The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.
13
votes
3answers
1k views
What does this injected code do?
One of my sites has just been hacked as this code has been inserted into random(?) files and places within the files.
Does anyone understand what it is trying to do? I would welcome anything that may ...
8
votes
1answer
46 views
Does it make sense to hash a session id before passing it to an advertisement partner?
My company runs a webshop. We work with a partner that gives discount vouchers to our customers after they buy (the vouchers can be used in other online shops) and also gives vouchers for our shop to ...
2
votes
2answers
65 views
Is it safer to store the XSRF value inside your JavaScript?
To protect yourself against XSRF, you need to have a separate token on a page.
See: Coding Horror: Preventing CSRF and XSRF Attacks, by Jeff Atwood
As the posting suggests, its best to have those ...
10
votes
5answers
413 views
CSRF protection with Session Id
To protect against CSRF, couldn't my page javascript just dynamically insert the session id from the cookie into the body of each HTTP request right before it's sent?
The server would then just ...
5
votes
2answers
89 views
User entered Javascript security implications
I'm creating a web site that lets people create their own site using a subdomain. Are there any security implications by letting people add custom javascript to their pages? If so, which ones? XSS? ...
-3
votes
0answers
45 views
User entered Javascript security implications [duplicate]
I'm creating a web site that lets people create their own site using a subdomain. Are there any security implications by letting people add custom javascript to their pages? If so, which ones? XSS? ...
8
votes
4answers
131 views
Data needed for why not to load third party JavaScript on web page with credit card form
My company makes a JavaScript widget that e-commerce sites can embed on their pages. Our current instructions to our customers tell them to load our JS on every page of their site and most follow this ...
4
votes
3answers
148 views
Are CSRF Attacks Really Blind
I'm new to CSRF attacks but don't see how they are always blind.
Let's say we are dealing with a site where the asset we need to protect is the HTTP response. Something like SurveyMonkey or ...
1
vote
1answer
57 views
Certificate authentication with jQuery's ajax() function
I need to sync with my server with the client certificate abc.pfx which is generated by the server using Ajax. How do I send my certificate with Ajax object. Can I do this certificate authentication ...
3
votes
4answers
210 views
Obfuscating JavaScript code
Some Flash developers are afraid of JavaScript. Their point of view:
Stealing JS source code is effortless, one would just 'view source' and copy it. Yes, you can decompile Flash bytecode, however it ...
2
votes
1answer
131 views
How to hide victim pop-up in clickjacking?
I am testing a web application for click-jacking vulnerability. The attack works fine for single clicks, however i am trying to delete a file and the hidden frame (victim) throws a pop-up ...
3
votes
2answers
101 views
XSS: Parsing Javascript
Reading about DOM based XSS from http://www.webappsec.org/projects/articles/071105.shtml
It illustrates some examples like:
...
-5
votes
0answers
80 views
What kind of equipment and make and model in the movie The Girl With The Dragon Tattoo (2011) [closed]
What kind of cameras are used by lisbeth in the film. I know they had a vaio sort of laptop but I can't find any information on the make and model of the cameras. All I saw was that she used Milton ...
2
votes
2answers
64 views
Can clients execute my python CGI at will?
I have a site where the main database is interacted with via python scripts located in public_html\cgi-bin\. To run commands, various JavaScript scripts, located in \public_html\scripts\, use jQuery ...
0
votes
1answer
148 views
Security Testing AngularJS Web Application
An angularjs application stores user input to local/sessionStorage and retrieves it later to fill the form fields or display that content later. If a javascript is submitted as user input, it gets ...
0
votes
1answer
118 views
Stopping js malware injection on our Wordpress site
This had been added to our wordpress site, specifically in the footer.php.
hxxp://pkktjuchlrv.peguards.cc/02b31ac5iq/get.js
It is malware as defined by google, i belive it is tracking code.
We have ...
2
votes
1answer
102 views
US Department of Labor Watering Hole Attack
So I read this article about how the US Department of Labor's website was compromised and users were redirect to a site that installed malware:
...
