The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

learn more… | top users | synonyms

2
votes
1answer
39 views

How and why does case insensitive XSS work, given that JavaScript is case sensitive?

I found a lot of instances where XSS scripts like the following work: <iMg SrC=x OnErRoR=window.location=123> Given that JavaScript is a case sensitive language, how is the browser able to ...
-6
votes
2answers
52 views

Noob to tor/tails/darknet…forgot to disable Javascript. What to do now?

I am a noob as stated in title. I didn't know how to disable Javascript before visiting some not-so-legit sites. So what can I do? I was using tor, I know this is not enough so I have tails ring a ...
0
votes
0answers
14 views

Executing JS script in a tooltip without “<” and “>” characters (XSS) [duplicate]

In the system that I am working on I have a simple form. In the form there is an input called "ID". The contents of the input is than displayed in a tooltip (after clicking the "i" icon) The input ...
1
vote
1answer
148 views

What is the Javascript trying to do/exploit? [duplicate]

I found the following javascript in a .zip attachment to an email. (Said zip file was opened on a new KVM virtual machine with none of my data on it while running an Ubuntu LiveCD session. Just to be ...
17
votes
4answers
11k views

Is WebGL a security concern?

Is WebGL a potential security problem due to the low level access it provides? For example, a web page can attempt to compile and run any shader source it wants. It seems that security would ...
0
votes
1answer
18 views

Is there a Javascript/Chromebook implementation of NTRU encryption? [closed]

I need to use NTRU encryption on a Chromebook. I need to be able to encrypt on my Chromebook while decrypting on the official version and vice versa. Does anyone know an implementation I could use ...
1
vote
1answer
49 views

Client-side encryption using public-key

My situation: Login password from a POST request is left in browser memory in clear text as long as cache is not cleared (manually/closing browser). Connection is HTTPS. Possible Solution: ...
13
votes
2answers
472 views

Advertisement on Skype tried to download a file to my computer using Javascript

I usually have Skype running in the background. If you have ever used Skype before, you probably know it has advertisements. One of these advertisements made two windows pop up on my screen, asking to ...
4
votes
3answers
93 views

Recent hack appends to all javascript files

I have about 10 websites hosted on shared server by a2hosting, on apr 20 some of the js files for some of the websites were appended with a function that detects the device and if it is mobile it ...
3
votes
1answer
125 views

Does the use of JavaScript make ProtonMail insecure?

I like the look of ProtonMail. However, what has stopped me from signing up is that JavaScript seems to be used at various points in the site, and for someone to read your email they must click on a ...
2
votes
1answer
172 views

What kind of encryption or obfuscation is this? [closed]

I found this script on a web page who attempted to change my router's DNS configuration. But I can't understant what kind of encryption or obfuscation is used. Here, a sample of the code on the ...
5
votes
2answers
101 views

What to use as 'state' in OAuth2 Authorization Code Grant workflow

I'm using csrf protection in my web app. Now I'm planning to trigger a OAuth2 Authorization Code Grant workflow, starting with a static template opened in a new browser window using ...
3
votes
1answer
103 views

JS snippets on my live project do not appear in my code residing on my production server

I have a Django website project that is live (let's call it example.com). It's a forum where users can submit comments and reply to them. It has a Postgresql database, and gunicorn + nginx reverse ...
-5
votes
0answers
7 views

What is i.ipricejs.info script after body tag in my page? [duplicate]

I am running one programe in my localhost. and found below script added automatically. <script ...
3
votes
1answer
89 views

Is it possible for XSS to occur in src attribute?

I'm working on XSS vulnerability and understanding it. I know in following cases cross site script injection happen in Javascript context Inside <script> tag. Inside html tag in event handler ...
2
votes
0answers
37 views

Prevent external script from loading using Burp

I am using free edition of Burp Suite to analyze some requests. Suppose, website is https://www.example.com. Now, there is a javascript file in https://www.example.com/templates/scripts/xyz.js. I ...
-2
votes
1answer
76 views

Clicking a lot of website links in Google Maps, then sent through multiple URL redirects, and lastly to a page that made my laptop start beeping?

