The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

learn more… | top users | synonyms

7
votes
3answers
140 views

Automatic detection of a compromised web server

I'm trying to figure out if it is possible to automatically detect the the fact that the HTML or javascript files on a server have been tampered with or changed by an attacker. Our website, say ...
3
votes
2answers
4k views

Are these both cross frame scripting attacks?

I've received a recent security review of a website which mentioned it had a cross frame scripting vulnerability. In short, it mentioned that a malicious site could load the page up in an iframe, ...
40
votes
4answers
6k views

Have computer criminals been known to exploit easily-edited websites like Wikipedia to embed malicious scripts?

When I was reading a page on Wikipedia several months ago (December 2014) I saw what looked like a pop-up window from BT, but I soon realized that when I closed the page the pop-up disappeared. I then ...
10
votes
3answers
304 views

Are bookmarklets safe with facebook data?

I usually play Mafia Wars and use bookmarklets like Spockholm, Arum, etc. Can these bookmarklets get my Facebook data when I run them, they usually ask to unframe the Facebook page? I was just ...
8
votes
6answers
36k views

Playing with Referrer Header

There are 2 sites: http://www.site1.com http://www.site2.com http://www.site1.com contains link to http://www.site2.com as <a href="http://www.site2.com/">link<a/> When user clicks ...
2
votes
0answers
78 views

Do any specific steps need to be taken into account for the user's browser and browser caching for a HIPAA compliant web application?

I'm currently writing a web application that will need to be HIPAA compliant. It is very JavaScript heavy, and ePHI will be sent over an encrypted connection in the form of JSON. The transmission ...
5
votes
1answer
150 views

Are there cases where malicious scripts on websites breached the sandbox of a browser so that files on the user's computer could be accessed?

Whenever a hosted script on a website tries to access a file on a user's computer the sandbox prevents it, but has there been any documented case where this sandbox obstacle was somehow overcome by ...
0
votes
1answer
102 views

xmlhttprequest with https - can I test the fingerprint before sending any data

I am making https calls in javascript via xmlhttprequest. I know the server and its public key in advance. For extra security, I would like to check the public key (or its fingerprint) if its is what ...
2
votes
2answers
372 views

http_only for cookies with JWT tokens

I'm trying to figure out how to use JWTs that are transmitted in cookies for an SPA It needs to be in cookies because we want non-ajax requests to also send the jwt, and it should "just work" for all ...
2
votes
0answers
54 views

Can static analysis of JavaScript be done?

Is it possible to statistically analyze JavaScript to find obfuscated JavaScript? Any algorithms or equations with coefficients that can find obfuscated JavaScript?
4
votes
1answer
1k views

How to secure my REST implementation for an ember.js app

I've been searching and searching for what seems days and have not come up with any definitive answer on a solution to my problem. To explain without going into terrible detail I am building a store, ...
4
votes
4answers
611 views

Is flash or javascript a bigger security concern? [closed]

Many flash website whitelisting extensions for chrome (such as flashblock and flashcontrol) use javascript in order to selectively block Adobe Flash from functioning. Thus, In order to get this ...
2
votes
1answer
727 views

JS malware detection

Is there a way to detect a malicious JavaScript code within a webpage before the script runs on my computer ? I want to develop a Python script that prevents from 8 JS malwares that I can embed on my ...
3
votes
4answers
557 views

Famous XSS attacks over JavaScript [closed]

I'm about to graduate in "Computer Science", and I'm writing thesis about the Javascript vulnerabilities. In particular, I'm analyzing the JS vulnerabilities that allow XSS attacks. I would like to ...
4
votes
3answers
625 views

What to do when iPhone is successfully phished

My girlfriend watched "some" pages on her iPhone and facebook.you-won.com page appeared. She didn't know how to get rid of that JavaScript alert, so she clicked OK. After that she closed the page, and ...
8
votes
4answers
4k views

Why disable JavaScript in Tor? [duplicate]

Why it is not advisable to use JavaScript with Tor? Yet with JavaScript, you cannot get the IP address of the user except through an external website. How could using JavaScript with Tor expose one's ...
0
votes
1answer
112 views

Is injecting malicious file with browser localstorage possible?

