The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

learn more… | top users | synonyms

6
votes
2answers
3k views

UTF-7 XSS attacks in modern browsers

I've recently read about utf-7 XSS-attacks (i.e. Ned Batchelders article at http://nedbatchelder.com/blog/200704/xss_with_utf7.html) but could not get any UTF-7 attack to work in modern browsers. (I ...
6
votes
3answers
1k views

What authentication system (OpenID, Facebook, etc) permits Javascript-free and/or Cookie-Free operation?

I'm looking for an authentication system that relies on 3rd parties (ADFS, OpenID, SAML) but doesn't rely on cookies or Javascript... or at least can make them optional. My intent is to gracefully ...
6
votes
2answers
200 views

Is this a Javascript virus?

So I got a random email saying this. Looks very automated: "How are things? I was visting your website on 4/9/2016 and I'm very interested. I'm currently looking for work either full time or ...
6
votes
3answers
539 views

Are there any tools to detect JavaScript-based WCF/AJAX calls?

I'd like to determine if a given JavaScript contains the logic to make a AJAX/WCF call, or determine if one is being executed at runtime. Does anything like this exist?
6
votes
3answers
250 views

How to convince team mate about using a whitelist?

Context In our development team, we have to build a component. This component is a full client side one written in Javascript. A client web application wishing to embed this component will call it ...
6
votes
3answers
668 views

Favicon Redirection Possible Security Flaw

I have the domain example.com When I enter the URL https://api.example.com, Chrome loads the page and also tries to load https://myapp.example.com/favicon.ico, and that request receives a 301 ...
6
votes
3answers
8k views

Javascript Malware: How does it work, and how can it be mitigated?

I am wondering how malware gets served through Javascript. I've noticed a few illegitimate pop-ups while visiting some financial websites. I wonder how malware exploits work against the application ...
6
votes
1answer
2k views

XSS JavaScript Double Quoted String with HTML Escaped Possible?

Is it possible to inject XSS in a JavaScript variable if a website inserts HTML encoded, user input in a double quoted string? var userString = "perfectly "safe" input from user?";
6
votes
1answer
119 views

Random Oracle in Javascript for password generation and recall

I use a lot of different sites, and my number one security issue is to never reuse a password. As it seems that every company out there like TalkTalk is as leaky as a sieve, I figure that's the right ...
6
votes
2answers
4k views

Can a website make an HTTP request to “localhost”? How does it get around the cross-domain policy?

I found this website which talks about fixing a Redis vulnerability by exploiting that same vulnerability. The website in question has a "patch me" button, and if you have a password-less Redis ...
6
votes
1answer
2k views

How should I mitigate the XSS vulnerabilities in KnockoutJS described at mustache-security?

The site Mustache-Security describes XSS vulnerabilities in KnockoutJS... The vulnerabilities come from the use of eval (or some equivalent) to convert text in the data-bind attribute to executable ...
6
votes
1answer
346 views

Safe to render data directly to DOM from localStorage? XSS attack possible?

I read that localstorage is susceptible to XSS attacks. I currently store JSON Web Token (JWT) in localstorage, and I access and display data about the user through localstorage: var localstore = ...
5
votes
4answers
2k views

Is it possible to make an xss with only html tags

I'm not aware of all the xss tricks.. While programming in Ruby on Rails, using a sanitize method to allow only certain tags and it makes its best to clear all the other tags and scripts the ...
5
votes
4answers
1k views

Client side encryption - only web browser available

I am creating an enterprise application, the server side runs a whole set of different apps, On the client side, there is only a webpage, no applet or anything else. Unfortunately data created by the ...
5
votes
5answers
260 views

Avoid unauthorized updating of online leaderboard php/sql [duplicate]

I am developing an offline web app (game) for android using cordova (phonegap). The leaderboard of the same is maintained online in my server. Currently this is how the leaderboard is updated Step ...
5
votes
1answer
6k views

Is this jQuery ajax call vulnerable to XSS?

If somebody can edit $("#field").val(), can they change the url property here to point to another location? $.ajax({ url: "http://mywebsite/script?param=" + $("#field").val(), dataType: "jsonp", ...
5
votes
2answers
2k views

Is it possible to create a secure chat web application relying on HTML5 web sockets?

