The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

learn more… | top users | synonyms

1
vote
1answer
50 views

How to de-obfuscate a malicious payload?

I've received some spam email that led to a JavaScript file which I assume is malicious. My curiosity got the best of me so I opened the file in notepad and I'm trying to make sense of the code but I ...
3
votes
2answers
123 views

Ransom32: How does it work?

Ransom32 seems to be a new ransomware written (partly) in JavaScript. As I understand it, it doesn't affect a user through a browser / by visiting a website, but by downloading some .rar file which ...
3
votes
2answers
44 views

How to secure communications between a web front-end and the web server when/where the HTTPS protocol is compromised?

A country in the Central Asia has issued a law enforcing all the ISPs to decrypt the transit HTTPS traffic and encrypt it with a special certificate issued by the government. Every client is to ...
4
votes
2answers
501 views

Did XSS reach its end-of-life with the introduction of the HTTP X-XSS-Protection header?

With the introduction of the HTTP X-XSS-Protection header it seems to me that the vulnerability impact (read: amount of possibly affected users with modern browsers) is drastically reduced. Firstly, ...
1
vote
1answer
80 views

DOM based XSS: jQuery(“#HiddenReferral”).val(jQuery(location).attr('href'));

DOM based XSS has been reported by Burp Suite and showed this query as vulnerable: The application may be vulnerable to DOM-based cross-site scripting. Data is read from location and passed to ...
22
votes
4answers
5k views

Suspicious JavaScript in website header

I am not sure if this is the correct place to ask a questions such as this, apologies if it isn't. I have found the below code in the header of one of my wordPress websites, I am pretty sure it is ...
-1
votes
1answer
551 views

Can someone break my anti DOM-based XSS javascript function? [closed]

Can someone break my anti DOM-based XSS javascript function using window.location? function parseparameters() { var href = window.location.href; var id = href.indexOf('#'); ...
1
vote
0answers
29 views

Detecting disabled Chrome plugins using JavaScript

My cable was on the fritz this weekend and I had to visit a friend to watch HBO online. Something weird happened that has been bothering me. I have disabled the Flash plugin on Chrome, since all ...
5
votes
2answers
89 views

Revising Phising Email & it's payload… did I do this right?

Recently my company got a widespread phishing email sent to them, thankfully no one clicked the link (which is great!) Since I'm a student and a current intern working in IT Security I wanted to see ...
2
votes
2answers
86 views

Hardening Javascript in respect to Javascript Malware/Ransomeware like Ransome32

Are there any methods or standards to harden Javascript implementations to help reduce/remediate the the risks associated with Javascript malware like the Ransom32 or other types of Javascript attacks?...
0
votes
3answers
126 views

Random characters and letters form obsfuscation

I know that this question has been asked many times, but would JavaScript encryption work if I just added 100 random numbers and letters to the password? That would be hard to reverse engineer, ...
1
vote
1answer
167 views

Using htmlentities() in a BBCode-supporting textarea to stop XSS

I want to have a text area to post stuff to the database with BBCode. So, I downloaded a JavaScript code (to write in the specific BBCode when the image is clicked) but it didn't transform the text. ...
4
votes
1answer
98 views

Risks of HTML/JavaScript window.opener security flaw?

I do not know if you are aware of this flaw, but here is a basic example: somepage.html (pointing to malicious.html): <!DOCTYPE html> <html> <head> <meta charset="utf-8"> ...
0
votes
1answer
58 views

Is it secure to get auth TOKEN from server with javascript?

