. What expectations are there?
I run an online gradebook. To keep student data private, I transfer all data over https.
Now, I'd like to use localStorage to avoid redundant calculations and server requests. However, according to ...
0
votes
2answers
303 views
DOM XSS : Need Help
I was trying my hands at DOM based XSS. I came across a scenario where user controlled string from the URL is included in javascript as below
var userControlled=substring of URL;
...
7
votes
1answer
550 views
Closing an HTML element without using literal slashes?
I'm investigating a vulnerability in an application that echoes a user-supplied filename without sanitizing the filename.
E.g. a file named test-<script>alert("evil");.txt will result in that ...
5
votes
1answer
115 views
Is it safe to allow untrusted field names in JSON?
When forming a JSON data structure, are there any security risks with allowing the field names to be chosen by an attacker? You can assume they'll be quoted properly. I'd like to know if allowing ...
4
votes
3answers
467 views
PHP/JavaScript with RSA
I have a few columns in the database which should be encrypted. I'm wondering if the way I chose to make this system work is ok, and I'm looking forward to hear some opinions:
I chose RSA algorithm ...
13
votes
5answers
2k views
Preventing information disclosure from browser back button/history?
I have sensitive data that will be hosted on a website, and I would like to prevent the data from being exposed in this scenario:
The primary user logs off the application, but does not close the ...
1
vote
2answers
198 views
Is the OData Protocol susceptible to Insecure Direct Object References?
The Open Data Protocol or OData is a great protocol created on top of Web Technologies.It uses the URI convention for the data exchange using Atom, JSON and XML. You can use the URI convention ...
6
votes
3answers
513 views
How serious are XSS attacks
A website I visit allows this kind of attack, to be implemented with GET in the URL
<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
Along with many others on this page: ...
18
votes
2answers
3k views
Why is the same origin policy so important?
I can't really fully understand what same origin domain means. I know it means that when getting a resource from another domain (say a JS file) it will run from the context of the domain that serves ...
20
votes
2answers
1k views
JavaScript written only with brackets?
I once saw JavaScript code which was only written as multiple brackets (). Does anybody remember this kind of code? There was also an online converter to convert "normal" JS into this style of code. I ...
2
votes
1answer
417 views
What browsers support encryption or decryption using local certificates, or smartcard readers?
I am working on a cloud-based solution and I would like to encrypt / decrypt the data locally using either a SmartCard or local Machine certificate. I'm hoping to do this in Javascript, but may ...
5
votes
2answers
826 views
Is a JavaScript implementation of AES any less secure than other language implementations?
There are a few JavaScript AES implementations available such as Gibberish-aes
So assuming the AES algorithm has been implemented correctly in this library then it should be as secure as any other ...
14
votes
1answer
944 views
Does the practice of blocking an off-site “Referer:” HTTP requests improve website security?
Is there any benefit for a security-paranoid website to disallow HTTP requests that have a Referer: from 3rd party sites?
The pitch is that if such a HTTP request were to come in, then certain XSS ...
15
votes
3answers
610 views
What are the risks of using a CDN to speed up my website? How do I avoid them?
Content Delivery Networks (CDNs) are well known to speed up the performance of a website, but they create the obvious security risks if someone were to change the code that resides on the CDN.
What ...
2
votes
1answer
267 views
How does IE's Privacy options affect javascript's ability to save cookies?
I'm looking at IE's privacy options screen and am trying to figure out how it breaks javascript, workarounds to that, and how I can gracefully degrade my user experience.
Is there a guide that ...
15
votes
2answers
347 views
What risks should I be aware of before allowing advertisements being placed on my website?
The thought of having a 3rd party send javascript, and images to end users seems to be a scary thought, but that is exactly what we are doing when I place advertisements onto my site.
Does serving ...
18
votes
4answers
3k views
How do you know your server has been compromised?
I recently helped a client who had their server hacked. The hackers added some PHP code into the header of the homepage redirecting the user to a porn website — but only if they came from Google. This ...
13
votes
5answers
1k views
What can I do about TLS 1.0 javascript injection vulnerability on my server?
The recent article featured on slashdot http://www.theregister.co.uk/2011/09/19/beast_exploits_paypal_ssl/ says that connections secured with TLS 1.0 are susceptible to man-in-the-middle decryption ...
1
vote
3answers
752 views
Authentication between multiple systems/platforms within the same web application context
Consider the following scenario: Web application is using two separate systems (they can share data/state through DB). First one is used for processing standard web stuff like http requests/responses, ...
10
votes
3answers
450 views
Is there a particular security weakness from using server-side JavaScript?
I never used JavaScript server side, actually I didn't even know that it would be used or useful there. Now that I found out that it is possible and there is a quite active community, I am wondering ...
3
votes
5answers
249 views
Is it possible to see if a script on a website steals session cookies?
I'm looking as some web analytics solutions, I know it sounds paranoid. but cookie-based web analytics need for you to paste their JavaScript code on your web-site.
I don't like the idea too much of ...
2
votes
1answer
775 views
RSA Key Pair generation with Javascript
I need to generate a RSA key pair with Javascript. This key pair will be used for encrypting a one time blob of data (20-100kb), then discarded. This data can be reduced to a couple of hundred kb or ...
8
votes
2answers
588 views
Security Concerns on clientside(Javascript)
We are going to design and implement a UI for a big website. Owner of the site is really cautious about security issues. I wonder if there is a check list for security issues at the client-side ,while ...
6
votes
3answers
4k views
Secure jquery ajax calls from a non secure page
I could not find a clear answer, but if I have the following situation:
I browse to a page let's say http://www.example.com/index.html
Now I use a form on this page to do a postback with jquery's ...
18
votes
3answers
802 views
NoScript: How to determine which sites/scripts to whitelist?
NoScript is a great plug-in, both for security and for ad blocking. However, I've found it's not always easy to figure out what scripts need to be permitted on certain pages, to be able to use the ...