Is it possible to create a secure chat web application using just HTML5 and Javascript? What possible security holes would there be if the server doesn't store the messages, just relay them using ...
5
votes
3answers
539 views

Are CSRF Attacks Really Blind

I'm new to CSRF attacks but don't see how they are always blind. Let's say we are dealing with a site where the asset we need to protect is the HTTP response. Something like one's medical history. ...
5
votes
2answers
2k views

Web & insecure HTTP - Using RSA for encrypting passwords on the client side

I used client side password hashing in my register and login project. Its purpose is to prevent passive adversaries/eavesdroppers from discovering users' plaintext passwords when HTTP requests are in ...
5
votes
4answers
800 views

Is JavaScript self-injection dangerous?

I have a toy web application that can be described roughly as a per-user key-value store. After logging in, the user can view and modify her set of key-value pairs. The keys and values are stored in a ...
5
votes
2answers
2k views

Is a JavaScript implementation of AES any less secure than other language implementations?

There are a few JavaScript AES implementations available such as Gibberish-aes So assuming the AES algorithm has been implemented correctly in this library then it should be as secure as any other ...
5
votes
1answer
153 views

Are there cases where malicious scripts on websites breached the sandbox of a browser so that files on the user's computer could be accessed?

Whenever a hosted script on a website tries to access a file on a user's computer the sandbox prevents it, but has there been any documented case where this sandbox obstacle was somehow overcome by ...
5
votes
2answers
859 views

Safety of using web based proxy?

Lets say for example I have to use a public online proxy like https://www.zend2.com to load a PHP webpage controlled by me containing sensitive data over HTTPS. How would I make sure that the proxy ...
5
votes
2answers
206 views

User entered Javascript security implications

I'm creating a web site that lets people create their own site using a subdomain. Are there any security implications by letting people add custom javascript to their pages? If so, which ones? XSS? ...
5
votes
1answer
190 views

Is it safe to allow untrusted field names in JSON?

When forming a JSON data structure, are there any security risks with allowing the field names to be chosen by an attacker? You can assume they'll be quoted properly. I'd like to know if allowing ...
5
votes
3answers
5k views

Facebook spam / phishing attempt?

I got this sent by a friend on Facebook and I don't think its a genuine message: ___ shared a link on your Wall. This will leave you speechless) ...
5
votes
1answer
6k views

Is it safe to give an Oauth token to client side javascript so it can directly make requests to a server?

I currently have a simple backbone.js application served from my domain (example.com), which is provided an Oauth token. Specifically, I pass the Oauth token through my page template into the ...
5
votes
2answers
242 views

Can webpages recognize that I saved my password?

If you save your logins in Firefox, username and password are auto-filled-in in corresponding webpages as soon as you visit them (if you have more than 1 account saved, you'd have to select a username ...
5
votes
2answers
171 views

Protection against synthetic queries

Note: One, I am not sure if synthetic queries is right word for the risk I am talking about. Second, though I am considering 3-tier model of web-applications general answers are welcome in ...
5
votes
3answers
925 views

What are NoScript surrogates and should one disable them for more privacy in browsing?

NoScript has a feature of supplying its own "surrogate" scripts instead of well-known tracking/ad scripts (Google Analytics, for one). Does it matter for my privacy if I do not change the factory ...
5
votes
2answers
816 views

How to ensure that files uploaded by users do not contain any XSS code

I have been working on providing the security related to the XSS attacks. My website only allows following mime-types: XML, CSV, HTML, PLAIN, VND_WAP_WML, APPLICATION_ZIP, APPLICATION_PDF, ...
5
votes
1answer
503 views

Using javascript, is it possible to iterate through all cookies saved in the user browser and send them to me?

Again, I am new to the programming and security world. I should mention that it is just a theoretical question so I can anticipate this kind of attack. Using javascript, is it possible to iterate ...
5
votes
1answer
100 views

Does prefetching/preloading in web browsers pose a security risk?

