The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

learn more… | top users | synonyms

0
votes
2answers
329 views

Is it possible to modify a support .js file in a web application by injection?

Let's say there is a web application needing a JavaScript support file .js to be loaded in the head of the html document. <!DOCTYPE html> <html> <head> <meta ...
4
votes
1answer
894 views

Is 'Forge' Javascript crypto library secure? [closed]

I need a client-side crypto library. I've seen https://github.com/digitalbazaar/forge linked many times on stackexchange. Forge seems to be the most complete and well-documented crypto library for JS. ...
2
votes
0answers
1k views

AngularJS Static Analysis Tools [closed]

I am setting up a software security initiative at a small software company. Part of this is selecting a static analysis tool for early and automated detection of security vulnerabilities. Many ...
4
votes
1answer
279 views

Why would a user agent string be executed?

I'm having trouble understanding how a particular XSS vulnerability might arise in the real world. Guides for two of the exercises on hackthissite.org: ...
9
votes
4answers
512 views

Does my UI need to be secure if my API is?

I'm working on a project that is creating two new, separate web modules (possibly even on different servers) to support a new web application, with one serving up a static JS-based UI and the other ...
5
votes
2answers
760 views

Is it safe to use createHTMLDocument to sanitize HTML?

i'm wondering how safe it is to use createHTMLDocument to do HTML sanitization. I've tried to implement it like this: function sanitize(string) { var elm = ...
1
vote
1answer
335 views

Hashing Passphrase in Client-Side JavaScript Rather than Server-Side — Is it Viable?

Yet another salting-and-hashing-for-web-sites question has been left on the doormat of Information Security's StackExchange. The oft-mentioned approach for website password-handling is to use a ...
1
vote
1answer
87 views

Base Programming for vulnerabilities

Hello, I am a beginner looking for some information. My question is the following: In order to understand certain security concepts is it essential that I understand the underlying languages? For ...
-2
votes
1answer
474 views

Injected Images

I want to learn all about that. How can we inject code into an image? Is the code must be php? Or is javascript or HTML works too? How I find documentation about this article? I'm a newbie about ...
1
vote
1answer
197 views

Can a Java servlet filter be used to pull out scripts that aren't whitelisted?

I might be asking a similar question to this: Whitelisting DOM elements to defeat XSS But I think my proposed solution is different and I was wondering if I could get the community to comment on ...
3
votes
2answers
11k views

XSS cookie stealing without redirecting to another page

I'm practicing in VM following the OWASP guide. I know that is possible to steal the cookie by redirecting to "False" page etc. but I would like to steal the cookie without redirecting on another ...
0
votes
2answers
304 views

Have I crossed my t's and dotted my lower-case j's? (or, implementing AES, please help get some eyes on my code)

So, I used the crypto module in node.js to implement a secure key generator and encrypt/decrypt functions. Knowing that security's best friend is a spotlight on the implementation, I want to throw it ...
3
votes
1answer
213 views

Danger of hidden html form uploading users local files without their knowledge

Is there a danger that a webpage could have a hidden form with a file upload input and js script that would try and take a random guesses at files on a users system and attach them to the form and ...
0
votes
1answer
3k views

Javascript http to https redirect - how vulnerable/how secure? [duplicate]

If I had a website http://site.com redirecting to https://site.com via javascript (with a HTTP/1.1 403 Forbidden), what are the attack vectors I could be vulnerable too? Why is this not a good ...
0
votes
1answer
102 views

Self-changing javascript characters in text editors

On Windows Server 2008-R2, certain javascript files are exhibiting the same behavior. Text can be copied from other files and pasted into new ones. In both NotePad++ and Windows' default notepad, ...
0
votes
1answer
412 views

Custom rest api / client security scheme

Right off the bat, I'd like to know if there is a widely used library or standard that I could adopt to replace my "custom" scheme. I am certain that I, as one person, cannot produce something better ...
1
vote
2answers
4k views

Ways to completely spoof browser user agent and hiding OS to a webserver

This is a follow-up to the following question: Can a website determine what OS or web browser a visitor is using if the useragent is blanked/changed? If I have understood the answers correctly, a ...
2
votes
1answer
121 views

Chrome inline JavaScript string interpreatation

If you have an HTML file that contains the following code : <!doctype html> <html lang="en"> <head> <meta charset="UTF-8"> </head> ...
2
votes
1answer
807 views

Cross site Scripting in HTTP Method?