I was in Google maps clicking on all the website links listed in the side panel, looking at every website really fast. Note, they were all tattoo parlors. One of the links I clicked bounced me through ...
-1
votes
1answer
80 views

What is this script supposed to do?

I just got a sketchy email to my University email. There was a zipped folder, containing, a lone js file. It reads: var ...
2
votes
2answers
66 views

Security feature: Preventing javascript from closing the window

The latest versions of most web browsers have implemented a feature to prevent javascript from closing current window or tab. Firefox window.close() method This method is only allowed to be ...
0
votes
2answers
59 views

What are the possible security issues when making a checkout system in Javascript?

I'm pretty new to JS and I am currently making a simple step-wise checkout system using purely JS and some Ajax and PHP. I have been wondering about the possible security issues that might pose with ...
1
vote
0answers
64 views

Security flaws while storing auto-login token

I must to accomplish auto-login with a token on my website. Token is generated on back-end, on front-end (Single-Page Application) I have to store token in secure way. I'm using secured channels ...
6
votes
2answers
187 views

Is this a Javascript virus?

So I got a random email saying this. Looks very automated: "How are things? I was visting your website on 4/9/2016 and I'm very interested. I'm currently looking for work either full time or ...
0
votes
3answers
52 views

Typical 'search box' XSS attack

When I develop a site, I'm always conscious of security flaws, but I'm struggling to see how a search box could ever be used to inject script that could be ran on a page of mine. So I understand ...
0
votes
3answers
759 views

DOM XSS : Need Help

I was trying my hands at DOM-based XSS. I came across a scenario where a user-controlled string from the URL is included in JavaScript as below. var userControlled=substring of URL; ...
1
vote
0answers
44 views

How to remember the trusted machine in an application

We need to remember trusted devices in our application. I have done some R&D for this and found out that Facebook achieves this using cookies. But, if I see Google, they don't use cookies, I ...
2
votes
1answer
61 views

Is JavaScript needed for browser code execution vulnerabilities?

Does JavaScript VM have to enabled in a vulnerable browser to exploit an arbitrary code execution bug? There is a number of bugs in borwsers that don't seem to involve JavaScript. For example, ...
25
votes
3answers
3k views

NoScript: How to determine which sites/scripts to whitelist?

NoScript is a great plug-in, both for security and for ad blocking. However, I've found it's not always easy to figure out what scripts need to be permitted on certain pages, to be able to use the ...
5
votes
3answers
5k views

Facebook spam / phishing attempt?

I got this sent by a friend on Facebook and I don't think its a genuine message: ___ shared a link on your Wall. This will leave you speechless) ...
-1
votes
1answer
821 views

scanning my site for JavaScript/XSS vulnerabilities [closed]

It have had a report that my site may have a security issue and there is some JavaScript loading 10 times per second. www.ayrshireminis.com Is there anyway that I can "scan" my site to check if ...
3
votes
4answers
1k views

Are malicious scripts in batch files detected by antiviruses?

We have many scripts in shared folders in our IT Department. Are malicious scripts in batch files detected by antiviruses?
2
votes
2answers
327 views

Is a browser with disabled scripts and disabled java enough against malware

Is a browser like Firefox with disabled scripts (for example via a plugin like no-script) and disabled Java enough to be protected against drive-by-malware from the internet. Of course this does not ...
-1
votes
1answer
94 views

How to secure a script that generates an HTML file from other websites?

I have a ksh script (Korn Shell Script) that generates a static HTML file from websites. How can I ensure that the output HTML file will not contain any bad <script>'s (bad JavaScript)? It's OK ...
5
votes
1answer
332 views

Safe to render data directly to DOM from localStorage? XSS attack possible?

I read that localstorage is susceptible to XSS attacks. I currently store JSON Web Token (JWT) in localstorage, and I access and display data about the user through localstorage: var localstore = ...
4
votes
2answers
3k views

JavaScript eval() to parse JSON after sanitizing with regexes — is XSS possible?

