The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

learn more… | top users | synonyms

3
votes
2answers
2k views

Is XSS possible here? Challenge

Is possible to bypass my regex and execute any javascript? <script> function json(a){ if (/^\s*$/.test(a) ? 0 : /^[\],:{}\s\u2028\u2029]*$/.test(a.replace(/\\["\\\/bfnrtu]/g, ...
3
votes
1answer
478 views

Is this code harmful? Why?

Code: http://pastebin.com/kJ8ZGP82 That code gets retrived from http://ui.sidepage.co for every HTTP page I visit (not HTTPS) and load it into the body tag of the page. Is it harmful in any way? ...
-1
votes
1answer
321 views

how to secure my login user id and passwords specially for facebook [closed]

i think they hack me with facebook cookies. i dont get what exactly is going on with me. every time i get the login notification from another ip location.i want to secure my cookies and i wanted to ...
1
vote
2answers
766 views

HTTP Response Splitting

Is this apart of a HTTP Response Splitting attack ? Here below is some code that gets put into a web browser after clearing the url while on the website javascript: var xhr = new XMLHttpRequest(); ...
3
votes
4answers
98 views

What is the technique to determine if a user is “reading” a page called? (similar to “infinite scroll”)

When I read an article at Salon.com I notice that the "overflow content" (where I need to scroll down) is loaded on demand. I can't imagine this being a useful bandwidth savings technique, so the ...
1
vote
2answers
253 views

Is a browser with disabled scripts and disabled java enough against malware

Is a browser like Firefox with disabled scripts (for example via a plugin like no-script) and disabled java enough to be protected against dryve-by-malware from the internet. Of course this does not ...
10
votes
1answer
728 views

How can I embed iframe securely without restricting its functionality?

I'd want to embed an iframe from untrusted site into web application. Iframe: should be able to run Javascript and browser plugins (Flash, etc.) should not be able to access my web application ...
-1
votes
1answer
173 views

Idea feedback wanted - easy and secure web notes manager (javascript) [closed]

I have an idea for a web app that I'd like to discuss. I like it a lot but chances are that I missed some evident security hole. Or, maybe it just sucks. The idea is a web-based secure text notes ...
3
votes
2answers
371 views

Should the Keygen element be used to create a certificate for mutual auth TLS? What alternatives are there?

I'm interested in using mutual auth TLS to improve the security of my javascript based webservices . I've looked at the Keygen element and given all its issues, not sure if this can even be used for ...
4
votes
4answers
710 views

Is it possible to make an xss with only html tags

I'm not aware of all the xss tricks.. While programming in Ruby on Rails, using a sanitize method to allow only certain tags and it makes its best to clear all the other tags and scripts the ...
1
vote
1answer
143 views

How does window.w3ssss hack occur

Recently a .Net MVC 2 application on our server was infected with a virus / hack, it added some Javascript to the index.aspx pages of the site. While we have cleaned it up, I have not been able to ...
1
vote
2answers
905 views

How do I holistically protect a web service from network and MITM attacks?

I have several financial web services that are accessed over HTTPS, however the client devices may be accessing the web services over untrusted WiFi, through questionable proxies, and possibly ToR ...
8
votes
2answers
172 views

Preventing user supplied javascript from posting to external server

I am writing an internal tool that will support plugins written by other developers. Ideally, these plugins would have a Javascript component to allow people to make widgets. Some of the pages these ...
13
votes
3answers
990 views

How secure is aSSL (javascript)? Does it effectively mimic SSL?

Some of you may be familiar with the aSSL project, which uses AJAX/PHP to mimic the SSL protocol. It uses RSA 512 or 1024 for the keys, and AES for the actual data. It looks impressive to me in ...
4
votes
2answers
147 views

Can webpages recognize that I saved my password?

If you save your logins in Firefox, username and password are auto-filled-in in corresponding webpages as soon as you visit them (if you have more than 1 account saved, you'd have to select a username ...
3
votes
0answers
67 views

Is the use of JavaScript for cryptography ever appropriate in the browser? [duplicate]

Possible Duplicate: How secure is aSSL (javascript)? Does it effectively mimic SSL? After some searching around, I realized we don't have an easily visible canonical question about this on ...
3
votes
1answer
286 views

How can I use certificates to secure my webservices? What is available to javascript?