Lately, I've noticed that many web server configurations reflect the method of an HTTP request sent with a non implemented method in the body of the server's response. For example, A request sent ...
5
votes
2answers
2k views

Risks of client-side encryption using Stanford Crypto Library

I'm building a simple web application for encrypted chat. Each message will undergo 256-bit AES encryption on the client side, using the Stanford Javascript Crypto Library. No unencrypted data or ...
4
votes
2answers
2k views

UTF-7 XSS attacks in modern browsers

I've recently read about utf-7 XSS-attacks (i.e. Ned Batchelders article at http://nedbatchelder.com/blog/200704/xss_with_utf7.html) but could not get any UTF-7 attack to work in modern browsers. (I ...
5
votes
2answers
203 views

Any eventhandlers that apply to hidden elements?

Im trying to XSS a search field and my attack vector is getting reflected like this: <input type="text" id="txtRpHiddenKeyword" style="display: none;" value="ATTACK VECTOR HERE" /> Only ...
-1
votes
2answers
223 views

Protecting sensitive content in JS source code and Ajax cals [closed]

I've been trying to see how to properly protect important content that's passed in ajax calls with java script. Considering JavaScript can be viewed at any point, it is inevitable that some of your ...
0
votes
2answers
334 views

NGO Joomla! site: Infected with malware? JavaScript injection?

Please help us with this NGO site running Joomla! 1.5. They can't pay a security professional right now, so maybe you guys can help isolate the problem? If you go to http://casatrespatios.org you ...
12
votes
4answers
1k views

How do I protect myself from clickjacking attacks?

I've seen many friends getting clickjacked on Facebook and similar sites. How does one detect and prevent clickjacking? How should I teach my friends to do the same?
0
votes
1answer
94 views

Seeking help with implementing SCRAM in .NET

I'm late to the party and need to be caught up. I'm doing my homework looking things up. I know that I don't want unsalted challenge-response CRAM, I want salted challenge-response SCRAM. I think ...
1
vote
1answer
260 views

How do you limit javascript api to a domain?

Ok, many of you now the scenario: you login to developer.sayLinkedIn.com, create an app with credentials and define the domain in witch that key is allowed to "run". The question is, from a api ...
3
votes
1answer
810 views

Access-Control-Allow-Origin header spoofing?

Is it possible for a attacker to spoof the Access-Control-Allow-Origin header? Or, is it secure enough to protect resource access via the Access-Control-Allow-Origin header? I'm trying to make an ...
1
vote
1answer
763 views

Security implications of adding all domains to CORS (i.e. Access-Control-Allow-Origin: *) [duplicate]

I am curious of what all the security implications are if I set the following two HTTP response CORS headers; Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false The only ...
4
votes
1answer
4k views

Is it safe to give an Oauth token to client side javascript so it can directly make requests to a server?

I currently have a simple backbone.js application served from my domain (example.com), which is provided an Oauth token. Specifically, I pass the Oauth token through my page template into the ...
0
votes
1answer
96 views

Verifying one specific attack vector of Cross Site Scripting

Burp suggests that there is a reflection.. It changes a value of a cookie named as x as x=<script src=abc.js> and in response this value gets injected to a javascript function.. <script ...
4
votes
1answer
923 views

OWASP Recommendation on Client-Side Password Hashing

The OWASP Application Security FAQ recommends the use of JavaScript to produce a salted hash of the password client-side with JavaScript prior to sending it to the server. Is this something truly ...
-1
votes
1answer
503 views

Open Source tool for analysing javascript for security vulnerabilities [closed]

I am completely new to this field and am a college student. I am looking for a static code analysis tool that scans the source code of a web app ( NOT the URL) for security vulnerabilities. So far i ...
2
votes
1answer
3k views

Are these both cross frame scripting attacks?

