The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

learn more… | top users | synonyms

3
votes
2answers
2k views

Is XSS possible here? Challenge

Is possible to bypass my regex and execute any javascript? <script> function json(a){ if (/^\s*$/.test(a) ? 0 : /^[\],:{}\s\u2028\u2029]*$/.test(a.replace(/\\["\\\/bfnrtu]/g, ...
3
votes
1answer
449 views

Is this code harmful? Why?

Code: http://pastebin.com/kJ8ZGP82 That code gets retrived from http://ui.sidepage.co for every HTTP page I visit (not HTTPS) and load it into the body tag of the page. Is it harmful in any way? ...
-1
votes
1answer
299 views

how to secure my login user id and passwords specially for facebook [closed]

i think they hack me with facebook cookies. i dont get what exactly is going on with me. every time i get the login notification from another ip location.i want to secure my cookies and i wanted to ...
1
vote
2answers
668 views

HTTP Response Splitting

Is this apart of a HTTP Response Splitting attack ? Here below is some code that gets put into a web browser after clearing the url while on the website javascript: var xhr = new XMLHttpRequest(); ...
3
votes
4answers
96 views

What is the technique to determine if a user is “reading” a page called? (similar to “infinite scroll”)

When I read an article at Salon.com I notice that the "overflow content" (where I need to scroll down) is loaded on demand. I can't imagine this being a useful bandwidth savings technique, so the ...
1
vote
2answers
240 views

Is a browser with disabled scripts and disabled java enough against malware

Is a browser like Firefox with disabled scripts (for example via a plugin like no-script) and disabled java enough to be protected against dryve-by-malware from the internet. Of course this does not ...
-1
votes
1answer
167 views

Idea feedback wanted - easy and secure web notes manager (javascript) [closed]

I have an idea for a web app that I'd like to discuss. I like it a lot but chances are that I missed some evident security hole. Or, maybe it just sucks. The idea is a web-based secure text notes ...
3
votes
2answers
323 views

Should the Keygen element be used to create a certificate for mutual auth TLS? What alternatives are there?

I'm interested in using mutual auth TLS to improve the security of my javascript based webservices . I've looked at the Keygen element and given all its issues, not sure if this can even be used for ...
4
votes
5answers
12k views

Playing with Referrer Header

There are 2 sites: http://www.site1.com http://www.site2.com http://www.site1.com contains link to http://www.site2.com as <a href="http://www.site2.com/">link<a/> When user clicks ...
1
vote
1answer
128 views

How does window.w3ssss hack occur

Recently a .Net MVC 2 application on our server was infected with a virus / hack, it added some Javascript to the index.aspx pages of the site. While we have cleaned it up, I have not been able to ...
1
vote
2answers
743 views

How do I holistically protect a web service from network and MITM attacks?

I have several financial web services that are accessed over HTTPS, however the client devices may be accessing the web services over untrusted WiFi, through questionable proxies, and possibly ToR ...
3
votes
4answers
3k views

What does scorecardsresearch.com/beacon.js - added by Disqus.com - do?

I recently added Disqus to my site. Looking at the "scripts" tab on Firebug, I noticed a script called, http://scorecardresearch.com/beacon.js (here is a prettified version - the script is not ...
10
votes
1answer
662 views

How can I embed iframe securely without restricting its functionality?

I'd want to embed an iframe from untrusted site into web application. Iframe: should be able to run Javascript and browser plugins (Flash, etc.) should not be able to access my web application ...
8
votes
2answers
163 views

Preventing user supplied javascript from posting to external server

I am writing an internal tool that will support plugins written by other developers. Ideally, these plugins would have a Javascript component to allow people to make widgets. Some of the pages these ...
4
votes
2answers
144 views

Can webpages recognize that I saved my password?

If you save your logins in Firefox, username and password are auto-filled-in in corresponding webpages as soon as you visit them (if you have more than 1 account saved, you'd have to select a username ...
3
votes
0answers
66 views

Is the use of JavaScript for cryptography ever appropriate in the browser? [duplicate]

Possible Duplicate: How secure is aSSL (javascript)? Does it effectively mimic SSL? After some searching around, I realized we don't have an easily visible canonical question about this on ...
3
votes
1answer
255 views

How can I use certificates to secure my webservices? What is available to javascript?

