The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

learn more… | top users | synonyms

0
votes
2answers
292 views

NGO Joomla! site: Infected with malware? JavaScript injection?

Please help us with this NGO site running Joomla! 1.5. They can't pay a security professional right now, so maybe you guys can help isolate the problem? If you go to http://casatrespatios.org you ...
12
votes
4answers
1k views

How do I protect myself from clickjacking attacks?

I've seen many friends getting clickjacked on Facebook and similar sites. How does one detect and prevent clickjacking? How should I teach my friends to do the same?
-1
votes
2answers
164 views

Protecting sensitive content in JS source code and Ajax cals [closed]

I've been trying to see how to properly protect important content that's passed in ajax calls with java script. Considering JavaScript can be viewed at any point, it is inevitable that some of your ...
1
vote
1answer
179 views

How do you limit javascript api to a domain?

Ok, many of you now the scenario: you login to developer.sayLinkedIn.com, create an app with credentials and define the domain in witch that key is allowed to "run". The question is, from a api ...
9
votes
5answers
2k views

Mobile Carrier Javascript Injection

So it appears that T-Mobile in the UK are injecting a javascript file into the head of files that are transfered over their mobile data network. The file in question is 1.2.3.8/bmi-int-js/bmi.js ...
5
votes
5answers
16k views

Playing with Referrer Header

There are 2 sites: http://www.site1.com http://www.site2.com http://www.site1.com contains link to http://www.site2.com as <a href="http://www.site2.com/">link<a/> When user clicks ...
3
votes
1answer
636 views

Access-Control-Allow-Origin header spoofing?

Is it possible for a attacker to spoof the Access-Control-Allow-Origin header? Or, is it secure enough to protect resource access via the Access-Control-Allow-Origin header? I'm trying to make an ...
0
votes
1answer
74 views

Seeking help with implementing SCRAM in .NET

I'm late to the party and need to be caught up. I'm doing my homework looking things up. I know that I don't want unsalted challenge-response CRAM, I want salted challenge-response SCRAM. I think ...
1
vote
1answer
614 views

Security implications of adding all domains to CORS (i.e. Access-Control-Allow-Origin: *) [duplicate]

I am curious of what all the security implications are if I set the following two HTTP response CORS headers; Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false The only ...
3
votes
1answer
3k views

Is it safe to give an Oauth token to client side javascript so it can directly make requests to a server?

I currently have a simple backbone.js application served from my domain (example.com), which is provided an Oauth token. Specifically, I pass the Oauth token through my page template into the ...
0
votes
1answer
96 views

Verifying one specific attack vector of Cross Site Scripting

Burp suggests that there is a reflection.. It changes a value of a cookie named as x as x=<script src=abc.js> and in response this value gets injected to a javascript function.. <script ...
4
votes
1answer
720 views

OWASP Recommendation on Client-Side Password Hashing

The OWASP Application Security FAQ recommends the use of JavaScript to produce a salted hash of the password client-side with JavaScript prior to sending it to the server. Is this something truly ...
-1
votes
1answer
420 views

Open Source tool for analysing javascript for security vulnerabilities [closed]

I am completely new to this field and am a college student. I am looking for a static code analysis tool that scans the source code of a web app ( NOT the URL) for security vulnerabilities. So far i ...
2
votes
1answer
2k views

Are these both cross frame scripting attacks?

I've received a recent security review of a website which mentioned it had a cross frame scripting vulnerability. In short, it mentioned that a malicious site could load the page up in an iframe, ...
1
vote
2answers
970 views

What's the limit on the size of the data that public-key cryptos can handle?

Someone mentioned here that asymmetric encryption might not be appropriate for bulk data and gave an example of RSA with 100 bytes. Of course, I understand that it was a rough example. But it made me ...
1
vote
2answers
278 views

Can older or custom web browsers override the same origin policy?

I totally understand the basis of origin policy and the reasoning why all modern browsers have put this policy into place. My question I guess is, do older browsers support this, and if they don't, ...
-1
votes
1answer
150 views

Reflected XSS Prevention plugin [closed]

Is there any plugin out there which prevent reflected XSS? Plugin could be either for firefox or chrome. Thanks.
1
vote
1answer
178 views

Does Google Analytics collect any information about the contents of the web page?