Lets say, I visited a "malicioussite.com" and the server had a "malicious.js" in it whose job is to write malicious code to my browser localStorage and save it to the my computer then execute it to ...
11
votes
1answer
761 views

Why can't you steal the synchroniser token to do CSRF? [duplicate]

I'm reading up on CSRF and I came across synchroniser tokens. I don't understand why you can't do a CSRF to get the token to do a real CSRF. Example: bank.com has a form like this at ...
3
votes
1answer
454 views

Google Analytics use of JSONP, what are the security risks?

These days Google Analytics uses a JSONP request to load ga.js into user's web pages via a callback function. According to the Wikipedia, JSONP can "inject any content into a website." What exactly ...
0
votes
2answers
99 views

Random characters and letters form obsfuscation

I know that this question has been asked many times, but would JavaScript encryption work if I just added 100 random numbers and letters to the password? That would be hard to reverse engineer, ...
1
vote
1answer
80 views

What kind of attacks do Javascript WebWorkers protect against?

What kind of attack are prevented by running code submitted by the user in a Javascript Web Worker? Do they prevent attacks like XSS, or is it better to use some other sandboxing method to protect ...
2
votes
1answer
236 views

How sharing location via web actually works? (It gets my exact house address)

I know that this could be a repeated question, but I'm freaked out right now, Maybe Im old or out of the 2015 technologies, but i just visited this page: http://whatismyipaddress.com. As I know, ...
3
votes
1answer
601 views

What are the best practices for (token based) security in a webapp?

I am designing a web application using Spring MVC with REST controllers and Angular JS pages which communicate with these REST controllers. I've implemented a token based security/ authorization ...
4
votes
4answers
3k views

bot detection via browser fingerprinting

I've recently noticed that a few companies have begun to offer bot and scraping protection services based on the idea of browser fingerprinting to detect them, and then blocking the specific ...
2
votes
3answers
121 views

Temporary XSS Vulnerability

I found xss on a textarea field. When you enter a character to this field it output the character in real time so when I input the following code: <input onclick=alert(document.cookie)> there ...
3
votes
2answers
442 views

Is it neccessary to use X-FRAME-OPTIONS to prevent ClickJacking attacks?

I use this Javascript Code, and it works perfectly: if (top.location != location) top.location.href = location.href Many researchers told me to not use this. Can any one bypass it? Are there ...
3
votes
0answers
72 views

How to indicate that content in an iframe is untrusted

As part of a website I am developing, untrusted content is displayed in a sandboxed iframe. The content is loaded using the srcdoc attribute, but the iframe is sandboxed using sandbox="allow-scripts", ...
1
vote
1answer
437 views

XSS payload to capture login credentials

I am trying to solve this exercise http://pentesteracademylab.appspot.com/lab/webapp/jfp/3. The objective of this is to "Post the Username and Password to Attacker Controlled Server". There is a url ...
14
votes
4answers
4k views

What are the security issues with “eval()” in JavaScript?

Every time that someone mentions eval(), everyone says that there are "security issues" with it, but nobody ever goes into detail about what they are. Most modern browsers seem to be able to debug ...
0
votes
3answers
719 views

What are the different payloads used for XSS vulnerability? [closed]

I am new to information security field. I am searching for XSS vulnerabilities. In XSS mostly they use <script>alert('XSS')</script> payload for attacking a websites. In the case of ...
-3
votes
1answer
99 views

Session hijacking [closed]

I know one way of doing session hijacking 1.copying the session value from the chrome browser and pasting the cookie value to firefox browser Is there any other way of doing session hijacking ? If ...
1
vote
1answer
92 views

Common characters/statements in obfuscated JavaScript [closed]

I'm trying to compile a list of common characters and statements in obfuscated JavaScript. I'm using http://aw-snap.info/articles/js-examples.php for obfuscated JS examples, but I cannot distinguish ...
2
votes
2answers
429 views

Is this password generator safe?

128-bit entropy is required http://nxtra.org/nxt-client/js/passphrasegenerator.js With all new browsers (Chrome, Firefox, IE 11) it uses crypto.getRandomValues which should be safe, but with IE 10 ...
3
votes
3answers
223 views

Any Security Risks for using mailto:?