I have a few web services that are accessed over public wifi connections and I think it would be a good idea to issue certificates to encrypt data, prevent MITM, and invalid impersonation (beyond what ...
2
votes
4answers
683 views

Are malicious scripts in batch files detected by antiviruses?

we have many scripts in shared folders in our IT Department. Are malicious scripts in batch files detected by antiviruses?
4
votes
4answers
589 views

Is it possible to make an xss with only html tags

I'm not aware of all the xss tricks.. While programming in Ruby on Rails, using a sanitize method to allow only certain tags and it makes its best to clear all the other tags and scripts the ...
1
vote
2answers
279 views

I need explanation on how serious these vulnerabilities are?

I have found two vulnerabilities on my college site and I want to report them but don't know if these are "really" vulnerabilities : RFI inside SWF file. Example: ...
13
votes
3answers
884 views

How secure is aSSL (javascript)? Does it effectively mimic SSL?

Some of you may be familiar with the aSSL project, which uses AJAX/PHP to mimic the SSL protocol. It uses RSA 512 or 1024 for the keys, and AES for the actual data. It looks impressive to me in ...
5
votes
4answers
566 views

Is JavaScript self-injection dangerous?

I have a toy web application that can be described roughly as a per-user key-value store. After logging in, the user can view and modify her set of key-value pairs. The keys and values are stored in a ...
3
votes
2answers
374 views

Can a whitespace regex character be used to perform a javascript injection?

if I want to validate the input of a <textarea>, and want it to contain, for example, only numerical values, but even want to give users the possibility to insert new lines, I can selected ...
5
votes
1answer
297 views

Cufon or Prototype as an attack vector for Blackhole exploit kit?

I've been asked to look into the security of a client site that's apparently throwing antiviral messages when visited. Specifics: It's being detected as a Blackhole exploit kit inside of a Cufon ...
0
votes
1answer
1k views

How to escape user input in a value of javascript object?

How to properly escape user-controlled input when it's inserted as a value in JSON object? <script> $(document).ready(function() { new MyObject({ key1: "user_input", key2: ...
7
votes
1answer
4k views

Iframe javascript Keylogger

Is it possible for a website to have a javascript keylogger and also contain an iframe that goes to a "client" site. Can the the JS log all key strokes done on the client site? Can the (host) iframe ...
7
votes
4answers
245 views

Limited JavaScript app scenario: Attack vectors and mitigation

I'm going to be developing a single page JavaScript app which allows input via a textarea. This input is never sent to the server, never shown to another user, and will only be persisted in browser ...
9
votes
5answers
3k views

How to validate if a JavaScript library is secure?

I'm the main developer for an Open Source JavaScript library. That library is used in the company I work for, for several clients. Every now and then there is a client that feels paranoid about ...
9
votes
2answers
481 views

User-specific Subdomains : JavaScript security

If I provide a public-facing website for users on my website at their own subdomain (e.g. bob.myapp.com) under their own control, can I allow them to execute arbitrary JavaScript without putting my ...
-1
votes
4answers
167 views

How secure is this login page? [closed]

Unfortunately I cant link to the page (it internal). But I can describe it! This is a lightspeed systems policy enforcement login page (content filter). The page is http and there is no iframe with ...
5
votes
3answers
4k views

Javascript Malware: How does it work, and how can it be mitigated?

I am wondering how malware gets served through Javascript. I've noticed a few illegitimate pop-ups while visiting some financial websites. I wonder how malware exploits work against the application ...
1
vote
1answer
1k views

How to prevent the following clickjacking attack?

The Security attribute was implemented to prevent XSS attacks in iFrames by disabling any JS implemented in the iFrame source, therefore indeed eliminating XSS attacks, but also disabling any security ...
10
votes
4answers
3k views

Generate cryptographically strong pseudorandom numbers in Javascript?