If I enable Google Analytics on my web application, does the Google Analytics Javascript collect any information on the web page (any of the content on the page)? Does it collect any information ...
1
vote
1answer
261 views

Security implications of hosting third-party Javascript [duplicate]

A client of ours wants us to host a blob of Javascript for their custom-branded version of our website. It is hosted on a subdomain of our site (customer.example.com), but uses the same cookie domain ...
5
votes
1answer
573 views

Child iFrame hash verification of parent iFrame content

Consider the following scenario: Alice wishes to browse Victor's website while on the job at Initech. Victor's website is hosted on an alternative domain name system to which Initech's DNS does not ...
8
votes
4answers
1k views

I've encountered JavaScript attack code - how do I search for information on the exploit's specifics?

So, I clicked on a reasonably-looking LinkedIn invite, not thinking about hovering overing the link first, since usually the e-mail client warns me about such things. Once I realized I landed on an ...
1
vote
1answer
70 views

Gaining sensible information from advertisement displayed in web pages

As we all know, JavaScript loaded inside a website A gets restricted to access the domain itself [same origin policy]. Unfortunately, same origin policy does not apply to newly created DOM nodes, ...
10
votes
5answers
795 views

Data needed for why not to load third party JavaScript on web page with credit card form

My company makes a JavaScript widget that e-commerce sites can embed on their pages. Our current instructions to our customers tell them to load our JS on every page of their site and most follow this ...
1
vote
1answer
272 views

Is it possible to execute xss under these conditions?

Is it possible to execute xss under the following conditions? The following blocked characters and words are replaced with _. characters: > , : , ; , " , ' , # , ~ , \ , % , ( , ) , [ , ] , { , } ...
0
votes
3answers
492 views

DOM XSS : Need Help

I was trying my hands at DOM based XSS. I came across a scenario where user controlled string from the URL is included in javascript as below var userControlled=substring of URL; ...
4
votes
2answers
123 views

To What Extent does an Attacker Have Access to the Browser History through the CSS Pseudoclass :visited Styles?

I have read this article on how a scripted web page is able to obtain the visited history of a user browsing the page. However, I can't find any clear information in the article describing the extent ...
3
votes
2answers
698 views

SJCL : convert ascii to a BitArray & compute random numbers

I am using the Stanford Javascript Crypto library and i'd like more information about it. 1.) I have an ASCII text and a random 128-bit key. I want to concat those two things, so I convert the ASCII ...
2
votes
2answers
406 views

Need help deciphering malicious JS code

was hoping someone could give me a hand with deciphering this obfuscated Javascript added to a webpage that I own. As the code is quite large I will just link to pastebin posts but I can add them to ...
1
vote
3answers
443 views

What is the risk of cross site scripting if I embed javascript into a website

What is the risk of cross site scripting, if I embed javascript into a website? Quite simply, I am using a 'site builder', and they don't allow rotating images, but they allow you to embed code... So ...
2
votes
1answer
113 views

Unusual ownership-ID using localStorage; any possible issues?

I'm working on a small side project in PHP. I may yet include some sort of actual username/password registration down the line, but for now, for ease of attracting attention, my goal is to allow for ...
1
vote
1answer
275 views

If my website does not take any user input, is there any danger in showing my code and folder structure?

First time posting here; apologies for any mistakes I've made, please edit, retag, migrate as appropriate. I have a simple homepage whose purpose is (essentially) to contain my contact info and some ...
0
votes
1answer
269 views

Secure browser storage

Where is a secure place to store a "secret" in a web browser that a User has access to and JavaScript does not? Thinking was along the lines of web history, bookmarks, built in password manager & ...
3
votes
3answers
7k views

Why is JavaScript disabled in the Tor Browser Bundle?

