The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

learn more… | top users | synonyms

2
votes
1answer
64 views

Securely identify clients by web app

I have a web service S that provides certain services. There are two web apps, A1 and A2, both on different servers within the same VPN, which I trust and want to grant access to my web service. ...
1
vote
1answer
119 views

Attack using weird characters followed by some javascript in a URL?

I'm seeing a very weird attack this morning from a pile of VPS instances spread out across the US. The URLs look like this: /js/bundles/,!0):this.element.propAttr( ...
0
votes
2answers
35 views

Is it safe to log JavaScript exceptions to the error console?

I know that on the server side it's very bad to display system-level errors instead of logging them to disk, because it could expose potentially sensitive information, but do the same concerns apply ...
0
votes
1answer
102 views

Is there any security benefit in stripping only `<script>` tags that contain code?

On a client's corporate network something is stripping all <script> elements that contain code, i.e. things like <script type="text/javascript">do_something();</script> will simply ...
2
votes
1answer
39 views

Limiting latter dom-based XSS when setting document.title

Given some JavaScript which modifies the page's title by taking in variable data document.title = someVariable I am looking to address dom based XSS while keeping the title fairly readable. ...
2
votes
2answers
85 views

Security of Firefox extensions such as Mailvelope

I am asking these question because I am not very familiar with javascript or the Firefox plugin/extension system. The specific context is the Mailvelope pgp extension but the questions are general and ...
1
vote
0answers
45 views

Pre-internet encryption for a rest application

I have a project idea that I want to code. There will be a huge gain for my user to be able to use it over a website and on their mobile device. The problem is the data will contains financial data ...
1
vote
2answers
42 views

Temporary XSS Vulnerability

I found xss on a textarea field. When you enter a character to this field it output the character on realtime so when i input the following code: <input onclick=alert(document.cookie)> there ...
2
votes
2answers
284 views

Would usage of jCryption 3.0 + SSL have mitigated the Heartbleed vulnerability?

I came across a project called jCryption 3.0, which encrypts data between the client and server, without using SSL. If a website's JavaScript had used jCryption 3.0 to encrypt login form fields before ...
15
votes
6answers
6k views

Preventing information disclosure from browser back button/history?

I have sensitive data that will be hosted on a website, and I would like to prevent the data from being exposed in this scenario: The primary user logs off the application, but does not close the ...
3
votes
1answer
96 views

How can I successfully perform an xss attack on a dummy website? [closed]

in my security course, we were told to practice an xss attack using firefox on this website; http://permalink.co/ No worries, this is a website specifically setup for us to practice ...
3
votes
1answer
840 views

How to secure my REST implementation for an ember.js app

I've been searching and searching for what seems days and have not come up with any definitive answer on a solution to my problem. To explain without going into terrible detail I am building a store, ...
0
votes
4answers
427 views

What are JS malware attack techniques?

Malicious JavaScript (generated by malicious hosted PHP code for example) can lead to attacks. What are the types of attack that malicious javascript could perform? Are the drive-by download attacks ...
11
votes
2answers
2k views

Where do I find JavaScript malware?

I am looking for JavaScript malware. I need it just for local tests on my computer for a project I am working on. Are there any Internet resources where I could find this?
-3
votes
0answers
14 views

Php's password_hash encoding for HTTP basic authentication [migrated]

My problem: I need, basic authentication over HTTP (client can't afford HTTPS). So I don't worry if communication is not encrypted. I just want to prevent some user from sniffing and using the ...
0
votes
2answers
88 views

Source code disclosure vulnerability

I am a bit confused about the discussion here about hiding javascript source code. Let's say if I browse to a url like this: http://www.example.com/site/somejs.js and then what I see is something like ...
1
vote
2answers
55 views

Using DNS to track browser activity on a LAN

I am trying to create a small network auditing script that tracks HTTP and HTTPS domain names visited by certain hosts using the libpcap wrapper for Nodejs. At its best the script would be able to ...
2
votes
0answers
14 views

How to Allow users to save html in Rails application without affecting security [duplicate]

After doing a lot of research I come to this forum hopefully i can get some help. I am building a Ruby on Rails application (version 4.2) My app allow users to create "one page" portfolio : user 1 ...
1
vote
1answer
65 views

Cross Domain Javascript security [duplicate]

I used a web vulnerability scanner to scan my web site. It indicates several links with "Cross domain Java script source file inclusion." May I know how would an attacker exploit this type of ...
1
vote
1answer
532 views

How to detect if a site is using a JavaScript exploit?

