The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

learn more… | top users | synonyms

2
votes
1answer
281 views

How is the QSS tag used as payload in an XSS attack?

I have received a report from a client that lists XSS vulnerabilities. The report shows reflected XSS vulnerabilities. In each vulnerability, the payload reflected is a single, unclosed <qss> ...
2
votes
1answer
58 views

Spoofing of Server Sent Events

In the spec for Server Sent Events, it says Authors should check the origin attribute to ensure that messages are only accepted from domains that they expect to receive messages from. Otherwise, ...
2
votes
1answer
134 views

XSS: alert() not executed on different OS/computer

I've encountered a strange behavior while I was performing a security audit of a web application. Some user controlled inputs were displaying their values, unencoded, into the page that processed the ...
2
votes
1answer
533 views

encodeURIComponent in a unquoted HTML attribute

My gut feeling is that the following should be attackable: $("<td><a href=somefile.php?url="+encodeURIComponent(somevar)+">Download Here</a></td>"); In contrast to ...
2
votes
2answers
185 views

Securing a Shuffle Algorithm

After reading about writing a secure shuffle algorithm, I realized that my module that generates a password is only as strong as my PRNG, which in this case is Math.random(). I'm confused as to how to ...
2
votes
1answer
220 views

JavaScript code authenticity when loaded from 3rd party website

Background A discussion about not sourcing JavaScript files from other websites (http://www.reddit.com/r/netsec/comments/29hfhz/please_dont_use_externally_hosted_javascript/) got me thinking. ...
2
votes
1answer
923 views

Facebook oAuth2 for Javascript client application

When implementing Facebook login using oAuth2 (the Javascript version), I receive an access token back from the Facebook auth server. So far so good. The problem I have is that I want to implement a ...
2
votes
2answers
373 views

Would usage of jCryption 3.0 + SSL have mitigated the Heartbleed vulnerability?

I came across a project called jCryption 3.0, which encrypts data between the client and server, without using SSL. If a website's JavaScript had used jCryption 3.0 to encrypt login form fields before ...
2
votes
1answer
350 views

user data accessible through javascript in browser

There are websites which display user information, such as browser version and operating system This website goes even further, and displays some additional information, such as desktop resolution, ...
2
votes
2answers
2k views

Are HTTPOnly Cookies submitted via XmlHTTPRequest with withCredentials=True?

I have a two part question here. I have a javascript webapp accessing privileged REST endpoints. I would like to protect against CSRF. Currently, I have a login system built which returns a login ...
2
votes
1answer
265 views

Can a Java servlet filter be used to pull out scripts that aren't whitelisted?

I might be asking a similar question to this: Whitelisting DOM elements to defeat XSS But I think my proposed solution is different and I was wondering if I could get the community to comment on ...
2
votes
1answer
932 views

Cross site Scripting in HTTP Method?

Lately, I've noticed that many web server configurations reflect the method of an HTTP request sent with a non implemented method in the body of the server's response. For example, A request sent ...
2
votes
1answer
984 views

Security implications of adding all domains to CORS (i.e. Access-Control-Allow-Origin: *) [duplicate]

I am curious of what all the security implications are if I set the following two HTTP response CORS headers; Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false The only ...
2
votes
1answer
127 views

DBus proxy Javascript binding issues

Recent Gnome-3 (under GNU/Linux, BSD or other Un*x) offer a gnome shell with nice presentation, but where the configuration and theming are to be done via Internet Browser (and a public URL, on a ...
2
votes
1answer
3k views

Security Testing AngularJS Web Application

An angularjs application stores user input to local/sessionStorage and retrieves it later to fill the form fields or display that content later. If a javascript is submitted as user input, it gets ...
2
votes
1answer
615 views

Newline XSS vulnerability

So I was experimenting with XSS using new line (%0A) character. So I got to the usual vector: '%0Aalert(/xss/)// and one thing came to my mind. What if you can't insert a quote? A new line will break ...
2
votes
1answer
121 views

Return AWS signature over HTTP

I am performing multipart upload to S3 straight from the browser, i.e. bypassing my back-end. My JS code sends a hand-shake request to S3 (a POST), then uploads the file in chunks of 5MB (a PUT for ...
2
votes
1answer
680 views

Black box testing javascript MVC web applications

I want to test a web application that has been built using the backbone.js framework. Currently I have used a few tools for crawling and testing without any luck. When crawling the website they can ...
2
votes
1answer
381 views

How does IE's Privacy options affect javascript's ability to save cookies?

