The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

learn more… | top users | synonyms

1
vote
2answers
96 views

What would typically be considered an acceptable string entropy for passwords?

I have gained interest in creating a way to check password strength (think password strength meters - yes - another one). I've found many ways to award a score on a policy driven approach (one ...
1
vote
2answers
204 views

CSRF by manipulating HTTP headers from client side using JavaScript

I am trying to do CSRF vulnerability analysis for my website. My website uses an anti-CSRF-token which is sent by the server to the client with the session cookie and then Javascript in the client ...
3
votes
1answer
39 views

Solution for Enterprise SW Eng. with Github and NPM [closed]

Can anyone share an architecture or framework that supports the use of Open Source software in enterprise software development environments? I'm seeking solutions to manage and mitigate the risk of ...
21
votes
4answers
5k views

Suspicious JavaScript in website header

I am not sure if this is the correct place to ask a questions such as this, apologies if it isn't. I have found the below code in the header of one of my wordPress websites, I am pretty sure it is ...
2
votes
2answers
99 views

which encryption is used in this JS Variables

Which encryption method is used for these variable names: var g_license_info var g_server_time_obj Respectfully encrypted to: var ago05b4e111efe149737a67a177f00ffad2 var ...
2
votes
1answer
197 views

OAuth 2.0 client side redirect instead of HTTP redirect

I'm implementing an OAuth 2.0 authorisation server using the Authorization Code flow (i.e. users will authorise client apps to connect to our server). The auth server is the same as the resource ...
2
votes
1answer
107 views

Mitigating reflected XSS in node/express requests for static assets

I've asked this on Stack Overflow because it is related to a programming problem (how to mititgate vulnerabilities in code) but I do have some broader questions, and a lack of understanding about how ...
0
votes
0answers
33 views

XSS script syntax problem

I have a server running on port 4444 on localhost that just echoes messages it receives. I have a JS script embedded in a message that is supposed to send the cookies of whoever looks at it. Here ...
1
vote
2answers
886 views

can web application disable browser's password manager's remember feature for that application?

Is there anything a website code do to prevent any browser from remembering your password? I am aware that from browser's options, users can change setting to ask to remember password or not. But can ...
-1
votes
2answers
228 views

Things to look for a backdoor in web application source code (.PHP, .JS, etc files) [closed]

I am in the process of adding functionality to a web application and I will be receiving some source files (PHP, JS, and CSS) from a hired external developer. These files are not obfuscated or ...
0
votes
0answers
40 views

Widget to client web encryption on an uncontrolled LAN

I asked a broader question related to this on serverfault, but I think probably the specific case I'm thinking of might be best considered here. My basic problem is this: I am providing physical ...
2
votes
1answer
321 views

Hashing user passwords via Javascript client-side versus server-side hashing? [duplicate]

I got into a discussion with one of our senior developers over password hashing/transmission best practices and it left me curious as to what the industry standard best practice is. In the ...
2
votes
2answers
296 views

Attack using weird characters followed by some javascript in a URL?

I'm seeing a very weird attack this morning from a pile of VPS instances spread out across the US. The URLs look like this: /js/bundles/,!0):this.element.propAttr( ...
2
votes
2answers
1k views

If using htmlentities or htmlspecialchars functions is enough for block XSS attack

I know this question was discussed on net various times. and people give some example how to bypass these functions through passing some code. But here one issue, All example of ...
-1
votes
3answers
1k views

Why no support for TCP Sockets in JavaScript [closed]

I know there are now WebSockets, but what is the issue with providing a socket API to allow interacting with existing protocols? I mean, after all, I can use a hidden flash object to do the same ...
7
votes
2answers
551 views

Do Javascript malware signatures exist?

Are there signatures for malicious JavaScript codes as they exist for other viruses/worms/trojans developed in other programming languages ? If so, are these JavaScript malware signatures defined ...
1
vote
2answers
600 views

With javascript in the browser, how can I sign some data without directly manipulating a private key?