Is there a way for me (non-expert in JavaScript) to detect JavaScript attacks from a website. I have done a lot of searching around and have not come up with a definitive answer. NoScript is a pain in ...
1
vote
2answers
82 views

What's the best way to secure the responses in a single page web app after logout?

I've read some of the great responses to storing and passing session keys in a single page web application (i.e., a web "site" that runs mostly on the client-side, getting data from the server by ...
1
vote
1answer
187 views

Can a Java servlet filter be used to pull out scripts that aren't whitelisted?

I might be asking a similar question to this: Whitelisting DOM elements to defeat XSS But I think my proposed solution is different and I was wondering if I could get the community to comment on ...
0
votes
0answers
43 views

Best practices to invalidate JWT while changing passwords and logout in node.js?

I would like to know the best practices to invalidate JWT without hitting db while changing password/logout. I have the idea below to handle above 2 cases by hitting the user database. 1.Incase of ...
0
votes
3answers
574 views

bot detection via browser fingerprinting

I've recently noticed that a few companies have begun to offer bot and scraping protection services based on the idea of browser fingerprinting to detect them, and then blocking the specific ...
1
vote
2answers
105 views

XSS outside of the DOM

I have the following JS (using jQuery for brevity's sake but it isn't necessary for the question): $("<i></i>").html(userInput); Is it possible for someone to input some string, ...
0
votes
0answers
67 views

Securing my API: concept of access tokens

First of all I want to excuse for the bad spelling and grammar. English is not my mother tongue. I have built a JSON communication between a front-end (website) and my Node.js web server. I want to ...
4
votes
1answer
327 views

How secure is JavaScript based OAuth 2.0

JavaScript based OAuth exposes the client ID of the application and it trusts only on the domain requesting the access token. The domain name can be forged with a DNS hijack (or a virus affecting ...
0
votes
1answer
113 views

Verify CDN javascript's integrity

CDNs speed up the loading of websites by allowing caching for frequently used javascript libraries like jquery. How do we know if they have modified the javascript before serving it to my clients? ...
0
votes
1answer
27 views

Secure keyboard entry with JavaScript or Flash?

Is it possible to perform secure keyboard entry (similar to what is offered in the OS X Terminal app) using only web technologies and/or Flash? If not, is there any way to more broadly guarantee ...
0
votes
1answer
56 views

How can I secure my server to ensure pre-login calls are originating from my app?

I have a .NET Web Api servicing a Cordova based mobile app and web front end written in AngularJS. I have done a ton of research and most sources don't give a great answer or one that's huge overkill ...
0
votes
1answer
41 views

From a security perspective, why not a screenshot api for browser? [closed]

I mean a javascript api for capturing a renderered html page, or current viewport, and dump content onto an image. While there are obvious attacks, such as taking screenshot of sensitive information, ...
2
votes
2answers
183 views

Website infected with unwanted “redirections”, apparently via javascript code

I'm working on a clients website, and I realize they've been compromised. Early today there was a major problem with a php eval(base64_decode issue. That was cleaned up via Andy Stratton clean.php ...
9
votes
2answers
2k views

How do the Stack Exchange sites protect themselves from XSS? [duplicate]

It seems to me that because Users can post questions and comments in them with HTML markup (possibly <script> tags), Stack Exchange sites would be very exposed to XSS attacks. How do they ...
3
votes
1answer
82 views

How does the same-origin policy apply between browser tabs? [duplicate]