Is possible to bypass my regex and execute any JavaScript? <script> function json(a){ if (/^\s*$/.test(a) ? 0 : /^[\],:{}\s\u2028\u2029]*$/.test(a.replace(/\\["\\\/bfnrtu]/g, ...
-2
votes
1answer
2k views

How to recognize if someone using password Reminder Script [closed]

I have been trying to know what these so called Gmail hacking scripts actually does (just studying for some knowledge purpose) and one of such scripts is this, which seems beyond my knowledge: ...
25
votes
2answers
3k views

Does browser 'view-source' mode avoid scripting attacks?

Let's say there's a URL www.badjs.com which is untrusted and may contain bad scripts. Intuitively, a view-source navigation to that URL does not execute any scripts so it should be safe. It would at ...
1
vote
0answers
22 views

Authenticate with ADFS without Javascript?

I'm trying to allow a search engine that doesn't support javascript to crawl content protected by ADFS. Is there a way to allow clients that don't support javascript to authenticate to an ADFS ...
21
votes
2answers
3k views

Can javascript execution from address bar cause any harm to client's machine?

Given the fact that modern browsers these days prohibit JavaScript from having access to any resources on the client's machine, does JavaScript execution from the address bar pose any threat at all to ...
0
votes
1answer
88 views

What are these links that have been sent to me multiple times on facebook?

2 friends of mine have sent me very suspicious links on facebook, which ask me for credentials on an external site. Entering hello@example.com in the username, and 1234 for the password let me in, and ...
1
vote
3answers
833 views

Best practices to invalidate JWT while changing passwords and logout in node.js?

I would like to know the best practices to invalidate JWT without hitting db while changing password/logout. I have the idea below to handle above 2 cases by hitting the user database. 1.Incase of ...
0
votes
1answer
44 views

Malicious tracking script being served from google server to circumvent block lists

I've found some bad JS that tries to open pop-unders and even deliver a likely malicious SWF file for a flash exploit. Thing is, its stored on a google server in a directory it really shouldnt be. ...
-3
votes
2answers
61 views

How to find Use-After-Free vulnerbilities? [closed]

I followed a lot of tutorials about the exploitation of UAF vulnerabilities, but there was never explained how to find and detect uaf vulnerabilities in javascript or html (i.e. with a static analysis ...
0
votes
2answers
45 views

Is there a server/website specific malware scanner? [closed]

I have multiple Linux CentOS servers that are scanned with the Google Webmaster Tools, and when it finds some malicious code on my servers(shared/dedicated), the ranking of those site drops. What I am ...
3
votes
3answers
233 views

How To Prove That Client Side Javascript Is Secure?

Imagine that you have a web application that encrypts the user's data, such as a note or spreadsheet, on both the server and client. The normal process for a user using this web application is ...
3
votes
1answer
169 views

How to get TOTP password with hmac sha 512 as hashing function?

ive never learned about javascript and network security before, but lately ive taken on some programming challange but i have to send my project link via http post request, and i have to figure the ...
11
votes
3answers
1k views

Predicting Math.random() numbers?

I was reading up on the documentation for Math.random() and I found the note: Math.random() does not provide cryptographically secure random numbers. Do not use them for anything related to ...
4
votes
2answers
104 views

Why are cookies considered more secure against XSS?

This article discusses storing session tokens in a cookie vs in localStorage: https://stormpath.com/blog/where-to-store-your-jwts-cookies-vs-html5-web-storage/ The article states: Cookies, when ...
57
votes
6answers
9k views

Anonymous surveys that aren't so anonymous

In the past I have completed an 'anonymous' survey at work only to find that my employer was able to garner a lot of not-anonymous information from this survey. Location, name of manager, etc. None ...
18
votes
3answers
7k views

Can JavaScript be used to capture the user's screen?

Can JavaScript be used to capture the user’s screen? If so, is this functionality available in any JS framework? (I do not need code examples: I am mainly asking to form an opinion about the security ...
0
votes
2answers
49 views

Can I safely store my admin scripts in a publicly available script file?

On a project I am working on I have all javascripts mixed together in all.js. I have a separate file, admin.js that contains scripts used on the admin section of the project. This file is only ...