The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

learn more… | top users | synonyms

2
votes
1answer
284 views

How sharing location via web actually works? (It gets my exact house address)

I know that this could be a repeated question, but I'm freaked out right now, Maybe Im old or out of the 2015 technologies, but i just visited this page: http://whatismyipaddress.com. As I know, ...
3
votes
1answer
820 views

What are the best practices for (token based) security in a webapp?

I am designing a web application using Spring MVC with REST controllers and Angular JS pages which communicate with these REST controllers. I've implemented a token based security/ authorization ...
4
votes
4answers
4k views

bot detection via browser fingerprinting

I've recently noticed that a few companies have begun to offer bot and scraping protection services based on the idea of browser fingerprinting to detect them, and then blocking the specific ...
2
votes
3answers
128 views

Temporary XSS Vulnerability

I found xss on a textarea field. When you enter a character to this field it output the character in real time so when I input the following code: <input onclick=alert(document.cookie)> there ...
3
votes
2answers
603 views

Is it neccessary to use X-FRAME-OPTIONS to prevent ClickJacking attacks?

I use this Javascript Code, and it works perfectly: if (top.location != location) top.location.href = location.href Many researchers told me to not use this. Can any one bypass it? Are there ...
3
votes
0answers
73 views

How to indicate that content in an iframe is untrusted

As part of a website I am developing, untrusted content is displayed in a sandboxed iframe. The content is loaded using the srcdoc attribute, but the iframe is sandboxed using sandbox="allow-scripts", ...
1
vote
1answer
572 views

XSS payload to capture login credentials

I am trying to solve this exercise http://pentesteracademylab.appspot.com/lab/webapp/jfp/3. The objective of this is to "Post the Username and Password to Attacker Controlled Server". There is a url ...
14
votes
4answers
4k views

What are the security issues with “eval()” in JavaScript?

Every time that someone mentions eval(), everyone says that there are "security issues" with it, but nobody ever goes into detail about what they are. Most modern browsers seem to be able to debug ...
1
vote
3answers
944 views

What are the different payloads used for XSS vulnerability? [closed]

I am new to information security field. I am searching for XSS vulnerabilities. In XSS mostly they use <script>alert('XSS')</script> payload for attacking a websites. In the case of ...
-3
votes
1answer
105 views

Session hijacking [closed]

I know one way of doing session hijacking 1.copying the session value from the chrome browser and pasting the cookie value to firefox browser Is there any other way of doing session hijacking ? If ...
1
vote
1answer
117 views

Common characters/statements in obfuscated JavaScript [closed]

I'm trying to compile a list of common characters and statements in obfuscated JavaScript. I'm using http://aw-snap.info/articles/js-examples.php for obfuscated JS examples, but I cannot distinguish ...
2
votes
2answers
446 views

Is this password generator safe?

128-bit entropy is required http://nxtra.org/nxt-client/js/passphrasegenerator.js With all new browsers (Chrome, Firefox, IE 11) it uses crypto.getRandomValues which should be safe, but with IE 10 (...
3
votes
3answers
296 views

Any Security Risks for using mailto:?

I use a PHP script which performs a database search and when no result are found, user is presented with a mailto link with this format mailto:example@test.com?subject=SEARCHED_QUERY_HERE The ...
-1
votes
2answers
283 views

Obfuscated JS Code That Breaks On De-Obfuscating Or Debugging [closed]

How can I de-obfuscate this JavaScript? I see it opens a new window at www.google.com, but what else does it do? I can't open it in debugger it just doesn't work then? And is it malicious? Here is ...
7
votes
1answer
429 views

Javascript phishing attack sucker: Do I need to be worried? [closed]

So, I'm an idiot. I opened a javascript phishing attack file. I would really, really appreciate some help with decoding the Javascript to figure out whether I'm in trouble, and what sort. I'm on OS X ...
1
vote
1answer
106 views

Any standard tests to prevent hacking? [closed]

I am very new in programming world so my question may sound weird. I am useing selenium to test an application, yesterday one of my colleagues found this issue that if someone enters this: <script ...
0
votes
2answers
183 views

