The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.
2
votes
3answers
221 views
sanitizing likes/unlikes in application?
I've got a function in my app where users can click on a "thumbs up" image and a like is recorded in the database; all that's recorded is the user's ID and the ID of the post that the user liked.
I ...
2
votes
2answers
67 views
Is it safer to store the XSRF value inside your JavaScript?
To protect yourself against XSRF, you need to have a separate token on a page.
See: Coding Horror: Preventing CSRF and XSRF Attacks, by Jeff Atwood
As the posting suggests, its best to have those ...
2
votes
1answer
154 views
Is DWR (Direct Web Remoting) Secure?
Is DWR considered secure, or what may be required to secure Direct Web Remoting?
Are there better options for hardened asynchronous communication?
2
votes
1answer
521 views
javascript:alert(“test”); command does not work
Hello! As I have done before and also have read in many web sites, that just simply writing:
javascript:alert(document.cookie);
should work on any web page.
But now, I was not able to execute it. I ...
2
votes
2answers
456 views
Removing Google Analytics cookie string from URL - security hole?
On our site, we use google analytics and we have to put the GA cookie in the URL since we have a two letter domain and IE imposes some cookie limitations on those. This means that when going between ...
2
votes
1answer
420 views
What browsers support encryption or decryption using local certificates, or smartcard readers?
I am working on a cloud-based solution and I would like to encrypt / decrypt the data locally using either a SmartCard or local Machine certificate. I'm hoping to do this in Javascript, but may ...
2
votes
1answer
779 views
RSA Key Pair generation with Javascript
I need to generate a RSA key pair with Javascript. This key pair will be used for encrypting a one time blob of data (20-100kb), then discarded. This data can be reduced to a couple of hundred kb or ...
2
votes
1answer
132 views
How to hide victim pop-up in clickjacking?
I am testing a web application for click-jacking vulnerability. The attack works fine for single clicks, however i am trying to delete a file and the hidden frame (victim) throws a pop-up ...
2
votes
1answer
112 views
Newline XSS vulnerability
So I was experimenting with XSS using new line (%0A) character.
So I got to the usual vector: '%0Aalert(/xss/)//
and one thing came to my mind. What if you can't insert a quote?
A new line will break ...
2
votes
1answer
69 views
Return AWS signature over HTTP
I am performing multipart upload to S3 straight from the browser, i.e. bypassing my back-end.
My JS code sends a hand-shake request to S3 (a POST), then uploads the file in chunks of 5MB (a PUT for ...
2
votes
1answer
166 views
Black box testing javascript MVC web applications
I want to test a web application that has been built using the backbone.js framework.
Currently I have used a few tools for crawling and testing without any luck. When crawling the website they can ...
2
votes
1answer
269 views
How does IE's Privacy options affect javascript's ability to save cookies?
I'm looking at IE's privacy options screen and am trying to figure out how it breaks javascript, workarounds to that, and how I can gracefully degrade my user experience.
Is there a guide that ...
2
votes
2answers
125 views
What are the security risks when users upload their html & javascript to AWS S3 and the content is used in a webapp
I'm building this webapp where users can login and build their own online presentation. To build the presentation they can use their own html, css and javascript. These user files are not uploaded to ...
1
vote
4answers
1k views
Prevent Users from Downloading Javascript, Images
A lot of times I see that resource XXXXX.gif or XXXXX.js can't be saved when I try to save a webpage in Firefox.
So this made me think, can I implement a similar thing for my website as well?
...
1
vote
4answers
632 views
Shall I need to use MD5 algorithm in both JavaScript and PHP for login authentication?
I have a login form with username and password. I post this form data to a PHP file. For security reasons I want to encrypt my password in the database and network. Now I have done now following ...
1
vote
5answers
709 views
Is it secure to use jQuery on the server-side for user input validation?
I'm thinking about using jQuery on the server-side (node.js) to validate user input (filter tags, remove every attributes except href, rel, target & style, modify css rules which are applied ...