Didn't Tor create a local socks proxy? Why doesn't all the Web traffic go over this local socks proxy and why is JavaScript disabled in the Tor Browser bundle? If you would connect with firefox for ...
1
vote
1answer
6k views

Create RSA public, private key pair having numbers generated already

I want to know to to generate working RSA key pair, with correct syntax. Let's say i have already generated somehow my numbers for 512bit key, which are: e = 00065537 d = ...
2
votes
3answers
2k views

Javascript containing a long hexadecimal string and eval: is this suspicious?

At the bottom of the index.php file for a simple “contact us” form, I found the following (some whitespace and newlines added): try {if(window.document)--document.getElementById('12')} catch(qq) ...
42
votes
3answers
4k views

I found obfuscated code in a comment on my blog. What should I do?

Today I was checking comments on my blog and I found a strange comment, here is the exact text <script>var ...
1
vote
3answers
940 views

Implementing 'Remember Me' for a mobile application

I am developing a mobile application wherein I need to implement the 'Remember Me' functionality. There are certain pages within the application which require you to login. What I need to do is, if ...
0
votes
2answers
392 views

Hide XSS payload

Scenario : There is a persistent XSS on a page with the username information. The username is present three times in the page, is visible only once and the visible one is correctly escaped. How ...
9
votes
3answers
406 views

How could the string \";alert('XSS');// be used for XSS?

I was using Burp Suite for some testing and I noticed that they included the following string: \";alert('XSS');// as an attack string for an XSS payload. How could this string be used to execute ...
1
vote
1answer
2k views

In which ways could a javascript making a cross domain HEAD request be a threat?

I was just reading this answer to the question Why is the same origin policy so important? Basically, when you try to make an XMLHttpRequest to a different domain, the browser will do one of two ...
2
votes
4answers
806 views

Are malicious scripts in batch files detected by antiviruses?

we have many scripts in shared folders in our IT Department. Are malicious scripts in batch files detected by antiviruses?
9
votes
5answers
3k views

How to validate if a JavaScript library is secure?

I'm the main developer for an Open Source JavaScript library. That library is used in the company I work for, for several clients. Every now and then there is a client that feels paranoid about ...
5
votes
2answers
498 views

How to ensure that files uploaded by users do not contain any XSS code

I have been working on providing the security related to the XSS attacks. My website only allows following mime-types: XML, CSV, HTML, PLAIN, VND_WAP_WML, APPLICATION_ZIP, APPLICATION_PDF, ...
14
votes
2answers
607 views

Does it make sense to hash a session id before passing it to an advertisement partner?

My company runs a webshop. We work with a partner that gives discount vouchers to our customers after they buy (the vouchers can be used in other online shops) and also gives vouchers for our shop to ...
7
votes
4answers
807 views

Security attacks on PHP web applications

I know about following security attacks on php applications (html,php,js). XSS SQL Injection CSFR Session Hijacking /Fixation Code Injection Remote file injection Should i know about any other or ...
1
vote
1answer
228 views

When a browser extension or user script pulls a JS file from Google's CDN, how does this compromise the user's privacy in terms of Google's reach? [duplicate]

The context from which my question has arisen is this user script which locally removes ads from Ixquick.com, which is an anonymizing 'proxy' search engine that gives the results from Google's index ...
2
votes
3answers
2k views

Javascript Diffie-Hellman and AES protocols

I am using the BigInteger Javascript library to create a symmetric key using Diffie-Hellman protocol. I want to create 128,160 or 192-bit keys. After some research, I have found out that I should use ...
3
votes
2answers
321 views

Injecting information in a web page (Gmail). Does it raise security problem?

I am developing a Google Chrome extension which encrypts/decrypts emails for Gmail users. So, I detect encrypted emails when the user opens an email on using tags. Once an encrypted email has been ...
11
votes
2answers
425 views

What should I look for when auditing a Firefox extension / plugin?

I've been asked to do a security audit on a Firefox add-on developed by a third party. I am a web developer with a reasonable grasp of JavaScript but am not a browser security expert. What kinds of ...
13
votes
3answers
1k views

What bad coding practices makes a browser extension vulnerable?

I'm trying to scan JavaScript files for vulnerabilities using JSHint. Specifically, I'm scanning the JavaScript files of browser extensions. To look for possible vulnerabilities I'm looking for bad ...