Today I googled the name of a domain that was reportedly serving up malware. My search results came up (with the compromised domain at the top of the list) and within seconds my AV gave an alert ...
5
votes
2answers
2k views

Is it safe to use createHTMLDocument to sanitize HTML?

i'm wondering how safe it is to use createHTMLDocument to do HTML sanitization. I've tried to implement it like this: function sanitize(string) { var elm = ...
5
votes
2answers
2k views

Problems with avoiding JSON hijacking with MVC3's AntiForgeryToken, or similar token validation

I'm hesitant to implement the proposed anti-JSON hijacking solutions since The recommended solutions to mitigating JSON hijacking involve non-REST-full JSON POSTs to GET data The alternate ...
5
votes
1answer
146 views

Video site requests Adblocker to be shut off, next day I have 3 “weird” bookmarks

I was on a site trying to view a video and the site requested that I turn off my adblocker to view the video. So I did and then the next day I noticed that I had 3 "weird" bookmarks in my bookmark ...
5
votes
2answers
1k views

How can document.referrer be used for XSS?

A very simple example... <div id="cat"></div> <script> document.getElementById("cat").innerHTML = document.referrer; </script> or <script src="' + document.referrer + ...
5
votes
1answer
456 views

Exploit SoakSoak injected in Wordpress

I have recently received an attack to my website and Google is warning visitors to not load the page. The malware is located in wp-includes/js/swfobject.js of my Wordpress and I had deleted it but ...
5
votes
2answers
108 views

What to use as 'state' in OAuth2 Authorization Code Grant workflow

I'm using csrf protection in my web app. Now I'm planning to trigger a OAuth2 Authorization Code Grant workflow, starting with a static template opened in a new browser window using ...
5
votes
1answer
508 views

Cufon or Prototype as an attack vector for Blackhole exploit kit?

I've been asked to look into the security of a client site that's apparently throwing antiviral messages when visited. Specifics: It's being detected as a Blackhole exploit kit inside of a Cufon ...
5
votes
1answer
2k views

Is 'Forge' Javascript crypto library secure? [closed]

I need a client-side crypto library. I've seen https://github.com/digitalbazaar/forge linked many times on stackexchange. Forge seems to be the most complete and well-documented crypto library for JS. ...
4
votes
2answers
2k views

Could a malicious JS file pointed on URL/URI attack the browser/computer?

I found some website blacklisted on Google. I mean when you try to visit them, you get something like shown on this picture: After a small search, I found that some of them have a malicious ...
4
votes
2answers
3k views

JavaScript eval() to parse JSON after sanitizing with regexes — is XSS possible?

Is possible to bypass my regex and execute any JavaScript? <script> function json(a){ if (/^\s*$/.test(a) ? 0 : /^[\],:{}\s\u2028\u2029]*$/.test(a.replace(/\\["\\\/bfnrtu]/g, ...
4
votes
4answers
7k views

How to stop other websites from sending cross domain AJAX requests?

From two different applications, I was able to send cross-orgin requests. Though the browser returns a "cross origin" error my server is still receiving and executing the request. For example, from a ...
4
votes
2answers
695 views

Can one get infected through visiting a site with a PHP script on it and if yes, how?

I can imagine a clientside JavaScript that gets executed in a vulnerable browser to do some harm, but how can this be done with PHP? Since it's serverside it shouldn't have access to the visitor's ...
4
votes
2answers
2k views

How to protect from new Javascript Injection technique that doesn't use eval()?

There is a new Javascript injection technique that is generating chatter on the forums mentioned here Here is the code sample: String.prototype.code = function(){ return (new Function('with(this) { ...
4
votes
5answers
1k views

Clicked on fake “Download Now!” ad on file transfer site (legal file for legit purposes) by accident; does anyone know what measures I should take?

I was sent a file by a coworker via "sendshare" - my first time using the service. The page loaded a bit slowly and the ads came in before the actual download link. I was in a hurry to get the file - ...
4
votes
3answers
19k views

What typically is the expiration date of a session cookie?

I need to create a session cookie using JavaScript (for more info see question). I'm wondering what should the expiry date be? I'm guessing it's the browsing session, so if I don't set an expiration ...
4
votes
2answers
1k views

DOM XSS attack failing in Firefox

I am trying to perform DOM XSS attack to exploit a vulnerability of localhost webpage. I am able to perform the attack successfully on IE-11 and Chrome. But Firefox is preventing me to perform the ...
4
votes
3answers
3k views

Javascript Diffie-Hellman and AES protocols

I am using the BigInteger Javascript library to create a symmetric key using Diffie-Hellman protocol. I want to create 128,160 or 192-bit keys. After some research, I have found out that I should use ...