1
vote
4answers
965 views
Playing with Referrer Header
There are 2 sites:
http://www.site1.com
http://www.site2.com
http://www.site1.com contains link to http://www.site2.com as
<a href="http://www.site2.com/">link<a/>
When user clicks ...
1
vote
2answers
127 views
Why ban XSS instead of flagging it?
Consider a browser that allows an XMLHttpRequest downloaded from foo.net to make requests to bar.net, but attaches a XHR-Origin: http://foo.net (or possibly a more descriptive value like ...
1
vote
3answers
593 views
what's the absolute worst damage javascript could do to a client?
Assuming I have a defenseless client computer running Windows 7 that will happily allow any javascript code it comes across on the internet, what's the worst damage that could be inflicted?
I'm ...
1
vote
2answers
363 views
AVG Website Scan, Chance of 'Potential Threat'?
In a recent question I asked about investigating websites for viruses.
The answers were very helpful, I ended up using the AVG website scanner. First I used it on our website and found it was clean, ...
1
vote
3answers
260 views
Client side scripts through proxies
If you're trying to hide your IP address using VPN/proxies can a website using client side scripting record your real ip? If yes is there any alternative to blocking all scripts as that breaks ...
1
vote
4answers
292 views
Are malicious scripts in batch files detected by antiviruses?
we have many scripts in shared folders in our IT Department.
Are malicious scripts in batch files detected by antiviruses?
1
vote
2answers
191 views
I need explanation on how serious these vulnerabilities are?
I have found two vulnerabilities on my college site and I want to report them but don't know if these are "really" vulnerabilities :
RFI inside SWF file.
Example: ...
1
vote
3answers
762 views
Authentication between multiple systems/platforms within the same web application context
Consider the following scenario: Web application is using two separate systems (they can share data/state through DB). First one is used for processing standard web stuff like http requests/responses, ...
1
vote
4answers
206 views
Can JavaScript be used to install malware?
Looking at the Pwn2Own contest got me thinking:
http://arstechnica.com/security/2013/03/pwn2own-carnage-continues-as-exploits-take-down-adobe-reader-flash/?comments=1
If you have all plugins turned ...
1
vote
1answer
71 views
How to verify that a clientside-generated object is genuine?
I know that general best-practice states not to trust anything generated by the client.
With that in mind, I want to write an HTML5 app that utilises the browser to generate various objects ...
1
vote
2answers
2k views
Best Approach for removing XSS Vulnerability
I have been developing a Webobjects application, and I found that my application is vulnerable to XSS through URL, but not when malicious input like <script>alert("hi")</script> is input ...
1
vote
2answers
199 views
Is the OData Protocol susceptible to Insecure Direct Object References?
The Open Data Protocol or OData is a great protocol created on top of Web Technologies.It uses the URI convention for the data exchange using Atom, JSON and XML. You can use the URI convention ...
1
vote
2answers
554 views
What does scorecardsresearch.com/beacon.js - added by Disqus.com - do?
I recently added Disqus to my site. Looking at the "scripts" tab on Firebug, I noticed a script called, http://scorecardresearch.com/beacon.js (here is a prettified version - the script is not ...
1
vote
1answer
383 views
scanning my site for JavaScript/XSS vulnerabilities
It have had a report that my site may have a security issue and there is some JavaScript loading 10 times per second.
www.ayrshireminis.com
Is there anyway that I can "scan" my site to check if ...
1
vote
1answer
107 views
Web speech API security
Does the web speech API send the audio to a third-party web service in order to do the speech-to-text conversion, or is everything built into the browser?
I'm trying to work out how secure this API ...
1
vote
2answers
104 views
Should the Keygen element be used to create a certificate for mutual auth TLS? What alternatives are there?
I'm interested in using mutual auth TLS to improve the security of my javascript based webservices . I've looked at the Keygen element and given all its issues, not sure if this can even be used for ...
1
vote
2answers
114 views
How do I holistically protect a web service from network and MITM attacks?
I have several financial web services that are accessed over HTTPS, however the client devices may be accessing the web services over untrusted WiFi, through questionable proxies, and possibly ToR ...