Hiding (Obfuscating) Java script [closed]

So i heard that obfuscating java script is useless and waste of time because anyone with a little of skill can decode your code. So i want to test that. This code will display a alert box saying hey ...
3
votes
1answer
582 views

Dom based Xss Query - location.hash

I was just looking at Dom based xss and wondering if hash value is written to a variable in javascript context can lead to Cross site scripting. The code looks something like this: <script> var ...
0
votes
5answers
1k views

Using a Public-Key-Encryption browser side to avoid PCI compliance

We're developing a web application in which certain not logged users (clients) need to send their credit card details to other users (merchants) - which, we'll assume, are PCI compliant. We are ...
5
votes
4answers
1k views

Client side encryption - only web browser available

I am creating an enterprise application, the server side runs a whole set of different apps, On the client side, there is only a webpage, no applet or anything else. Unfortunately data created by the ...
2
votes
2answers
458 views

Would usage of jCryption 3.0 + SSL have mitigated the Heartbleed vulnerability?

I came across a project called jCryption 3.0, which encrypts data between the client and server, without using SSL. If a website's JavaScript had used jCryption 3.0 to encrypt login form fields before ...
5
votes
1answer
147 views

Video site requests Adblocker to be shut off, next day I have 3 “weird” bookmarks

I was on a site trying to view a video and the site requested that I turn off my adblocker to view the video. So I did and then the next day I noticed that I had 3 "weird" bookmarks in my bookmark ...
2
votes
0answers
105 views

Suspicious web-application requests containing encoded JavaScript function(?)

I've been seeing some odd traffic in the logs for a web-application (Apache) that I'm wondering about, and I'm hoping that someone here has seen this before. The raw requests were variations of: ...
0
votes
0answers
178 views

injecting javascript in webviews in Android

I am relatively new to mobile application security. Currently I am supposed to audit an android application which uses a webview to display some static FAQ page in an activity. The webview in ...
2
votes
3answers
323 views

How do anti-viruses identify malicious pages when JavaScript doesn't have access to the filesystem anyway?

Disclaimer : I am not very knowledgeable about the behaviour of anti-viruses (anti-viri?). I was wondering how they discern between malicious and non-malicious pages if all they can read is the HTML ...
3
votes
3answers
344 views

Can a browser JavaScript console ever be an issue?

I'm sure most of you are familiar with the JavaScript-based game Candy Box. As you probably know, one can cheat this game's candy system by sending commands to the console. For instance, if you ...
2
votes
0answers
191 views

How does JavaScript Injection work?

I was watching a DefCon talk and the speaker was saying he was able to infect JavaScript cache files, once the user visited his website/server. From there he was able to load scripts from other sites ...
2
votes
1answer
10k views

Encrypting string in JavaScript and decryption in Java [closed]

I would like to know if there is any library to do encryption in JavaScript and decryption in Java. I have already tried many APIs, but am not getting the same values in Java. I want public-private ...
1
vote
1answer
137 views

Angular security in $scope

For our app when a user logged in we are issuing him a token which is stored in session and we are using $rootScope to store his details. This what we are doing if(sessionStorage.loggedIn && ...
2
votes
2answers
141 views

Is is possible to create a “signature” for a piece of JavaScript

Bear with me, I may have asked this question in a botched way. So I need some JavaScript code that creates a signature of JavaScript that is stored in a string. Here is an example: presignature = ...
5
votes
3answers
965 views

What are NoScript surrogates and should one disable them for more privacy in browsing?

NoScript has a feature of supplying its own "surrogate" scripts instead of well-known tracking/ad scripts (Google Analytics, for one). Does it matter for my privacy if I do not change the factory ...
-3
votes
1answer
91 views

Could blocking script in the url prevent DOM XSS? [closed]

On my site, if I were to block <script> from the url, could this prevent some cases of XSS? Any way someone could bypass that?
-1
votes
1answer
118 views

What to do if I suspect a website I visit and link to was compromised via an XSS?