3
votes
1answer
141 views
Security of Javascript in mobile browsers
Is Javascript on a mobile browser more secure than Javascript on other types of systems? For instance, if I have a site that includes some client-side (Javascript) encryption code, with the intention ...
3
votes
2answers
142 views
Web & insecure HTTP - Using RSA for encrypting passwords on the client side
I used client side password hashing in my register and login project.
Its purpose is to prevent passive adversaries/eavesdroppers from discovering users' plaintext passwords when HTTP requests are in ...
3
votes
2answers
174 views
How can JavaScript be tampered with while viewing a web page?
I often hear about how client side JavaScript can't be relied on because it can easily be changed. How exactly can it be changed, what program would be used to modify the JavaScript before a page ...
7
votes
4answers
662 views
Generate cryptographically strong pseudorandom numbers in Javascript?
Is there any good way to generate cryptographically strong pseudorandom (or true random) numbers in Javascript?
The crucial requirement: if a.com's Javascript generates some random numbers, no one ...
3
votes
2answers
91 views
User privileges for unsanatized code
We all know there are still vulnerable code out there even though they may or may not get exploited and found for hacking attempts. I've seen people do it countless times and have a possibly plausible ...
10
votes
3answers
345 views
What bad coding practices makes a browser extension vulnerable?
I'm trying to scan JavaScript files for vulnerabilities using JSHint. Specifically, I'm scanning the JavaScript files of browser extensions. To look for possible vulnerabilities I'm looking for bad ...
10
votes
2answers
203 views
What should I look for when auditing a Browser extension / plugin?
I've been asked to do a security audit on a cross-browser plugin for desktop browsers developed by a third party. I am a web developer with a reasonable grasp of Javascript but am not a browser ...
6
votes
3answers
233 views
Is there a way to bypass Django's XSS escaping with “unicode”?
Django (the Python web framework) escapes output to prevent XSS (Cross Site Scripting) attacks. It replaces ', ", <, >, & with their HTML safe versions.
However this presentation on slide ...
0
votes
1answer
99 views
How does DOCTYPE selection affect security of my AJAX app?
I'm considering using modern techniques to protect my Javascript code and am studying how the DOCTYPE element selection may impact that. Specifically, the linked question used IFrames which are not ...
1
vote
3answers
213 views
What typically is the expiration date of a session cookie?
I need to create a session cookie using JavaScript (for more info see question). I'm wondering what should the expiry date be? I'm guessing it's the browsing session, so if I don't set an expiration ...
1
vote
1answer
187 views
bypass a regex filtration to perform an xss attack
Does the regex [\w/$!.*-]+$ stop the injection of payloads like :
"><script>alert(4)</script>
" onload="alert(4)"
...
-1
votes
1answer
146 views
can someone break my anti dom based xss from the window location? [closed]
can someone break my anti dom based xss from the window location ?
function parseparameters()
{
var href = window.location.href;
var id = href.indexOf('#');
if (id ...
6
votes
3answers
575 views
How secure are self decrypting HTML files for data storage?
I recently came across a JavaScript self decrypting archive. Is it secure enough to be used as a portable password storage tool? The author has even challenged it to be cracked.
-1
votes
1answer
101 views
some questions about DOM based XSS [closed]
Is it possible to do a DOM based xss attack with window.location.protocol?
How can we use dom based xss with document.title?
How can we bypass the escape javascript function if it is used?
thank ...
0
votes
1answer
207 views
Sanitizing JavaScript to prevent XSS
I'm going through a vulnerability remediation exercise for a client and am trying to figure out how to best mitigate this particular hole. There's a script on our site that calls up content into a new ...
7
votes
1answer
358 views
What possible use does an iFrame have for security?
I'm looking at code for an old login form I'm redesigning. It's a simple table with two input fields for username and password.
But just before the end </table> tag there's a blank iFrame which ...
1
vote
1answer
267 views
How can I ensure privacy when outsourcing authentication to an IdP (Identity Provider)
I need to outsource authentication to an IdP (Identity Provider) but I don't want that IdP to know of the calling site. The two major issues are the callback URL and the referer header.
Is there any ...