I use a PHP script which performs a database search and when no result are found, user is presented with a mailto link with this format mailto:example@test.com?subject=SEARCHED_QUERY_HERE The ...
-1
votes
2answers
256 views

Obfuscated JS Code That Breaks On De-Obfuscating Or Debugging [closed]

How can I de-obfuscate this JavaScript? I see it opens a new window at www.google.com, but what else does it do? I can't open it in debugger it just doesn't work then? And is it malicious? Here is ...
7
votes
1answer
364 views

Javascript phishing attack sucker: Do I need to be worried? [closed]

So, I'm an idiot. I opened a javascript phishing attack file. I would really, really appreciate some help with decoding the Javascript to figure out whether I'm in trouble, and what sort. I'm on OS X ...
1
vote
1answer
104 views

Any standard tests to prevent hacking? [closed]

I am very new in programming world so my question may sound weird. I am useing selenium to test an application, yesterday one of my colleagues found this issue that if someone enters this: <script ...
9
votes
4answers
2k views

XSS using JSF**k

I was reading about JSf**k. From their website: JSF**k is an esoteric and educational programming style based on the atomic parts of JavaScript. It uses only six different characters to write and ...
0
votes
2answers
138 views

Hiding (Obfuscating) Java script [closed]

So i heard that obfuscating java script is useless and waste of time because anyone with a little of skill can decode your code. So i want to test that. This code will display a alert box saying hey ...
68
votes
4answers
25k views

Why is the same origin policy so important?

I can't really fully understand what same origin domain means. I know it means that when getting a resource from another domain (say a JS file) it will run from the context of the domain that serves ...
3
votes
1answer
416 views

Dom based Xss Query - location.hash

I was just looking at Dom based xss and wondering if hash value is written to a variable in javascript context can lead to Cross site scripting. The code looks something like this: <script> var ...
5
votes
2answers
3k views

Can a website make an HTTP request to “localhost”? How does it get around the cross-domain policy?

I found this website which talks about fixing a Redis vulnerability by exploiting that same vulnerability. The website in question has a "patch me" button, and if you have a password-less Redis ...
0
votes
3answers
448 views

Preventing SSL strip attack

Is it possible to detect a ssl strip attack by checking whether the page deliverd is https or http using javascript?I am assuming that the response page is https page instead of http?
0
votes
5answers
1k views

Using a Public-Key-Encryption browser side to avoid PCI compliance

We're developing a web application in which certain not logged users (clients) need to send their credit card details to other users (merchants) - which, we'll assume, are PCI compliant. We are ...
5
votes
4answers
1k views

Client side encryption - only web browser available

I am creating an enterprise application, the server side runs a whole set of different apps, On the client side, there is only a webpage, no applet or anything else. Unfortunately data created by the ...
2
votes
2answers
442 views

Would usage of jCryption 3.0 + SSL have mitigated the Heartbleed vulnerability?

I came across a project called jCryption 3.0, which encrypts data between the client and server, without using SSL. If a website's JavaScript had used jCryption 3.0 to encrypt login form fields before ...
5
votes
1answer
145 views

Video site requests Adblocker to be shut off, next day I have 3 “weird” bookmarks

I was on a site trying to view a video and the site requested that I turn off my adblocker to view the video. So I did and then the next day I noticed that I had 3 "weird" bookmarks in my bookmark ...
2
votes
0answers
96 views

Suspicious web-application requests containing encoded JavaScript function(?)

I've been seeing some odd traffic in the logs for a web-application (Apache) that I'm wondering about, and I'm hoping that someone here has seen this before. The raw requests were variations of: ...
0
votes
0answers
152 views

injecting javascript in webviews in Android

I am relatively new to mobile application security. Currently I am supposed to audit an android application which uses a webview to display some static FAQ page in an activity. The webview in ...
2
votes
3answers
287 views

How do anti-viruses identify malicious pages when JavaScript doesn't have access to the filesystem anyway?

Disclaimer : I am not very knowledgeable about the behaviour of anti-viruses (anti-viri?). I was wondering how they discern between malicious and non-malicious pages if all they can read is the HTML ...