1
vote
2answers
2k views
Encrypting string in javascript and decryption in java
I would like to know if someone know any library to do encryption in javascript and decryption in java. I have already tried many API, But getting not not getting same values in java.
I want ...
1
vote
1answer
59 views
Certificate authentication with jQuery's ajax() function
I need to sync with my server with the client certificate abc.pfx which is generated by the server using Ajax. How do I send my certificate with Ajax object. Can I do this certificate authentication ...
1
vote
3answers
215 views
What typically is the expiration date of a session cookie?
I need to create a session cookie using JavaScript (for more info see question). I'm wondering what should the expiry date be? I'm guessing it's the browsing session, so if I don't set an expiration ...
1
vote
1answer
190 views
bypass a regex filtration to perform an xss attack
Does the regex [\w/$!.*-]+$ stop the injection of payloads like :
"><script>alert(4)</script>
" onload="alert(4)"
...
1
vote
1answer
267 views
How can I ensure privacy when outsourcing authentication to an IdP (Identity Provider)
I need to outsource authentication to an IdP (Identity Provider) but I don't want that IdP to know of the calling site. The two major issues are the callback URL and the referer header.
Is there any ...
1
vote
2answers
342 views
HTTP Response Splitting
Is this apart of a HTTP Response Splitting attack ? Here below is some code that gets put into a web browser after clearing the url while on the website
javascript: var xhr = new XMLHttpRequest(); ...
1
vote
1answer
85 views
How does window.w3ssss hack occur
Recently a .Net MVC 2 application on our server was infected with a virus / hack, it added some Javascript to the index.aspx pages of the site.
While we have cleaned it up, I have not been able to ...
1
vote
1answer
120 views
Is the javascript browser tool at printfriendly.com secure for my browser
I use Win Xp Home with SP3 and am pretty aware of security problems. I use Palemoon 12.1, a version of Firefox optimized for windows.
I usually use printfriendly bookmarklet to create printable pages ...
1
vote
2answers
181 views
Can XSS vulnerabilities present in 3rd party js libraries be used to attack the app that uses the lib?
I am using various 3rd party libs like cordova.js, jquery, jquery mobile, mobilizer and so on, in a an android mobile app.. These libs are found to have various XSS vectors through insecure use of ...
1
vote
1answer
437 views
How to prevent the following clickjacking attack?
The Security attribute was implemented to prevent XSS attacks in iFrames by disabling any JS implemented in the iFrame source, therefore indeed eliminating XSS attacks, but also disabling any security ...
1
vote
2answers
641 views
Possible to use CAPICOM to extract current SSL certificate?
I'd like to extract the current SSL certificate from the current browsing session, and read the properties.
I'd like to do this at the Browser, for content that is delivered from the server. I'm ...
1
vote
0answers
95 views
What are potential use cases of script that identifies browser? [closed]
Let's say I've found a way to produce a unique string for each and every browser using pure Javascript (which makes it an alternative to UA strings).
Now what I'd like to know is what are potential ...
1
vote
0answers
304 views
A proposal for Data Transmission and Password Encryption [closed]
I need to implement a sensitive data protection scheme which can meet the requirements on secure data transmission, protection and storage, assuming mutually trusted third party is not available, that ...
0
votes
2answers
303 views
DOM XSS : Need Help
I was trying my hands at DOM based XSS. I came across a scenario where user controlled string from the URL is included in javascript as below
var userControlled=substring of URL;
...
0
votes
1answer
531 views
“pagesinxt.com” links in the sourcecode, am I being hacked?
At this moment I am being hacked and I do not know to stop it. Let me explain...
My website is hosted in a VPS where I am the only person who has access to it. The page is builtwith ...
0
votes
1answer
167 views
Replicating javascript actions from different website (XSS?)
I've got html / javascript code on my site like this:
<a ...
0
votes
1answer
119 views
Stopping js malware injection on our Wordpress site
This had been added to our wordpress site, specifically in the footer.php.
hxxp://pkktjuchlrv.peguards.cc/02b31ac5iq/get.js
It is malware as defined by google, i belive it is tracking code.
We have ...
