The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

learn more… | top users | synonyms

3
votes
4answers
2k views

How to prevent attacks against client side validations?

I have a login form where am accepting Mobile Number of the User for login. When Mobile Number is submitted, am calling a JavaScript to validate the Mobile Number. My client side validations ...
1
vote
3answers
113 views

How to detect malicious JavaScript in a PDF file?

Is having any JavaScript in a PDF file by definition dangerous or is it only dangerous when specific functions (for example eval) are used inside a PDF, in which case, what JavaScript functions are ...
3
votes
1answer
109 views

How secure is HTML5 web storage (sessionStorage and localStorage)?

I'm thinking of using either sessionStorage or localStorage to store some important user data. The extension's functionality will only work in the context of a particular website that defaults to ...
-1
votes
0answers
7 views

Knowledge base solution access [on hold]

Presently working on a knowledge-based solution platform which I want to be accessed both online /offline via data and sms by searching keywords.... Please I need help with regards to the offline(sms) ...
1
vote
2answers
436 views

Is this sanitizer vulnerable to XSS?

To have a simple and secure editor for text fields of a django app, I have this snippet to sanitize input HTML into django code: from bs4 import BeautifulSoup def sanitize_html(value): ...
6
votes
0answers
141 views

Vulnerability in popular Javascript Framework (Angularjs)

I found a bug that allows you to escape the AngularJS template sandbox. Angular is a mustache based template language. It allows you to put expressions that are evaluated in your html. For example, {{...
4
votes
2answers
2k views

DOM XSS attack failing in Firefox

I am trying to perform DOM XSS attack to exploit a vulnerability of localhost webpage. I am able to perform the attack successfully on IE-11 and Chrome. But Firefox is preventing me to perform the ...
-3
votes
1answer
47 views

Which WYSIWYG editor has the best security reputation? [closed]

I would like to use a pre-built WYSIWYG editor such as TinyMCE or CKEditor in a website that I'm building. Since I expect my users to be entering confidential information into the editor it is ...
0
votes
2answers
84 views

Is it secure to get auth TOKEN from server with javascript?

Is it secure to manipulate with auth token inside client side javascript over https ? I want to pass that token to websocket after login. $.getJSON( $SCRIPT_ROOT + '/jscript_get_auth_token', {}, ...
4
votes
1answer
125 views

Risks of HTML/JavaScript window.opener security flaw?

I do not know if you are aware of this flaw, but here is a basic example: somepage.html (pointing to malicious.html): <!DOCTYPE html> <html> <head> <meta charset="utf-8"> ...
3
votes
0answers
41 views

Simple Authentication Method to Secure REST API

I've been desperately trying to find a simple method of securing my API but still haven't found one that works. Unlike a lot RESTful APIs my API doesn't need user logins, tokens that expire, or other ...
4
votes
1answer
145 views

JS snippets on my live project do not appear in my code residing on my production server

I have a Django website project that is live (let's call it example.com). It's a forum where users can submit comments and reply to them. It has a Postgresql database, and gunicorn + nginx reverse ...
0
votes
1answer
58 views

How does malware downloaded by JavaScript get executed, and why would you distribute malware in a .js file?

I have two questions about JavaScript as an infection vector. The first one is about a user getting infected while visiting a website, and the second is about getting infected by e-mail via attachment....
2
votes
1answer
879 views

HTML iframe security exploit

Can somebody explain if there's something malicious in this HTML, The width and height of the iframe ares set to 1 and it's out of the view with top: -100px; statement. I believe it takes some some ...
0
votes
1answer
33 views

How to securely insert JSON objects into javascript, DOM content and html elements attributes?