3
votes
3answers
191 views
Stop code injections into page code
I started a topic HERE on the stackoverflow site, but was refered here.
I did get some info there, but think it need's more indepth input.
So hopefuly people here can help.
I have a few domains ...
1
vote
2answers
180 views
Can XSS vulnerabilities present in 3rd party js libraries be used to attack the app that uses the lib?
I am using various 3rd party libs like cordova.js, jquery, jquery mobile, mobilizer and so on, in a an android mobile app.. These libs are found to have various XSS vectors through insecure use of ...
3
votes
1answer
1k views
DOM Based XSS attacks: what is the most dangerous example?
I knew that XSS attacks (“non-persistent” and “persistent”) can hijack user session, deface websites, conduct phishing attack, etc.
However, I can't understand what is dangerous of DOM Based XSS if ...
0
votes
1answer
530 views
“pagesinxt.com” links in the sourcecode, am I being hacked?
At this moment I am being hacked and I do not know to stop it. Let me explain...
My website is hosted in a VPS where I am the only person who has access to it. The page is builtwith ...
1
vote
4answers
203 views
Can JavaScript be used to install malware?
Looking at the Pwn2Own contest got me thinking:
http://arstechnica.com/security/2013/03/pwn2own-carnage-continues-as-exploits-take-down-adobe-reader-flash/?comments=1
If you have all plugins turned ...
2
votes
1answer
69 views
Return AWS signature over HTTP
I am performing multipart upload to S3 straight from the browser, i.e. bypassing my back-end.
My JS code sends a hand-shake request to S3 (a POST), then uploads the file in chunks of 5MB (a PUT for ...
2
votes
1answer
112 views
Newline XSS vulnerability
So I was experimenting with XSS using new line (%0A) character.
So I got to the usual vector: '%0Aalert(/xss/)//
and one thing came to my mind. What if you can't insert a quote?
A new line will break ...
0
votes
1answer
98 views
Can a Javascript - WebGL proof of work system prevent website spam?
Is it a good idea to come up with a Javascript-based Proof of Work system to reduce spam on forums, and other websites?
This idea would be similar to HashCash, but the computation would be based on ...
13
votes
3answers
751 views
What security risks does Firefox 19's built-in PDF reader (pdf.js) bring?
Firefox 19 ships with pdf.js as the default PDF reader.
One of the main stated goals is to reduce the exposure of users to the often vulnerable Adobe PDF reader/plugin.
So what new risks does pdf.js ...
-2
votes
1answer
110 views
When logging into a web page what exactly happens when a user types the wrong password?
I have two related questions as to what happens when a user tries to log in to a website
If the entered password is wrong what should happen?
I have two ideas:
Redirect to a page saying "wrong ...
4
votes
1answer
175 views
Potential issues with Kim Dotcom's new proposed “encrypted webmail service”
Just spotted a Reddit thread about Kim Dotcom, of MegaUpload fame, planning to produce a secure webmail system that allows people to communicate securely, without the worry of having their messages ...
4
votes
4answers
348 views
How to prevent attacks against client side validations?
I have a login form where am accepting Mobile Number of the User for login.
When Mobile Number is submitted, am calling a JavaScript to validate the Mobile Number. My client side validations ...
1
vote
1answer
107 views
Web speech API security
Does the web speech API send the audio to a third-party web service in order to do the speech-to-text conversion, or is everything built into the browser?
I'm trying to work out how secure this API ...
2
votes
2answers
124 views
What are the security risks when users upload their html & javascript to AWS S3 and the content is used in a webapp
I'm building this webapp where users can login and build their own online presentation. To build the presentation they can use their own html, css and javascript. These user files are not uploaded to ...
2
votes
1answer
165 views
Black box testing javascript MVC web applications
I want to test a web application that has been built using the backbone.js framework.
Currently I have used a few tools for crawling and testing without any luck. When crawling the website they can ...
4
votes
3answers
1k views
Hiding JavaScript source code
In a web-app should one strive to hide as much of the code as possible, for example from view source? In particular I was wondering should JavaScript be hidden, especially ones used for Ajax? I was ...
