The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

learn more… | top users | synonyms

2
votes
5answers
3k views

Is converting `<` to `&lt;` sufficient to prevent execution of JavaScript from arbitrary HTML?

This is kind of a bar-bet question. An acquaintance of mine has made the claim that, given an arbitrary glob of HTML, it can be completely prevented from executing JavaScript if, before slapping it ...
2
votes
2answers
17k views

Best Approach for removing XSS Vulnerability

I have been developing a Webobjects application, and I found that my application is vulnerable to XSS through URL, but not when malicious input like <script>alert("hi")</script> is input ...
2
votes
2answers
3k views

What's the limit on the size of the data that public-key cryptos can handle?

Someone mentioned here that asymmetric encryption might not be appropriate for bulk data and gave an example of RSA with 100 bytes. Of course, I understand that it was a rough example. But it made me ...
2
votes
3answers
2k views

Javascript containing a long hexadecimal string and eval: is this suspicious?

At the bottom of the index.php file for a simple “contact us” form, I found the following (some whitespace and newlines added): try {if(window.document)--document.getElementById('12')} catch(qq) ...
2
votes
2answers
126 views

Is is possible to create a “signature” for a piece of JavaScript

Bear with me, I may have asked this question in a botched way. So I need some JavaScript code that creates a signature of JavaScript that is stored in a string. Here is an example: presignature = ...
2
votes
2answers
1k views

Is it possible to take down a site using javascript in the URL bar?

If a site is written poorly enough, is it possible to take it down or severely mess with it using only javascript in the URL bar?
2
votes
1answer
353 views

Should a space in a password count as a symbol when checking for complexity?

There is no doubt in my mind that spaces should be allowed in passwords. I see some websites disallow spaces, symbols in passwords and even enforce minimum length which seems t otally nonsensical to ...
2
votes
2answers
90 views

which encryption is used in this JS Variables

Which encryption method is used for these variable names: var g_license_info var g_server_time_obj Respectfully encrypted to: var ago05b4e111efe149737a67a177f00ffad2 var ...
2
votes
3answers
488 views

How to spoof my IP address to JavaScript and other security concerns

Many websites require JavaScript. However, enabling JS means that a website can run a JS snippet to retrieve the user's IP address (even if they are behind a proxy or VPN). So, how can I (the user) ...
2
votes
2answers
357 views

is it sufficient to convert '(single-quote) to ` &#039; `

Is it sufficient to convert ' to &#039; , > converted to &gt; and < converted to &lt; to avoid xss A bit of context: the payload would be going through the URL and landing in a ...
2
votes
3answers
790 views

hiding javascript in image

I have read a post in thehackernews and searched the net to find how it worked. How can anyone add javascript in an image such that when the image is displayed it can run a script. Can this be done ...
2
votes
4answers
410 views

Why aren't we all compromised on the internet?

Well, I've been thinking about this for a while now. Within the last decade, we've used various ways to make our websites look dynamic and live. For example, in JavaScript, it's quite easy to send ...
2
votes
2answers
351 views

I need explanation on how serious these vulnerabilities are?

I have found two vulnerabilities on my college site and I want to report them but don't know if these are "really" vulnerabilities : RFI inside SWF file. Example: ...
2
votes
1answer
10k views

Encrypting string in JavaScript and decryption in Java [closed]

I would like to know if there is any library to do encryption in JavaScript and decryption in Java. I have already tried many APIs, but am not getting the same values in Java. I want public-private ...
2
votes
2answers
390 views

Is the OData Protocol susceptible to Insecure Direct Object References?