Is there a way to sanitize or scape strings to secure put data in a object into script or DOM like: var myObj = JSON.parse({someObject: value}) someElement.innerHTML('<div data-id="'+myObj....
0
votes
1answer
49 views

Script injection on all browsers

I have something injecting a script into all web browsers that I have tried - Firefox, IE, Edge, Chrome - and it doesn't look like an extension (since it is doing so in different web browsers). I ...
2
votes
2answers
142 views

JavaScript variable evasion when quote is escaped, but not newline

I'm searching a way to properly evade from a JavaScript variable to perform XSS. A normal user input will give var a='<b>user input</b>'. a isn't eval anywhere and is not usable. Howewer,...
0
votes
1answer
31 views

How to GET security answer values via AJAX for user edit

I have an issue where our app had an app scan issue. The application is using GET to retrieve info for a user profile page (written in HTML/Javascript). This page has the user's security questions ...
1
vote
0answers
59 views

Detecting disabled Chrome plugins using JavaScript

My cable was on the fritz this weekend and I had to visit a friend to watch HBO online. Something weird happened that has been bothering me. I have disabled the Flash plugin on Chrome, since all ...
1
vote
1answer
48 views

Serving javascript from an API and having that execute on the client

I have been proposed a solution where our API serves up some JavaScript which will be executed on the client. The code will render some HTML on the client and provide some functionality such as ...
1
vote
3answers
202 views

Reflective XSS in script codes with Content Type “text/javascript”

I have a webpage that returns raw script code with the headerContent-Type: text/javascript. However I found that there is a reflective xss in one of the parameters passed to the url which is copied ...
7
votes
2answers
84 views

Ending a javascript block without slash character

Very frustrating situation on a pentest I am currently doing - I have found a place where I can inject almost all characters into a piece of javascript from a parameter. But the web developers seem ...
0
votes
1answer
59 views

Deobfuscating JavaScript Malware

Recently I was going over my network activity and came upon a PCAP that is directly related to a Trojan Dropper. Taking a quick look into the TCP stream of the packets, I found some malicious ...
3
votes
1answer
81 views

XSS filter bypass to hook BeEF

I found a vulnerability on a website which allows me to trigger XSS. It's a very specific vulnerability, which is caused by a design-flaw. I want to write a PoC for them but I'm stuck at this step. ...
-2
votes
1answer
20 views

How do I perform output encoding on text boxes having fixed size?

I have a fixed size text box which expects '<' and '>' symbols as input. It is a requirement for that text box to expect '<' and '>' in its input so I can't perform input validation for that ...
0
votes
1answer
47 views

How can I disable javascript alert and access the webpage? [closed]

Few days ago I opened a webpage of my academics website, I wanted to download the webpage but it has a javascript alert box pop up so after that I wasn't able to access anything either on the browser ...
3
votes
2answers
236 views

Disclosure of end user files / Installation of Trojan horses via XSS

I've stumbled upon following examples of XSS attacks on OWASP: "Other damaging attacks include the disclosure of end user files, installation of Trojan horse programs..." Link to the example: https://...
1
vote
0answers
27 views

Help injecting a MongoDB used by a Python web app

this is a follow up to this thread. So I am trying to perform a NoSQL injection on a web application that is written in Python and connects to a MongoDB backend. The issue I am having is that I am ...
1
vote
1answer
42 views

Is it possible to secure a web page from a Chrome extension?

Detecting and outsmarting an AdBlocker is trivial, but this got me thinking about the issue in terms of a security battle between a page's native script and an extension. In terms of Chrome Extensions,...
6
votes
1answer
110 views

Is there a reason why legit web sites are using this type of obfuscation?

Saw some top 200 web sites (by Alexa) using obfuscation in the javascript code. Any ideas on why they do it? My guess is that they do it to prevent data scraping, but not sure. Thanks. youtube ...
1
vote
3answers
373 views

Is this code javascript vulnerable to DOM based XSS?

Code : <script> document.theform.reference.onchange = function(){ var id = document.theform.reference.selectedIndex; var url = document.theform.reference[id].value; ...
1
vote
2answers
96 views

Risks in avoiding AdBlock detection by importing cookies or simulating the displaying of ads

I've increasingly been finding that many of the websites that I access have now been requesting whitelisting by my adblocker. Sites that do this like Forbes, NDTV, do not allow you to proceed until ...
1
vote
1answer
72 views

Javascript file detection

One common technique I use is xor bruteforcing on binary data. In this case, I would like a heuristic approach to determine whether or not any possible candidate plaintexts are javascript. This rules ...
4
votes
1answer
997 views

What are the security risks associated with PDF files?