Is it secure to manipulate with auth token inside client side javascript over https ? I want to pass that token to websocket after login. $.getJSON( $SCRIPT_ROOT + '/jscript_get_auth_token', {}, ...
4
votes
1answer
140 views

JS snippets on my live project do not appear in my code residing on my production server

I have a Django website project that is live (let's call it example.com). It's a forum where users can submit comments and reply to them. It has a Postgresql database, and gunicorn + nginx reverse ...
-4
votes
1answer
96 views

Is this script vulnerable to XSS? If yes, how can I exploit it? [closed]

Is this script is vulnerable to XSS? If yes then how can I exploit it? <script> //<![CDATA[ var _gaq=[['_setAccount','UA-34064858-1'],['_trackPageview']]; (function(d,t){var ...
3
votes
0answers
260 views

Problem in underscore.js with “new Function()” when CSP header is set

In underscore.js, template rendering causes violation of the 'unsafe-eval' property, with CSP error at following line: render = new Function(settings.variable || 'obj', '_', source); The solution ...
1
vote
1answer
49 views

Offline Javascript and encrypted secret

When using Javascript online with the server, The server can provide a unique Key and Initialization vector for use in AES-CBC available in Webcrypto API. Each user has key allocated to them. The ...
12
votes
1answer
221 views

Stack Exchange's javascript is malicious

I have, recently, discovered a rather annoying problem: every first-click I have on any Stack Exchange site creates an advertisement popup. This happens on my desktop, laptop, phone and even a VM. I ...
5
votes
3answers
999 views

What to do when iPhone is successfully phished

My girlfriend watched "some" pages on her iPhone and facebook.you-won.com page appeared. She didn't know how to get rid of that JavaScript alert, so she clicked OK. After that she closed the page, and ...
7
votes
1answer
6k views

Is it safe to give an Oauth token to client side javascript so it can directly make requests to a server?

I currently have a simple backbone.js application served from my domain (example.com), which is provided an Oauth token. Specifically, I pass the Oauth token through my page template into the ...
5
votes
1answer
53 views

Why don't web templating frameworks HTML escape all data by default?

I recently discovered an XSS vulnerability in an application that uses JSP to render pages. The vulnerable code in the JSP was something like this: <td>${customer.notes}</td> It was ...
-1
votes
0answers
29 views

How does this XSS “filter bypass based polyglot” from OWASP work?

I tried some XSS on a practice site and copied random codes from the OWASP cheat sheet to see what happens and I found this code: '">><marquee><img src=x onerror=confirm(1)></...
1
vote
1answer
42 views

Serving javascript from an API and having that execute on the client

I have been proposed a solution where our API serves up some JavaScript which will be executed on the client. The code will render some HTML on the client and provide some functionality such as ...
0
votes
0answers
62 views

How can JavaScript be uploaded safely to a server through a web app?

Can users who have access to web content management system be allowed to upload JavaScript files to the web server through a web app in a safe way? Or shouldn't uploading JavaScript be allowed by ...
12
votes
1answer
983 views

How can I embed iframe securely without restricting its functionality?

I'd want to embed an iframe from untrusted site into web application. Iframe: should be able to run Javascript and browser plugins (Flash, etc.) should not be able to access my web application ...
0
votes
0answers
23 views

Security risks with setDomStorageEnabled(true) in Android?

What are the security risks associated with enabling setDomStorageEnabled(true) method? Reference.
4
votes
1answer
56 views

How can Google search change the location in a URL tooltip?

When hovering over a website link in Google search the tooltip says the link of the website (stackoverflow.com). But when I click it it goes to some Google page and then StackOverflow. But now if I go ...
1
vote
2answers
79 views

Is Stegosploit a real concern with modern browsers?

http://stegosploit.info/ I looking into having users upload their images directly to AWS S3 to save on costs (rather than going through a traditional server and re-encoded with mozjpeg), but this ...
1
vote
0answers
57 views

JavaScript variable evasion when quote is escaped, but not newline

I'm searching a way to properly evade from a JavaScript variable to perform XSS. A normal user input will give var a='<b>user input</b>'. a isn't eval anywhere and is not usable. Howewer,...
8
votes
2answers
175 views

Can XHR patching prevent XSS side-effects?

XSS & Single-Page Apps I'm researching on web security, and have seen that token based authentication is good for CSRF prevention, distributed system architectures and processing performance. ...
7
votes
1answer
361 views

Safe to render data directly to DOM from localStorage? XSS attack possible?

