The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

learn more… | top users | synonyms

5
votes
3answers
678 views

Secure a publicly accessible REST api

We're building a public single page app in JavaScript that talks to a back-end REST service. What we want is for that REST-service to be only accessible from the single page app. Since it's a public ...
5
votes
2answers
345 views

Do Javascript malware signatures exist?

Are there signatures for malicious JavaScript codes as they exist for other viruses/worms/trojans developed in other programming languages ? If so, are these javascript malware signatures defined ...
5
votes
2answers
973 views

Is it safe to use createHTMLDocument to sanitize HTML?

i'm wondering how safe it is to use createHTMLDocument to do HTML sanitization. I've tried to implement it like this: function sanitize(string) { var elm = ...
5
votes
1answer
1k views

XSS JavaScript Double Quoted String with HTML Escaped Possible?

Is it possible to inject XSS in a JavaScript variable if a website inserts HTML encoded, user input in a double quoted string? var userString = "perfectly "safe" input from user?";
5
votes
2answers
2k views

Problems with avoiding JSON hijacking with MVC3's AntiForgeryToken, or similar token validation

I'm hesitant to implement the proposed anti-JSON hijacking solutions since The recommended solutions to mitigating JSON hijacking involve non-REST-full JSON POSTs to GET data The alternate ...
5
votes
1answer
123 views

Video site requests Adblocker to be shut off, next day I have 3 “weird” bookmarks

I was on a site trying to view a video and the site requested that I turn off my adblocker to view the video. So I did and then the next day I noticed that I had 3 "weird" bookmarks in my bookmark ...
5
votes
1answer
345 views

Exploit SoakSoak injected in Wordpress

I have recently received an attack to my website and Google is warning visitors to not load the page. The malware is located in wp-includes/js/swfobject.js of my Wordpress and I had deleted it but ...
5
votes
1answer
1k views

How should I mitigate the XSS vulnerabilities in KnockoutJS described at mustache-security?

The site Mustache-Security describes XSS vulnerabilities in KnockoutJS... The vulnerabilities come from the use of eval (or some equivalent) to convert text in the data-bind attribute to executable ...
5
votes
2answers
345 views

Any eventhandlers that apply to hidden elements?

Im trying to XSS a search field and my attack vector is getting reflected like this: <input type="text" id="txtRpHiddenKeyword" style="display: none;" value="ATTACK VECTOR HERE" /> Only ...
5
votes
1answer
419 views

Cufon or Prototype as an attack vector for Blackhole exploit kit?

I've been asked to look into the security of a client site that's apparently throwing antiviral messages when visited. Specifics: It's being detected as a Blackhole exploit kit inside of a Cufon ...
5
votes
1answer
1k views

Is 'Forge' Javascript crypto library secure? [closed]

I need a client-side crypto library. I've seen https://github.com/digitalbazaar/forge linked many times on stackexchange. Forge seems to be the most complete and well-documented crypto library for JS. ...
4
votes
2answers
2k views

Could a malicious JS file pointed on URL/URI attack the browser/computer?

I found some website blacklisted on Google. I mean when you try to visit them, you get something like shown on this picture: After a small search, I found that some of them have a malicious ...
4
votes
4answers
1k views

Is it possible to make an xss with only html tags

I'm not aware of all the xss tricks.. While programming in Ruby on Rails, using a sanitize method to allow only certain tags and it makes its best to clear all the other tags and scripts the ...
4
votes
4answers
6k views

What does scorecardsresearch.com/beacon.js - added by Disqus.com - do?

I recently added Disqus to my site. Looking at the "scripts" tab on Firebug, I noticed a script called, http://scorecardresearch.com/beacon.js (here is a prettified version - the script is not ...
4
votes
4answers
1k views

How to prevent attacks against client side validations?

I have a login form where am accepting Mobile Number of the User for login. When Mobile Number is submitted, am calling a JavaScript to validate the Mobile Number. My client side validations ...
4
votes
2answers
586 views

Can one get infected through visiting a site with a PHP script on it and if yes, how?