I have a few web services that are accessed over public wifi connections and I think it would be a good idea to issue certificates to encrypt data, prevent MITM, and invalid impersonation (beyond what ...
1
vote
2answers
293 views

I need explanation on how serious these vulnerabilities are?

I have found two vulnerabilities on my college site and I want to report them but don't know if these are "really" vulnerabilities : RFI inside SWF file. Example: ...
3
votes
2answers
422 views

Can a whitespace regex character be used to perform a javascript injection?

if I want to validate the input of a <textarea>, and want it to contain, for example, only numerical values, but even want to give users the possibility to insert new lines, I can selected ...
9
votes
2answers
1k views

Security Concerns on clientside(Javascript)

We are going to design and implement a UI for a big website. Owner of the site is really cautious about security issues. I wonder if there is a check list for security issues at the client-side ,while ...
5
votes
1answer
336 views

Cufon or Prototype as an attack vector for Blackhole exploit kit?

I've been asked to look into the security of a client site that's apparently throwing antiviral messages when visited. Specifics: It's being detected as a Blackhole exploit kit inside of a Cufon ...
11
votes
4answers
3k views

Challenging challenge: client-side password hashing and server-side password verification

We have a website where users need to log in to access privileged information. Obviously we are using SSL, but I also want to avoid plaintext passwords from accidently ending up in server logs, or ...
7
votes
4answers
260 views

Limited JavaScript app scenario: Attack vectors and mitigation

I'm going to be developing a single page JavaScript app which allows input via a textarea. This input is never sent to the server, never shown to another user, and will only be persisted in browser ...
0
votes
1answer
1k views

How to escape user input in a value of javascript object?

How to properly escape user-controlled input when it's inserted as a value in JSON object? <script> $(document).ready(function() { new MyObject({ key1: "user_input", key2: ...
7
votes
1answer
4k views

Iframe javascript Keylogger

Is it possible for a website to have a javascript keylogger and also contain an iframe that goes to a "client" site. Can the the JS log all key strokes done on the client site? Can the (host) iframe ...
9
votes
2answers
543 views

User-specific Subdomains : JavaScript security

If I provide a public-facing website for users on my website at their own subdomain (e.g. bob.myapp.com) under their own control, can I allow them to execute arbitrary JavaScript without putting my ...
15
votes
5answers
2k views

What can I do about TLS 1.0 javascript injection vulnerability on my server?

The recent article featured on slashdot http://www.theregister.co.uk/2011/09/19/beast_exploits_paypal_ssl/ says that connections secured with TLS 1.0 are susceptible to man-in-the-middle decryption ...
3
votes
2answers
514 views

Implementing brute force attacks on hash values in Javascript

I'm working for my bachelor thesis at the end of which I aim to implement a proof-of-concept Javascript-based hash cracker. The idea is to work like this: Users can submit a hash value along with ...
-1
votes
4answers
170 views

How secure is this login page? [closed]

Unfortunately I cant link to the page (it internal). But I can describe it! This is a lightspeed systems policy enforcement login page (content filter). The page is http and there is no iframe with ...
1
vote
2answers
6k views

Encrypting string in javascript and decryption in java

I would like to know if someone know any library to do encryption in javascript and decryption in java. I have already tried many API, But getting not not getting same values in java. I want ...
8
votes
5answers
320 views

Is it a risk to highlight text while reading a webpage?

Whenever a user selects or highlights text on a webpage, an OnClick() event is generated. Some of the web browser security models depends on explicit end user interaction, such as OnClick(), before a ...
-1
votes
1answer
223 views

Why don't G+, Facebook and Twitter use text editors to share? Why would someone receive each separately? [closed]

I've seen sites use text editors as below: What is the risk in using these? G+ receives images individually, others receive it all at once. Could someone shed some light on it?
0
votes
1answer
639 views

scanning my site for JavaScript/XSS vulnerabilities [closed]

It have had a report that my site may have a security issue and there is some JavaScript loading 10 times per second. www.ayrshireminis.com Is there anyway that I can "scan" my site to check if ...
2
votes
5answers
1k views

Is it secure to use jQuery on the server-side for user input validation?