I've received a recent security review of a website which mentioned it had a cross frame scripting vulnerability. In short, it mentioned that a malicious site could load the page up in an iframe, ...
1
vote
2answers
1k views

What's the limit on the size of the data that public-key cryptos can handle?

Someone mentioned here that asymmetric encryption might not be appropriate for bulk data and gave an example of RSA with 100 bytes. Of course, I understand that it was a rough example. But it made me ...
3
votes
4answers
4k views

How to stop other websites from sending cross domain AJAX requests?

From two different applications, I was able to send cross-orgin requests. Though the browser returns a "cross origin" error my server is still receiving and executing the request. For example, from a ...
1
vote
2answers
329 views

Can older or custom web browsers override the same origin policy?

I totally understand the basis of origin policy and the reasoning why all modern browsers have put this policy into place. My question I guess is, do older browsers support this, and if they don't, ...
-1
votes
1answer
174 views

Reflected XSS Prevention plugin [closed]

Is there any plugin out there which prevent reflected XSS? Plugin could be either for firefox or chrome. Thanks.
1
vote
1answer
205 views

Does Google Analytics collect any information about the contents of the web page?

If I enable Google Analytics on my web application, does the Google Analytics Javascript collect any information on the web page (any of the content on the page)? Does it collect any information ...
1
vote
1answer
314 views

Security implications of hosting third-party Javascript [duplicate]

A client of ours wants us to host a blob of Javascript for their custom-branded version of our website. It is hosted on a subdomain of our site (customer.example.com), but uses the same cookie domain ...
2
votes
1answer
2k views

Calling JavaScript functions from within a Style tag XSS

I've identified an XSS in a client's application where they've failed to properly sanitize a variable. The application, however, is written in ASP.NET 2.x and they have request validation turned on. ...
9
votes
4answers
1k views

I've encountered JavaScript attack code - how do I search for information on the exploit's specifics?

So, I clicked on a reasonably-looking LinkedIn invite, not thinking about hovering overing the link first, since usually the e-mail client warns me about such things. Once I realized I landed on an ...
1
vote
1answer
70 views

Gaining sensible information from advertisement displayed in web pages

As we all know, JavaScript loaded inside a website A gets restricted to access the domain itself [same origin policy]. Unfortunately, same origin policy does not apply to newly created DOM nodes, ...
5
votes
1answer
627 views

Child iFrame hash verification of parent iFrame content

Consider the following scenario: Alice wishes to browse Victor's website while on the job at Initech. Victor's website is hosted on an alternative domain name system to which Initech's DNS does not ...
4
votes
2answers
146 views

To What Extent does an Attacker Have Access to the Browser History through the CSS Pseudoclass :visited Styles?

I have read this article on how a scripted web page is able to obtain the visited history of a user browsing the page. However, I can't find any clear information in the article describing the extent ...
1
vote
1answer
293 views

Is it possible to execute xss under these conditions?

Is it possible to execute xss under the following conditions? The following blocked characters and words are replaced with _. characters: > , : , ; , " , ' , # , ~ , \ , % , ( , ) , [ , ] , { , } ...
2
votes
1answer
159 views

Sandboxing user input html

I want to render user uploaded HTML (consisting of possibly many files with images, custom css, custom js, all uploaded in a zip file) for preview purpose. The user that submits the html will be the ...
2
votes
2answers
449 views

Need help deciphering malicious JS code

was hoping someone could give me a hand with deciphering this obfuscated Javascript added to a webpage that I own. As the code is quite large I will just link to pastebin posts but I can add them to ...
1
vote
3answers
495 views

What is the risk of cross site scripting if I embed javascript into a website

What is the risk of cross site scripting, if I embed javascript into a website? Quite simply, I am using a 'site builder', and they don't allow rotating images, but they allow you to embed code... So ...
1
vote
1answer
549 views

How to detect if a site is using a JavaScript exploit?

Is there a way for me (non-expert in JavaScript) to detect JavaScript attacks from a website. I have done a lot of searching around and have not come up with a definitive answer. NoScript is a pain in ...