The Open Data Protocol or OData is a great protocol created on top of Web Technologies.It uses the URI convention for the data exchange using Atom, JSON and XML. You can use the URI convention ...
2
votes
1answer
286 views

Hashing user passwords via Javascript client-side versus server-side hashing? [duplicate]

I got into a discussion with one of our senior developers over password hashing/transmission best practices and it left me curious as to what the industry standard best practice is. In the ...
2
votes
2answers
1k views

If using htmlentities or htmlspecialchars functions is enough for block XSS attack

I know this question was discussed on net various times. and people give some example how to bypass these functions through passing some code. But here one issue, All example of ...
2
votes
1answer
235 views

How sharing location via web actually works? (It gets my exact house address)

I know that this could be a repeated question, but I'm freaked out right now, Maybe Im old or out of the 2015 technologies, but i just visited this page: http://whatismyipaddress.com. As I know, ...
2
votes
1answer
207 views

How does this website prevent directing away from it

I'm using the latest version of Firefox with Ghostery and Adblock plus installed. This website somehow prevents navigation away from it. How does it do this and how can it be protected against? I ...
2
votes
3answers
271 views

XSS prevention by black-listing

I have a reflected XSS vulnerability in my Web application. I have decided to take the black-list approach instead of the popular white-list approach. My question is can there exist a malicious ...
2
votes
2answers
2k views

XSS in HTML meta tag

There is a web application which contains a search function. When I search for aaaaaaaaxss I get this: <meta property="the:property" content="100 Results for aaaaaaaaxss (Page 1)" /> It strips ...
2
votes
2answers
7k views

Ways to completely spoof browser user agent and hiding OS to a webserver

This is a follow-up to the following question: Can a website determine what OS or web browser a visitor is using if the useragent is blanked/changed? If I have understood the answers correctly, a ...
2
votes
2answers
494 views

Need help deciphering malicious JS code

was hoping someone could give me a hand with deciphering this obfuscated Javascript added to a webpage that I own. As the code is quite large I will just link to pastebin posts but I can add them to ...
2
votes
2answers
723 views

Can clients execute my python CGI at will?

I have a site where the main database is interacted with via python scripts located in public_html\cgi-bin\. To run commands, various JavaScript scripts, located in \public_html\scripts\, use jQuery ...
2
votes
2answers
54 views

Javascript videoplayer attack vectors [closed]

My team is building a Javascript-based video player for our own platform, instead of relying on other already available options like video.js. I'm wondering which attack vectors should I take into ...
2
votes
1answer
168 views

What kind of encryption or obfuscation is this? [closed]

I found this script on a web page who attempted to change my router's DNS configuration. But I can't understant what kind of encryption or obfuscation is used. Here, a sample of the code on the ...
2
votes
1answer
55 views

Crypto in browser

It's almost 2016 and javascript encryption libraries have been around for a while. My question is, have they improved? Or should we still abandon the idea of having encryption done in our browsers? ...
2
votes
2answers
3k views

What's the best way to authenticate an user using a websocket?

I'm creating a multiplayer game(based in websockets) which runs directly from the browser and which has multiplayer functionality. Each player needs to have his own account(Username and password). ...
2
votes
2answers
229 views

Identify code being run on website

I do not normally deal with internet security problems but this one has got me interested. The issue is with a specific site, lets say example.com, and how it it visited. If the address is typed ...
2
votes
1answer
143 views

US Department of Labor Watering Hole Attack

So I read this article about how the US Department of Labor's website was compromised and users were redirect to a site that installed malware: ...
2
votes
1answer
512 views

Can a Javascript - WebGL proof of work system prevent website spam?

Is it a good idea to come up with a Javascript-based Proof of Work system to reduce spam on forums, and other websites? This idea would be similar to HashCash, but the computation would be based on ...
2
votes
3answers
505 views

sanitizing likes/unlikes in application?

I've got a function in my app where users can click on a "thumbs up" image and a like is recorded in the database; all that's recorded is the user's ID and the ID of the post that the user liked. I ...
2
votes
3answers
7k views

Set Cookie in XHR response : How different browsers handle this?

If I send a XHR request to example.com and response has Set-Cookie: dummyCookie=dummy in response. How different browsers handle this? Does any version of any browser set the cookie for ...
2
votes
2answers
64 views

Security feature: Preventing javascript from closing the window

The latest versions of most web browsers have implemented a feature to prevent javascript from closing current window or tab. Firefox window.close() method This method is only allowed to be ...
2
votes
1answer
65 views

Break out of JavaScript data context to perform XSS when backslash and quotes are replaced?