I'm thinking about using jQuery on the server-side (node.js) to validate user input (filter tags, remove every attributes except href, rel, target & style, modify css rules which are applied ...
3
votes
2answers
562 views

Why do I get AV alerts when browsing a web page?

I'm using the latest version of Firefox and Windows is up to date. When I was browsing a webpage and clicked a link the browser displayed "connection has been reset" and AVAST poped-up saying "Alert!" ...
1
vote
2answers
184 views

Why ban XSS instead of flagging it?

Consider a browser that allows an XMLHttpRequest downloaded from foo.net to make requests to bar.net, but attaches a XHR-Origin: http://foo.net (or possibly a more descriptive value like ...
1
vote
0answers
153 views

What are potential use cases of script that identifies browser? [closed]

Let's say I've found a way to produce a unique string for each and every browser using pure Javascript (which makes it an alternative to UA strings). Now what I'd like to know is what are potential ...
3
votes
1answer
235 views

Client-side cross-site access in SSL environment - when it's still possible to do?

I'm trying to imagine an secure sandboxed environment for an application which is big and unexplored, and may contain backdoors. It would live under chroot/virtual environment with no outgoing ...
1
vote
1answer
166 views

Is the javascript browser tool at printfriendly.com secure for my browser

I use Win Xp Home with SP3 and am pretty aware of security problems. I use Palemoon 12.1, a version of Firefox optimized for windows. I usually use printfriendly bookmarklet to create printable pages ...
4
votes
2answers
424 views

Are sandboxes overrated?

I've stumbled upon the following on the blog of the NoScript developer Giorgio Maone. First, he quotes the following ArsTechnica article about an XSS bug in Adobe Flash: As useful as sandboxes ...
1
vote
1answer
98 views

How to verify that a clientside-generated object is genuine?

I know that general best-practice states not to trust anything generated by the client. With that in mind, I want to write an HTML5 app that utilises the browser to generate various objects ...
9
votes
3answers
5k views

How can i find what hashing algorithm was used?

One of my clients has asked me to modify the login page that their board members use to access their materials. The problem here is that the person previously responsible for this has left no ...
1
vote
4answers
1k views

Shall I need to use MD5 algorithm in both JavaScript and PHP for login authentication?

I have a login form with username and password. I post this form data to a PHP file. For security reasons I want to encrypt my password in the database and network. Now I have done now following ...
25
votes
9answers
2k views

Why do some people really hate security via client-side?

For instance, lets look at a common login system for a website HTTPS connection is made User submits credentials via POST Server-side code hashes the password and looks if it matches the user name ...
3
votes
2answers
235 views

How to defend against invalid UTF7/8 that hides a <script> tag?

I'm scanning HTML before it reaches a browser, and I've just heard about a type of exploit that uses invalid UTF7 or UTF8 sequences to embed an otherwise invisible script tag, which is used to execute ...
0
votes
3answers
5k views

Set Cookie in XHR response : How different browsers handle this?

If I send a XHR request to example.com and response has Set-Cookie: dummyCookie=dummy in response. How different browsers handle this? Does any version of any browser set the cookie for ...
1
vote
3answers
438 views

Client side scripts through proxies

If you're trying to hide your IP address using VPN/proxies can a website using client side scripting record your real ip? If yes is there any alternative to blocking all scripts as that breaks ...
1
vote
4answers
2k views

Prevent Users from Downloading Javascript, Images

A lot of times I see that resource XXXXX.gif or XXXXX.js can't be saved when I try to save a webpage in Firefox. So this made me think, can I implement a similar thing for my website as well? ...
2
votes
1answer
341 views

Is DWR (Direct Web Remoting) Secure?

Is DWR considered secure, or what may be required to secure Direct Web Remoting? Are there better options for hardened asynchronous communication?
3
votes
5answers
930 views

Clicked on fake “Download Now!” ad on file transfer site (legal file for legit purposes) by accident; does anyone know what measures I should take?

I was sent a file by a coworker via "sendshare" - my first time using the service. The page loaded a bit slowly and the ads came in before the actual download link. I was in a hurry to get the file - ...