I can imagine a clientside JavaScript that gets executed in a vulnerable browser to do some harm, but how can this be done with PHP? Since it's serverside it shouldn't have access to the visitor's ...
4
votes
2answers
2k views

How to protect from new Javascript Injection technique that doesn't use eval()?

There is a new Javascript injection technique that is generating chatter on the forums mentioned here Here is the code sample: String.prototype.code = function(){ return (new Function('with(this) { ...
4
votes
5answers
1k views

Clicked on fake “Download Now!” ad on file transfer site (legal file for legit purposes) by accident; does anyone know what measures I should take?

I was sent a file by a coworker via "sendshare" - my first time using the service. The page loaded a bit slowly and the ads came in before the actual download link. I was in a hurry to get the file - ...
4
votes
3answers
2k views

Javascript Diffie-Hellman and AES protocols

I am using the BigInteger Javascript library to create a symmetric key using Diffie-Hellman protocol. I want to create 128,160 or 192-bit keys. After some research, I have found out that I should use ...
4
votes
2answers
2k views

UTF-7 XSS attacks in modern browsers

I've recently read about utf-7 XSS-attacks (i.e. Ned Batchelders article at http://nedbatchelder.com/blog/200704/xss_with_utf7.html) but could not get any UTF-7 attack to work in modern browsers. (I ...
4
votes
2answers
615 views

Safety of using web based proxy?

Lets say for example I have to use a public online proxy like https://www.zend2.com to load a PHP webpage controlled by me containing sensitive data over HTTPS. How would I make sure that the proxy ...
4
votes
3answers
4k views

Facebook spam / phishing attempt?

I got this sent by a friend on facebook and i dont think its a genuine message ___ shared a link on your Wall. This will leave you speechless) ...
4
votes
1answer
5k views

Is it safe to give an Oauth token to client side javascript so it can directly make requests to a server?

I currently have a simple backbone.js application served from my domain (example.com), which is provided an Oauth token. Specifically, I pass the Oauth token through my page template into the ...
4
votes
1answer
8k views

Create RSA public, private key pair having numbers generated already

I want to know to to generate working RSA key pair, with correct syntax. Let's say i have already generated somehow my numbers for 512bit key, which are: e = 00065537 d = ...
4
votes
2answers
880 views

XSS: Parsing Javascript

Reading about DOM based XSS from http://www.webappsec.org/projects/articles/071105.shtml It illustrates some examples like: ...
4
votes
2answers
149 views

Can webpages recognize that I saved my password?

If you save your logins in Firefox, username and password are auto-filled-in in corresponding webpages as soon as you visit them (if you have more than 1 account saved, you'd have to select a username ...
4
votes
3answers
717 views

PHP/JavaScript with RSA

I have a few columns in the database which should be encrypted. I'm wondering if the way I chose to make this system work is ok, and I'm looking forward to hear some opinions: I chose RSA algorithm ...
4
votes
1answer
4k views

Can your Windows or Linux username be exposed to websites?

For example: Accessing a website with javascript enabled can expose information such as browser, fonts and local time. Can it, theoretically, expose your Windows or Linux username? Will saving a ...
4
votes
1answer
250 views

Potential issues with Kim Dotcom's new proposed “encrypted webmail service”

Just spotted a Reddit thread about Kim Dotcom, of MegaUpload fame, planning to produce a secure webmail system that allows people to communicate securely, without the worry of having their messages ...
4
votes
2answers
161 views

To What Extent does an Attacker Have Access to the Browser History through the CSS Pseudoclass :visited Styles?

I have read this article on how a scripted web page is able to obtain the visited history of a user browsing the page. However, I can't find any clear information in the article describing the extent ...
4
votes
1answer
136 views

Security consequence of Javascript hole in an online chat?

For an online chat that allows basic HTML, what happens if they leave an open way for a potential hacker to execute javascript on everyone who is in the chat? What is the worst thing they could do?
4
votes
2answers
469 views

Are sandboxes overrated?