With JavaScript in the browser, I need to digitally sign some data. I'm looking at the new Crypto.Subtle api, specifically the sign() and importKey() methods. I want, very reasonably I feel, to ...
2
votes
2answers
100 views

Can 3rd party JavaScript libraries access the http headers of the hosting html page

So, I have website, it uses a cookie stored in the http header of the downloaded html document to maintain the session while the end user is logged on and accessing there 'secure' data. This webpage ...
4
votes
2answers
362 views

Security of Firefox extensions such as Mailvelope

I am asking these question because I am not very familiar with JavaScript or the Firefox plugin/extension system. The specific context is the Mailvelope pgp extension but the questions are general and ...
3
votes
2answers
224 views

Why browsers implement stricter policy for local files

I have a problem viewing HTML/JS/CSS files generated on disk. Specifically, several calls in javascript are blocked by Google Chrome. I googled and found an answer here: ...
6
votes
2answers
29k views

XSS cookie stealing without redirecting to another page

I'm practicing in VM following the OWASP guide. I know that is possible to steal the cookie by redirecting to "False" page etc. but I would like to steal the cookie without redirecting on another ...
4
votes
1answer
211 views

Can source javascript files be infected from a developer's machine?

First a little bit of background, About two weeks back one of the developers in my team said they were seeing advertisement popups and links appearing all over the web app we were developing, when ...
1
vote
2answers
421 views

Is this sanitizer vulnerable to XSS?

To have a simple and secure editor for text fields of a django app, I have this snippet to sanitize input html into django code: from bs4 import BeautifulSoup def sanitize_html(value): ...
2
votes
3answers
533 views

How to spoof my IP address to JavaScript and other security concerns

Many websites require JavaScript. However, enabling JS means that a website can run a JS snippet to retrieve the user's IP address (even if they are behind a proxy or VPN). So, how can I (the user) ...
1
vote
3answers
270 views

Is this code javascript vulnerable to DOM based XSS?

Code : <script> document.theform.reference.onchange = function(){ var id = document.theform.reference.selectedIndex; var url = document.theform.reference[id].value; ...
1
vote
1answer
114 views

Is it possible to get a flash src after a redirect or an element inside an embed/object/iframe tag (cross-domain)?

The URL example.com/auth will automatically redirect the user (HTTP 302) to example.com/signed_in.SWF?token=SENSITIVE. Is it possible for an attacker to steal the token, using javascript or flash, in ...
5
votes
2answers
2k views

Is it possible to create a secure chat web application relying on HTML5 web sockets?

Is it possible to create a secure chat web application using just HTML5 and Javascript? What possible security holes would there be if the server doesn't store the messages, just relay them using ...
3
votes
1answer
146 views

Securely identify clients by web app

I have a web service S that provides certain services. There are two web apps, A1 and A2, both on different servers within the same VPN, which I trust and want to grant access to my web service. ...
7
votes
3answers
144 views

Automatic detection of a compromised web server

I'm trying to figure out if it is possible to automatically detect the the fact that the HTML or javascript files on a server have been tampered with or changed by an attacker. Our website, say ...
3
votes
2answers
5k views

Are these both cross frame scripting attacks?

I've received a recent security review of a website which mentioned it had a cross frame scripting vulnerability. In short, it mentioned that a malicious site could load the page up in an iframe, ...
40
votes
4answers
6k views

Have computer criminals been known to exploit easily-edited websites like Wikipedia to embed malicious scripts?

When I was reading a page on Wikipedia several months ago (December 2014) I saw what looked like a pop-up window from BT, but I soon realized that when I closed the page the pop-up disappeared. I then ...
10
votes
3answers
309 views

Are bookmarklets safe with facebook data?

I usually play Mafia Wars and use bookmarklets like Spockholm, Arum, etc. Can these bookmarklets get my Facebook data when I run them, they usually ask to unframe the Facebook page? I was just ...
8
votes
6answers
37k views

Playing with Referrer Header

There are 2 sites: http://www.site1.com http://www.site2.com http://www.site1.com contains link to http://www.site2.com as <a href="http://www.site2.com/">link<a/> When user clicks ...
2
votes
0answers
80 views

Do any specific steps need to be taken into account for the user's browser and browser caching for a HIPAA compliant web application?