EDIT: The script has been removed and apparently the vulnerability has been patched. My employer links to this resource: http://www.myplan.com/ I recently noticed a JavaScript alert was added into ...
6
votes
3answers
735 views

Favicon Redirection Possible Security Flaw

I have the domain example.com When I enter the URL https://api.example.com, Chrome loads the page and also tries to load https://myapp.example.com/favicon.ico, and that request receives a 301 ...
0
votes
1answer
310 views

JS code giving xss vulnerability

Below is a piece of JS code: if(!(window.location.href.indexOf('?')> -1)){ id= window.location.href.slice(window.location.href.lastIndexOf('/') + 1); } location.hash='...
3
votes
2answers
984 views

Set the max length for input

Suppose I have a form, and one of this form inputs I set the max length to 15: <input type="text" name="username" maxlength="15"> Now the attacker wants to override this limit, to do that he ...
3
votes
3answers
215 views

What's the best way to secure the responses in a single page web app after logout?

I've read some of the great responses to storing and passing session keys in a single page web application (i.e., a web "site" that runs mostly on the client-side, getting data from the server by ...
3
votes
1answer
365 views

Can a Java servlet filter be used to pull out scripts that aren't whitelisted?

I might be asking a similar question to this: Whitelisting DOM elements to defeat XSS But I think my proposed solution is different and I was wondering if I could get the community to comment on ...
4
votes
1answer
13k views

Create RSA public, private key pair having numbers generated already

I want to know to to generate working RSA key pair, with correct syntax. Let's say i have already generated somehow my numbers for 512bit key, which are: e = 00065537 d = ...
1
vote
3answers
138 views

External JS Security

I'm kinda new to security development. I've work mostly with backend processing stuff. I've been assign on how to secure external javascript that we import from facebook, twitter and google. One ...
1
vote
1answer
88 views

XSS inside a javascript

Can an XSS be craft inside the following JS. $(function () { $("#panel").find(".form").each(function (index) { var that = this; $(that).overload(); ...
33
votes
4answers
33k views

How do you know your server has been compromised?

I recently helped a client who had their server hacked. The hackers added some PHP code into the header of the homepage redirecting the user to a porn website — but only if they came from Google. This ...
1
vote
0answers
116 views

ASP.NET WCF security, javascript and handling sensitive information

I've come upon what I would call some "nasty" javascript coding (I come from a KnockoutJS / Angular / Web API 'world') in which WCF services are exposed to javascript by production URL's, i.e. "...
1
vote
2answers
116 views

Is Great Cannon essentially a JavaScript injection attack?

I was reading an article on Great Cannon at Ars Technica (http://arstechnica.com/security/2015/04/meet-great-cannon-the-man-in-the-middle-weapon-china-used-on-github/) and it seems to me that this is ...
0
votes
1answer
392 views

What does this malicious JavaScript code do? [closed]

I got this by email this morning before my brain woke up and I clicked on it. Does anyone know how bad this is? It gave me an out of stack space error when I ran it. var listing="...
2
votes
1answer
164 views

Potential attack vectors using Javascript to log in [closed]

I would like to allow users of a website to be able to log in at any page. In order to provide a seamless experience my first thought was to collect user credentials (username and password) in a ...
4
votes
4answers
8k views

How to stop other websites from sending cross domain AJAX requests?

From two different applications, I was able to send cross-orgin requests. Though the browser returns a "cross origin" error my server is still receiving and executing the request. For example, from a ...
2
votes
0answers
108 views

Securing a JavaScript app with RESTful backend

I went through the question Securing a JavaScript Single Page App with RESTful backend that has discussions / options around securing a Javascript client side app that invokes RESTful APIs. However, ...
1
vote
2answers
150 views

Are “web bugs” a technique that instructs web browsers to operate the computer's microphone?

"Web bugs" [pg 7] refers to Javascript techniques that instruct web browsers to operate the computer’s microphone and locally search the audio for keywords. Would this be false? If so, why?
3
votes
2answers
230 views

Classifying Reflected and DOM-based XSS

Having referenced Difference between DOM & Reflected XSS , I observed that certain attacks could be both DOM-based and Reflected XSS. I wish to find out if my understand is accurate, or they ...