I've stumbled upon the following on the blog of the NoScript developer Giorgio Maone. First, he quotes the following ArsTechnica article about an XSS bug in Adobe Flash: As useful as sandboxes ...
4
votes
3answers
3k views

Why are scripts injected through innerHTML not executed whilst onerror and other on<event> attributes on elements are? - Google XSS Challenge 2

SPOILER ALERT : Do not continue if you do not want to be spoiled I am currently doing the Google XSS Challenge Level 2 . I am injecting XSS code that is inserted into the document using ...
4
votes
1answer
1k views

OWASP Recommendation on Client-Side Password Hashing

The OWASP Application Security FAQ recommends the use of JavaScript to produce a salted hash of the password client-side with JavaScript prior to sending it to the server. Is this something truly ...
4
votes
2answers
485 views

How can document.referrer be used for XSS?

A very simple example... <div id="cat"></div> <script> document.getElementById("cat").innerHTML = document.referrer; </script> or <script src="' + document.referrer + ...
4
votes
2answers
140 views

Can a website make an HTTP request to “localhost”? How does it get around the cross-domain policy?

I found this website which talks about fixing a Redis vulnerability by exploiting that same vulnerability. The website in question has a "patch me" button, and if you have a password-less Redis ...
4
votes
1answer
99 views

Should I be worried about this url request I received on my site?

I was checking the weekend logs of my IIS server and noticed a strange request which was blocked: ...
4
votes
1answer
380 views

How secure is JavaScript based OAuth 2.0

JavaScript based OAuth exposes the client ID of the application and it trusts only on the domain requesting the access token. The domain name can be forged with a DNS hijack (or a virus affecting ...
4
votes
1answer
332 views

Why would a user agent string be executed?

I'm having trouble understanding how a particular XSS vulnerability might arise in the real world. Guides for two of the exercises on hackthissite.org: ...
4
votes
1answer
105 views

Can source javascript files be infected from a developer's machine?

First a little bit of background, About two weeks back one of the developers in my team said they were seeing advertisement popups and links appearing all over the web app we were developing, when ...
3
votes
2answers
443 views

Set the max length for input

Suppose I have a form, and one of this form inputs I set the max length to 15: <input type="text" name="username" maxlength="15"> Now the attacker wants to override this limit, to do that he ...
3
votes
4answers
4k views

How to stop other websites from sending cross domain AJAX requests?

From two different applications, I was able to send cross-orgin requests. Though the browser returns a "cross origin" error my server is still receiving and executing the request. For example, from a ...
3
votes
2answers
2k views

Is XSS possible here? Challenge

Is possible to bypass my regex and execute any javascript? <script> function json(a){ if (/^\s*$/.test(a) ? 0 : /^[\],:{}\s\u2028\u2029]*$/.test(a.replace(/\\["\\\/bfnrtu]/g, ...
3
votes
5answers
1k views

Is it secure to use jQuery on the server-side for user input validation?

I'm thinking about using jQuery on the server-side (node.js) to validate user input (filter tags, remove every attributes except href, rel, target & style, modify css rules which are applied ...
3
votes
3answers
644 views

Stop code injections into page code

I started a topic HERE on the stackoverflow site, but was refered here. I did get some info there, but think it need's more indepth input. So hopefuly people here can help. I have a few domains ...
3
votes
3answers
2k views

Why is the Samy Worm considered XSS?

Last night I was browsing notable computer attacks and came across the Samy worm, which apparently affected a huge portion of the MySpace network -- over one million users in under 24 hours, according ...
3
votes
2answers
870 views

How can JavaScript be tampered with while viewing a web page?

I often hear about how client side JavaScript can't be relied on because it can easily be changed. How exactly can it be changed, what program would be used to modify the JavaScript before a page ...
3
votes
3answers
11k views

What typically is the expiration date of a session cookie?

I need to create a session cookie using JavaScript (for more info see question). I'm wondering what should the expiry date be? I'm guessing it's the browsing session, so if I don't set an expiration ...
3
votes
1answer
523 views

Is this code harmful? Why?

Code: http://pastebin.com/kJ8ZGP82 That code gets retrived from http://ui.sidepage.co for every HTTP page I visit (not HTTPS) and load it into the body tag of the page. Is it harmful in any way? ...
3
votes
2answers
779 views

HTML Vulnerabilities

My question is three-fold. Background I was asked to do some vulnerability scans on a website with some holes (I think). On a particular page, I was able to escape the text field and write on the ...