The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

learn more… | top users | synonyms

25
votes
9answers
1k views

Why do some people really hate security via client-side?

For instance, lets look at a common login system for a website HTTPS connection is made User submits credentials via POST Server-side code hashes the password and looks if it matches the user name ...
4
votes
2answers
2k views

How to protect from new Javascript Injection technique that doesn't use eval()?

There is a new Javascript injection technique that is generating chatter on the forums mentioned here Here is the code sample: String.prototype.code = function(){ return (new Function('with(this) { ...
6
votes
1answer
585 views

Access to other local files from a local HTML file

I tried this question on programmers site with no luck Do you see any reason to block a local html file from accessing another local files located in the same folder? I mean, if a user downloaded an ...
6
votes
4answers
354 views

Is flash or javascript a bigger security concern?

Many flash website whitelisting extensions for chrome (such as flashblock and flashcontrol) use javascript in order to selectively block Adobe Flash from functioning. Thus, In order to get this ...
5
votes
2answers
135 views

Protection against synthetic queries

Note: One, I am not sure if synthetic queries is right word for the risk I am talking about. Second, though I am considering 3-tier model of web-applications general answers are welcome in ...
3
votes
3answers
4k views

Facebook spam / phishing attempt?

I got this sent by a friend on facebook and i dont think its a genuine message ___ shared a link on your Wall. This will leave you speechless) ...
12
votes
4answers
999 views

How to step through malicious JavaScript?

There's a Facebook virus doing the rounds: Your face in 20 years (safe link, but don't follow the instructions). It clearly grabs some Javascript from a url (e.g. ...
5
votes
1answer
320 views

Using javascript, is it possible to iterate through all cookies saved in the user browser and send them to me?

Again, I am new to the programming and security world. I should mention that it is just a theoretical question so I can anticipate this kind of attack. Using javascript, is it possible to iterate ...
1
vote
1answer
182 views

Replicating javascript actions from different website (XSS?)

I've got html / javascript code on my site like this: <a ...
4
votes
2answers
1k views

Problems with avoiding JSON hijacking with MVC3's AntiForgeryToken, or similar token validation

I'm hesitant to implement the proposed anti-JSON hijacking solutions since The recommended solutions to mitigating JSON hijacking involve non-REST-full JSON POSTs to GET data The alternate ...
5
votes
3answers
1k views

What authentication system (OpenID, Facebook, etc) permits Javascript-free and/or Cookie-Free operation?

I'm looking for an authentication system that relies on 3rd parties (ADFS, OpenID, SAML) but doesn't rely on cookies or Javascript... or at least can make them optional. My intent is to gracefully ...
7
votes
4answers
764 views

Security attacks on PHP web applications

I know about following security attacks on php applications (html,php,js). XSS SQL Injection CSFR Session Hijacking /Fixation Code Injection Remote file injection Should i know about any other or ...
1
vote
2answers
747 views

Possible to use CAPICOM to extract current SSL certificate?

I'd like to extract the current SSL certificate from the current browsing session, and read the properties. I'd like to do this at the Browser, for content that is delivered from the server. I'm ...
7
votes
4answers
1k views

Escaping JavaScript constants

how can untrusted values be included in a html-page as javascript string constants? Although the case i am asking uses JSF and Rails, I think this is a general problem independent of the server side ...
6
votes
3answers
386 views

Are there any tools to detect JavaScript-based WCF/AJAX calls?

I'd like to determine if a given JavaScript contains the logic to make a AJAX/WCF call, or determine if one is being executed at runtime. Does anything like this exist?
2
votes
2answers
623 views

Is it possible to take down a site using javascript in the URL bar?

If a site is written poorly enough, is it possible to take it down or severely mess with it using only javascript in the URL bar?
8
votes
3answers
196 views

Are bookmarklets safe with facebook data?

I usually play mafia wars and use bookmarklet like Spockholm, Arum, etc. Can these bookmarklet get my facebook data when I run them, they usually ask to unframe the facebook page. I was just ...