Is there any good way to generate cryptographically strong pseudorandom (or true random) numbers in Javascript? The crucial requirement: if a.com's Javascript generates some random numbers, no one ...
3
votes
2answers
462 views

Implementing brute force attacks on hash values in Javascript

I'm working for my bachelor thesis at the end of which I aim to implement a proof-of-concept Javascript-based hash cracker. The idea is to work like this: Users can submit a hash value along with ...
37
votes
3answers
17k views

Securing a JavaScript Single Page App with RESTful backend

I'm currently in the process of building a JavaScript SPA and have been researching how to secure it. There is currently as RESTful API that is being completely interacted with through AJAX. We also ...
8
votes
5answers
311 views

Is it a risk to highlight text while reading a webpage?

Whenever a user selects or highlights text on a webpage, an OnClick() event is generated. Some of the web browser security models depends on explicit end user interaction, such as OnClick(), before a ...
0
votes
1answer
589 views

scanning my site for JavaScript/XSS vulnerabilities [closed]

It have had a report that my site may have a security issue and there is some JavaScript loading 10 times per second. www.ayrshireminis.com Is there anyway that I can "scan" my site to check if ...
1
vote
0answers
146 views

What are potential use cases of script that identifies browser? [closed]

Let's say I've found a way to produce a unique string for each and every browser using pure Javascript (which makes it an alternative to UA strings). Now what I'd like to know is what are potential ...
1
vote
5answers
1k views

Is it secure to use jQuery on the server-side for user input validation?

I'm thinking about using jQuery on the server-side (node.js) to validate user input (filter tags, remove every attributes except href, rel, target & style, modify css rules which are applied ...
3
votes
2answers
553 views

Why do I get AV alerts when browsing a web page?

I'm using the latest version of Firefox and Windows is up to date. When I was browsing a webpage and clicked a link the browser displayed "connection has been reset" and AVAST poped-up saying "Alert!" ...
3
votes
1answer
220 views

Client-side cross-site access in SSL environment - when it's still possible to do?

I'm trying to imagine an secure sandboxed environment for an application which is big and unexplored, and may contain backdoors. It would live under chroot/virtual environment with no outgoing ...
1
vote
2answers
173 views

Why ban XSS instead of flagging it?

Consider a browser that allows an XMLHttpRequest downloaded from foo.net to make requests to bar.net, but attaches a XHR-Origin: http://foo.net (or possibly a more descriptive value like ...
1
vote
1answer
87 views

How to verify that a clientside-generated object is genuine?

I know that general best-practice states not to trust anything generated by the client. With that in mind, I want to write an HTML5 app that utilises the browser to generate various objects ...
1
vote
2answers
5k views

Encrypting string in javascript and decryption in java

I would like to know if someone know any library to do encryption in javascript and decryption in java. I have already tried many API, But getting not not getting same values in java. I want ...
1
vote
4answers
1k views

Shall I need to use MD5 algorithm in both JavaScript and PHP for login authentication?

I have a login form with username and password. I post this form data to a PHP file. For security reasons I want to encrypt my password in the database and network. Now I have done now following ...
9
votes
3answers
5k views

How can i find what hashing algorithm was used?

One of my clients has asked me to modify the login page that their board members use to access their materials. The problem here is that the person previously responsible for this has left no ...
11
votes
4answers
3k views

Challenging challenge: client-side password hashing and server-side password verification

We have a website where users need to log in to access privileged information. Obviously we are using SSL, but I also want to avoid plaintext passwords from accidently ending up in server logs, or ...
-1
votes
1answer
221 views

Why don't G+, Facebook and Twitter use text editors to share? Why would someone receive each separately? [closed]

I've seen sites use text editors as below: What is the risk in using these? G+ receives images individually, others receive it all at once. Could someone shed some light on it?
3
votes
2answers
227 views

How to defend against invalid UTF7/8 that hides a <script> tag?

I'm scanning HTML before it reaches a browser, and I've just heard about a type of exploit that uses invalid UTF7 or UTF8 sequences to embed an otherwise invisible script tag, which is used to execute ...
4
votes
2answers
407 views

Are sandboxes overrated?

I've stumbled upon the following on the blog of the NoScript developer Giorgio Maone. First, he quotes the following ArsTechnica article about an XSS bug in Adobe Flash: As useful as sandboxes ...