I read that localstorage is susceptible to XSS attacks. I currently store JSON Web Token (JWT) in localstorage, and I access and display data about the user through localstorage: var localstore = //...
64
votes
1answer
5k views

Tell browser my site has no scripts

I have created a Tor hidden service site which has absolutely no JavaScript or other types of client side scripts. The page is HTML, CSS, images, and some JSP for handling user input. I encourage ...
1
vote
2answers
96 views

XSS vectors in img src and background-image url

I'm a little confused about XSS vulnerabilities when serving img.src and background url. From what I understand, the only way to execute javascript in this case, is to use javascript protocol. Let's ...
0
votes
0answers
27 views

From a credential flow perspective, whats the difference between FIDO UAF and FIDO 2.0 Web Services?

The FIDO Standard allows for devices and authentication schemes to be certified as UAF or U2F. This allows for flexible unified authentication, and optional second factor enrollment and registration. ...
3
votes
2answers
114 views

Is it possible to trick a person into going to a website, and running JavaScript, without them knowing? (no iframes)

My website is W. If you make a GET request to my website, it gives you JavaScript, and if you execute the JS, then you do some action (if you are logged in and have a session cookie). Can someone ...
0
votes
1answer
68 views

How trivial is identifying a Tor user with JavaScript enabled/ 'allow scrips globally'?

I was browsing using Tor, with Javascript enabled/ 'allow scripts globally'. I made an automated take-down request for something posted on a website, and the next day went back to check if the item ...
-5
votes
1answer
50 views

Is possible to get password with stored XSS? [closed]

Is it possible to get password from a site with stored XSS? I have a forum where I can put JavaScript not directly but inside HTML (like <div onclick="alert()">CLICK</div>). Is it possible ...
1
vote
2answers
140 views

Bypass CAPTCHA form made with 100% JavaScript?

There is a website I have found where the JavaScript handles the response of the CAPTCHA and then proceeds to fire what I believe is an AJAX request. So the flow is as follows: Button -> ...
1
vote
1answer
65 views

XSS Page Cannot be Displayed

When I try XSS on various websites, such as inserting " onmouseover="alert(1) in a search box, I either get a message saying You don't have permission to access this page or This page cannot be ...
4
votes
2answers
110 views

Is this codes usage of document.location.toString() a DOM based XSS vulnerability?

I have come across the following JS code in multiple web applications. I think the reason for the popularity of this code snippet is this accepted answer on SO. Developers seem to be using this code a ...
0
votes
1answer
52 views

XSS to overcome HTML entities

In a search box (<input value=" *insert search term here* "...>), when I input " onmouseover="alert(1), the double quotes are converted to their entities, so it's not possible to break out of ...
59
votes
3answers
43k views

Securing a JavaScript Single Page App with RESTful backend

I'm currently in the process of building a JavaScript SPA and have been researching how to secure it. There is currently as RESTful API that is being completely interacted with through AJAX. We also ...
6
votes
2answers
5k views

Can a website make an HTTP request to “localhost”? How does it get around the cross-domain policy?

I found this website which talks about fixing a Redis vulnerability by exploiting that same vulnerability. The website in question has a "patch me" button, and if you have a password-less Redis ...
-4
votes
1answer
60 views

No SSL: Web Application Security using html fragment identifier (#)

I am currently running my website in shared hosting, and I am not able to register TLS/SSL for my website. However, I implemented jsencrypt [A Javascript library to perform OpenSSL RSA Encryption, ...
1
vote
1answer
246 views

BeeF - How does it work?

I'm mainly server sided. I haven't worked with JS that much before. My coworker was talking about BeeF and how it basically controls the victims browser just by a simple xss attack. I was wondering ...
1
vote
0answers
27 views

Is it safe to use DOMParser to parse client side XML files

Some javascript frameworks or libraries use the DOMParser API to parse XML files from the client. Is it safe to do this. Malicious code can easily be embedded into the XML file (in either the ...
-1
votes
1answer
59 views

Svg width element XSS

I'm working on a svg image generator. Now I want to set the user width and height value. Can a user exploit this element tags? And what should I do to make this secure? <?php $user_input = $...