I'm looking at IE's privacy options screen and am trying to figure out how it breaks javascript, workarounds to that, and how I can gracefully degrade my user experience. Is there a guide that ...
2
votes
0answers
31 views

Do any specific steps need to be taken into account for the user's browser and browser caching for a HIPAA compliant web application?

I'm currently writing a web application that will need to be HIPAA compliant. It is very JavaScript heavy, and ePHI will be sent over an encrypted connection in the form of JSON. The transmission ...
2
votes
0answers
54 views

How to indicate that content in an iframe is untrusted

As part of a website I am developing, untrusted content is displayed in a sandboxed iframe. The content is loaded using the srcdoc attribute, but the iframe is sandboxed using sandbox="allow-scripts", ...
2
votes
0answers
77 views

Suspicious web-application requests containing encoded JavaScript function(?)

I've been seeing some odd traffic in the logs for a web-application (Apache) that I'm wondering about, and I'm hoping that someone here has seen this before. The raw requests were variations of: ...
2
votes
0answers
124 views

How does JavaScript Injection work?

I was watching a DefCon talk and the speaker was saying he was able to infect JavaScript cache files, once the user visited his website/server. From there he was able to load scripts from other sites ...
2
votes
1answer
132 views

Safe to render data directly to DOM from localStorage? XSS attack possible?

I read that localstorage is susceptible to XSS attacks. I currently store JSON Web Token (JWT) in localstorage, and I access and display data about the user through localstorage: var localstore = ...
2
votes
0answers
78 views

Securing a JavaScript app with RESTful backend

I went through the question Securing a JavaScript Single Page App with RESTful backend that has discussions / options around securing a Javascript client side app that invokes RESTful APIs. However, ...
2
votes
0answers
16 views

How to Allow users to save html in Rails application without affecting security [duplicate]

After doing a lot of research I come to this forum hopefully i can get some help. I am building a Ruby on Rails application (version 4.2) My app allow users to create "one page" portfolio : user 1 ...
2
votes
2answers
215 views

Attack using weird characters followed by some javascript in a URL?

I'm seeing a very weird attack this morning from a pile of VPS instances spread out across the US. The URLs look like this: /js/bundles/,!0):this.element.propAttr( ...
2
votes
1answer
1k views

HMAC secret key client storage

I've read numerous articles about using HMAC and the secret key for client authentication in a RESTful client (Javascript) application today. Still, I don't find a single source that is able to ...
2
votes
0answers
2k views

AngularJS Static Analysis Tools [closed]

I am setting up a software security initiative at a small software company. Part of this is selecting a static analysis tool for early and automated detection of security vulnerabilities. Many ...
2
votes
2answers
328 views

What are the security risks when users upload their HTML and javascript to AWS S3 and the content is used in a webapp?

I'm building this web app where users can login and build their own online presentation. To build the presentation they can use their own html, css and javascript. These user files are not uploaded to ...
2
votes
1answer
96 views

How to trace source of clickjacking attack within a website using developer tools?

When surfing a popular Wordpress website on my mobile, clicking on a link to an article within would sometimes open a new window to a malicious website or launch the Apps Store. I am interested to ...
1
vote
4answers
2k views

Prevent Users from Downloading Javascript, Images

A lot of times I see that resource XXXXX.gif or XXXXX.js can't be saved when I try to save a webpage in Firefox. So this made me think, can I implement a similar thing for my website as well? ...
1
vote
4answers
2k views

Shall I need to use MD5 algorithm in both JavaScript and PHP for login authentication?