Suppose I have a this on my site: <script> var x = "<? echo unsafe_data; ?>"; </script> This is obviously vulnerable to XSS. Now suppose I "clean" the unsafe data by replacing \ ...
2
votes
2answers
343 views

High level design for secure web application

I'm looking for some advise on designing a secure web app for storing passwords. Why reinvent the wheel? Because I don't trust a 3rd party with all of my passwords. Here are my thoughts: There are ...
2
votes
2answers
429 views

Is this password generator safe?

128-bit entropy is required http://nxtra.org/nxt-client/js/passphrasegenerator.js With all new browsers (Chrome, Firefox, IE 11) it uses crypto.getRandomValues which should be safe, but with IE 10 ...
2
votes
1answer
211 views

Chrome inline JavaScript string interpreatation

If you have an HTML file that contains the following code : <!doctype html> <html lang="en"> <head> <meta charset="UTF-8"> </head> ...
2
votes
1answer
4k views

In which ways could a javascript making a cross domain HEAD request be a threat?

I was just reading this answer to the question Why is the same origin policy so important? Basically, when you try to make an XMLHttpRequest to a different domain, the browser will do one of two ...
2
votes
2answers
326 views

Is a browser with disabled scripts and disabled java enough against malware

Is a browser like Firefox with disabled scripts (for example via a plugin like no-script) and disabled Java enough to be protected against drive-by-malware from the internet. Of course this does not ...
2
votes
1answer
3k views

How to prevent the following clickjacking attack?

The Security attribute was implemented to prevent XSS attacks in iFrames by disabling any JS implemented in the iFrame source, therefore indeed eliminating XSS attacks, but also disabling any security ...
2
votes
1answer
3k views

javascript:alert(“test”); command does not work

Hello! As I have done before and also have read in many web sites, that just simply writing: javascript:alert(document.cookie); should work on any web page. But now, I was not able to execute it. I ...
2
votes
1answer
71 views

Licensing system for client side code web application

I have a client-side web application running on SharePoint Site Collection, each site collection has it's own unique id. I want to use a licensing process to lock the app to a site collection. This ...
2
votes
2answers
368 views

http_only for cookies with JWT tokens

I'm trying to figure out how to use JWTs that are transmitted in cookies for an SPA It needs to be in cookies because we want non-ajax requests to also send the jwt, and it should "just work" for all ...
2
votes
1answer
150 views

Potential attack vectors using Javascript to log in [closed]

I would like to allow users of a website to be able to log in at any page. In order to provide a seamless experience my first thought was to collect user credentials (username and password) in a ...
2
votes
3answers
287 views

How do anti-viruses identify malicious pages when JavaScript doesn't have access to the filesystem anyway?

Disclaimer : I am not very knowledgeable about the behaviour of anti-viruses (anti-viri?). I was wondering how they discern between malicious and non-malicious pages if all they can read is the HTML ...
2
votes
2answers
291 views

Attack using weird characters followed by some javascript in a URL?

I'm seeing a very weird attack this morning from a pile of VPS instances spread out across the US. The URLs look like this: /js/bundles/,!0):this.element.propAttr( ...
2
votes
2answers
373 views

How can one find keyloggers in javascript?

Assuming no XSS and a client-side only page, how can a keylogger be identified in javascript code? Should I simply look for the id of the targeted fields and possibly some sort of DOM traversal to ...
2
votes
2answers
1k views

Hacked HTML page - what's in the comment following the obfuscated code?

Chrome just warned me about malicious content when visiting a site - so I visited it. The source code is like the following: <html> <head> <link href="images/DPT2.ico" title="Dynamic ...
2
votes
1answer
211 views

Sandboxing user input html

I want to render user uploaded HTML (consisting of possibly many files with images, custom css, custom js, all uploaded in a zip file) for preview purpose. The user that submits the html will be the ...