I'm currently writing a web application that will need to be HIPAA compliant. It is very JavaScript heavy, and ePHI will be sent over an encrypted connection in the form of JSON. The transmission ...
5
votes
1answer
153 views

Are there cases where malicious scripts on websites breached the sandbox of a browser so that files on the user's computer could be accessed?

Whenever a hosted script on a website tries to access a file on a user's computer the sandbox prevents it, but has there been any documented case where this sandbox obstacle was somehow overcome by ...
0
votes
1answer
106 views

xmlhttprequest with https - can I test the fingerprint before sending any data

I am making https calls in javascript via xmlhttprequest. I know the server and its public key in advance. For extra security, I would like to check the public key (or its fingerprint) if its is what ...
2
votes
2answers
419 views

http_only for cookies with JWT tokens

I'm trying to figure out how to use JWTs that are transmitted in cookies for an SPA It needs to be in cookies because we want non-ajax requests to also send the jwt, and it should "just work" for all ...
2
votes
0answers
57 views

Can static analysis of JavaScript be done?

Is it possible to statistically analyze JavaScript to find obfuscated JavaScript? Any algorithms or equations with coefficients that can find obfuscated JavaScript?
4
votes
1answer
1k views

How to secure my REST implementation for an ember.js app

I've been searching and searching for what seems days and have not come up with any definitive answer on a solution to my problem. To explain without going into terrible detail I am building a store, ...
4
votes
4answers
618 views

Is flash or javascript a bigger security concern? [closed]

Many flash website whitelisting extensions for chrome (such as flashblock and flashcontrol) use javascript in order to selectively block Adobe Flash from functioning. Thus, In order to get this ...
2
votes
1answer
766 views

JS malware detection

Is there a way to detect a malicious JavaScript code within a webpage before the script runs on my computer ? I want to develop a Python script that prevents from 8 JS malwares that I can embed on my ...
3
votes
4answers
647 views

Famous XSS attacks over JavaScript [closed]

I'm about to graduate in "Computer Science", and I'm writing thesis about the Javascript vulnerabilities. In particular, I'm analyzing the JS vulnerabilities that allow XSS attacks. I would like to ...
4
votes
3answers
784 views

What to do when iPhone is successfully phished

My girlfriend watched "some" pages on her iPhone and facebook.you-won.com page appeared. She didn't know how to get rid of that JavaScript alert, so she clicked OK. After that she closed the page, and ...
8
votes
4answers
4k views

Why disable JavaScript in Tor? [duplicate]

Why it is not advisable to use JavaScript with Tor? Yet with JavaScript, you cannot get the IP address of the user except through an external website. How could using JavaScript with Tor expose one's ...
0
votes
1answer
116 views

Is injecting malicious file with browser localstorage possible?

Lets say, I visited a "malicioussite.com" and the server had a "malicious.js" in it whose job is to write malicious code to my browser localStorage and save it to the my computer then execute it to ...
11
votes
1answer
791 views

Why can't you steal the synchroniser token to do CSRF? [duplicate]

I'm reading up on CSRF and I came across synchroniser tokens. I don't understand why you can't do a CSRF to get the token to do a real CSRF. Example: bank.com has a form like this at ...
3
votes
1answer
512 views

Google Analytics use of JSONP, what are the security risks?

These days Google Analytics uses a JSONP request to load ga.js into user's web pages via a callback function. According to the Wikipedia, JSONP can "inject any content into a website." What exactly ...
0
votes
2answers
100 views

Random characters and letters form obsfuscation

I know that this question has been asked many times, but would JavaScript encryption work if I just added 100 random numbers and letters to the password? That would be hard to reverse engineer, ...
1
vote
1answer
84 views

What kind of attacks do Javascript WebWorkers protect against?

What kind of attack are prevented by running code submitted by the user in a Javascript Web Worker? Do they prevent attacks like XSS, or is it better to use some other sandboxing method to protect ...
2
votes
1answer
257 views

How sharing location via web actually works? (It gets my exact house address)

I know that this could be a repeated question, but I'm freaked out right now, Maybe Im old or out of the 2015 technologies, but i just visited this page: http://whatismyipaddress.com. As I know, ...