What are the security risks associated with PDF files? There is, of course, the general risk associated with any type of file: that whatever application is used to read it will have a bug that can be ...
0
votes
1answer
82 views

How trivial is identifying a Tor user with JavaScript enabled/ 'allow scrips globally'?

I was browsing using Tor, with Javascript enabled/ 'allow scripts globally'. I made an automated take-down request for something posted on a website, and the next day went back to check if the item ...
8
votes
1answer
862 views

Child iFrame hash verification of parent iFrame content

Consider the following scenario: Alice wishes to browse Victor's website while on the job at Initech. Victor's website is hosted on an alternative domain name system to which Initech's DNS does not ...
7
votes
2answers
629 views

Did XSS reach its end-of-life with the introduction of the HTTP X-XSS-Protection header?

With the introduction of the HTTP X-XSS-Protection header it seems to me that the vulnerability impact (read: amount of possibly affected users with modern browsers) is drastically reduced. Firstly, ...
18
votes
3answers
7k views

Cross Site Scripting without special chars

I'm testing a web application and I found a XSS vulnerability. I can break a tag and inject some code to the application but nothing potentialy dangerous for the client. The application has a filter ...
0
votes
3answers
549 views

Preventing SSL strip attack

Is it possible to detect a SSL strip attack by checking whether the page delivered is HTTPS or HTTP using JavaScript? I am assuming that the response page is HTTPS page instead of HTTP?
7
votes
2answers
3k views

What is a good XSS vector without forward slashes and spaces?

I need an XSS vector that doesn't use forward slashes nor spaces. I've gone through lists of hundreds of vectors, but they usually have one of those two. The space gets URL encoded, and anything after ...
4
votes
1answer
154 views

How to de-obfuscate a malicious payload?

I've received some spam email that led to a JavaScript file which I assume is malicious. My curiosity got the best of me so I opened the file in notepad and I'm trying to make sense of the code but I ...
3
votes
2answers
160 views

Ransom32: How does it work?

Ransom32 seems to be a new ransomware written (partly) in JavaScript. As I understand it, it doesn't affect a user through a browser / by visiting a website, but by downloading some .rar file which ...
3
votes
2answers
86 views

How to secure communications between a web front-end and the web server when/where the HTTPS protocol is compromised?

A country in the Central Asia has issued a law enforcing all the ISPs to decrypt the transit HTTPS traffic and encrypt it with a special certificate issued by the government. Every client is to ...
1
vote
1answer
100 views

DOM based XSS: jQuery(“#HiddenReferral”).val(jQuery(location).attr('href'));

DOM based XSS has been reported by Burp Suite and showed this query as vulnerable: The application may be vulnerable to DOM-based cross-site scripting. Data is read from location and passed to ...
22
votes
4answers
5k views

Suspicious JavaScript in website header

I am not sure if this is the correct place to ask a questions such as this, apologies if it isn't. I have found the below code in the header of one of my wordPress websites, I am pretty sure it is ...
-1
votes
1answer
560 views

Can someone break my anti DOM-based XSS javascript function? [closed]

Can someone break my anti DOM-based XSS javascript function using window.location? function parseparameters() { var href = window.location.href; var id = href.indexOf('#'); ...
5
votes
2answers
101 views

Revising Phising Email & it's payload… did I do this right?

Recently my company got a widespread phishing email sent to them, thankfully no one clicked the link (which is great!) Since I'm a student and a current intern working in IT Security I wanted to see ...
2
votes
2answers
100 views

Hardening Javascript in respect to Javascript Malware/Ransomeware like Ransome32

Are there any methods or standards to harden Javascript implementations to help reduce/remediate the the risks associated with Javascript malware like the Ransom32 or other types of Javascript attacks?...
0
votes
3answers
126 views

Random characters and letters form obsfuscation

I know that this question has been asked many times, but would JavaScript encryption work if I just added 100 random numbers and letters to the password? That would be hard to reverse engineer, ...
1
vote
1answer
485 views

Using htmlentities() in a BBCode-supporting textarea to stop XSS

I want to have a text area to post stuff to the database with BBCode. So, I downloaded a JavaScript code (to write in the specific BBCode when the image is clicked) but it didn't transform the text. ...