Let's assume that we have 2 open tabs in a browser containing page A (A.html, A.js) into the first tab and page B (B.html, B.js) into the second tab and that page A and B have the same origin (scheme, ...
1
vote
1answer
134 views

Encrypted quiz data in PHP and JS

I'm developing a quiz with which you can win a few cool prizes. Therefore I'm afraid, that someone might try to hack/manipulate it. All participants have to be logged in and the website takes 15 ...
2
votes
2answers
111 views

High level design for secure web application

I'm looking for some advise on designing a secure web app for storing passwords. Why reinvent the wheel? Because I don't trust a 3rd party with all of my passwords. Here are my thoughts: There are ...
8
votes
3answers
196 views

Preventing user supplied javascript from posting to external server

I am writing an internal tool that will support plugins written by other developers. Ideally, these plugins would have a Javascript component to allow people to make widgets. Some of the pages these ...
7
votes
2answers
17k views

Javascript and jQuery not secure over https

I am building an ASP.NET MVC 3 app which will run in Azure. Everything was working well, until I switched to https. Now most of my jQuery plugins and some other javascript are not secure. I'm using ...
14
votes
4answers
4k views

Generate cryptographically strong pseudorandom numbers in Javascript?

Is there any good way to generate cryptographically strong pseudorandom (or true random) numbers in Javascript? The crucial requirement: if a.com's Javascript generates some random numbers, no one ...
2
votes
1answer
104 views

How is the QSS tag used as payload in an XSS attack?

I have received a report from a client that lists XSS vulnerabilities. The report shows reflected XSS vulnerabilities. In each vulnerability, the payload reflected is a single, unclosed <qss> ...
0
votes
1answer
221 views

Preventing socket.join(“room”) client-side, listening for private room leaving

i'm developing an application with Socket.IO that needs to authenticate if user can join a room. Client side: var socket = io('http://<?php echo $_SERVER['HTTP_HOST'];?>:3000'); ...
2
votes
1answer
45 views

Spoofing of Server Sent Events

In the spec for Server Sent Events, it says Authors should check the origin attribute to ensure that messages are only accepted from domains that they expect to receive messages from. Otherwise, ...
1
vote
1answer
170 views

What are the security risks associated with PDF files?

What are the security risks associated with PDF files? There is, of course, the general risk associated with any type of file: that whatever application is used to read it will have a bug that can be ...
41
votes
4answers
12k views

Why is the same origin policy so important?

I can't really fully understand what same origin domain means. I know it means that when getting a resource from another domain (say a JS file) it will run from the context of the domain that serves ...
-1
votes
2answers
112 views

Is JavaScript console vulnerable to XSS

Assume the content of the name variable below is controlled by an attacker. Is this line of code vulnerable to XSS? console.log(name) When I send an injection in name variable I see its value ...
4
votes
1answer
160 views

Suspecious js file sent as email attachment

I received a js file with following code in my spam folder but I decided to take a look into the file. Do anybody of you know what does this code might do? var evl='';function nr() { evl = '}; ' + ...
3
votes
5answers
9k views

Hiding JavaScript source code

In a web-app should one strive to hide as much of the code as possible, for example from view source? In particular I was wondering should JavaScript be hidden, especially ones used for Ajax? I was ...
23
votes
2answers
4k views

JavaScript written only with brackets?

I once saw JavaScript code which was only written as multiple brackets (). Does anybody remember this kind of code? There was also an online converter to convert "normal" JS into this style of code. I ...
5
votes
1answer
301 views

Exploit SoakSoak injected in Wordpress

I have recently received an attack to my website and Google is warning visitors to not load the page. The malware is located in wp-includes/js/swfobject.js of my Wordpress and I had deleted it but ...
49
votes
6answers
5k views

Does injecting querystring values directly into HTML pose a security risk?

Someone reported a bug on my site that I don't really consider an issue. My site has an URL akin to this: www.site.com/ajax/ads.asp?callback=[text injection] So filetype is application/json, and I ...