I have a login form with username and password. I post this form data to a PHP file. For security reasons I want to encrypt my password in the database and network. Now I have done now following ...
1
vote
2answers
1k views

Possible attack on website

I am a developer and I therefor I have very little knowledge on security. So I need some help understanding the attack on website which we launched recently for one of our client. Website is built on ...
1
vote
2answers
380 views

Can older or custom web browsers override the same origin policy?

I totally understand the basis of origin policy and the reasoning why all modern browsers have put this policy into place. My question I guess is, do older browsers support this, and if they don't, ...
1
vote
1answer
329 views

If my website does not take any user input, is there any danger in showing my code and folder structure?

First time posting here; apologies for any mistakes I've made, please edit, retag, migrate as appropriate. I have a simple homepage whose purpose is (essentially) to contain my contact info and some ...
1
vote
3answers
2k views

Is JavaScript malware as dangerous as native viruses? [closed]

Can JavaScript malware be as dangerous and damaging as more traditional viruses that are programmed mostly in native APIs?
1
vote
2answers
2k views

What's the limit on the size of the data that public-key cryptos can handle?

Someone mentioned here that asymmetric encryption might not be appropriate for bulk data and gave an example of RSA with 100 bytes. Of course, I understand that it was a rough example. But it made me ...
1
vote
1answer
190 views

Encrypted quiz data in PHP and JS

I'm developing a quiz with which you can win a few cool prizes. Therefore I'm afraid, that someone might try to hack/manipulate it. All participants have to be logged in and the website takes 15 ...
1
vote
2answers
210 views

Why ban XSS instead of flagging it?

Consider a browser that allows an XMLHttpRequest downloaded from foo.net to make requests to bar.net, but attaches a XHR-Origin: http://foo.net (or possibly a more descriptive value like ...
1
vote
3answers
2k views

what's the absolute worst damage javascript could do to a client?

Assuming I have a defenseless client computer running Windows 7 that will happily allow any javascript code it comes across on the internet, what's the worst damage that could be inflicted? I'm ...
1
vote
2answers
580 views

AVG Website Scan, Chance of 'Potential Threat'?

In a recent question I asked about investigating websites for viruses. The answers were very helpful, I ended up using the AVG website scanner. First I used it on our website and found it was clean, ...
1
vote
3answers
510 views

Client side scripts through proxies

If you're trying to hide your IP address using VPN/proxies can a website using client side scripting record your real ip? If yes is there any alternative to blocking all scripts as that breaks ...
1
vote
3answers
79 views

External JS Security

I'm kinda new to security development. I've work mostly with backend processing stuff. I've been assign on how to secure external javascript that we import from facebook, twitter and google. One ...
1
vote
2answers
239 views

Want to build a password manager using OpenPGP.js

I'm kind of tired of the password managers that are available around... I need one that's open source, that works on OSX, that lets me store .pem files and that I can trust. As I haven't found one, I ...
1
vote
3answers
202 views

Hidding ip address in a peer to peer connection

I'm curious is it possible to hide the ip address in a peer to peer connection. Mainly considering you have 2 computer connected remotly in a browser session. I would like to know if it's possible to ...
1
vote
3answers
1k views

Implementing 'Remember Me' for a mobile application

I am developing a mobile application wherein I need to implement the 'Remember Me' functionality. There are certain pages within the application which require you to login. What I need to do is, if ...
1
vote
4answers
3k views

Can JavaScript be used to install malware?

Looking at the Pwn2Own contest got me thinking: http://arstechnica.com/security/2013/03/pwn2own-carnage-continues-as-exploits-take-down-adobe-reader-flash/?comments=1 If you have all plugins turned ...
1
vote
1answer
106 views

How to verify that a clientside-generated object is genuine?

I know that general best-practice states not to trust anything generated by the client. With that in mind, I want to write an HTML5 app that utilises the browser to generate various objects ...
1
vote
2answers
303 views

Is the OData Protocol susceptible to Insecure Direct Object References?

The Open Data Protocol or OData is a great protocol created on top of Web Technologies.It uses the URI convention for the data exchange using Atom, JSON and XML. You can use the URI convention ...