The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

learn more… | top users | synonyms

-1
votes
2answers
35 views

Considerations for a Web Based Secure Questionnaire System

I am about the start working with my degree project, which is related to Secure Questionnaires. I am currently doing research about how to develop a web based system which requires the users to login ...
4
votes
1answer
100 views

Risks of HTML/JavaScript window.opener security flaw?

I do not know if you are aware of this flaw, but here is a basic example: somepage.html (pointing to malicious.html): <!DOCTYPE html> <html> <head> <meta charset="utf-8"> ...
4
votes
1answer
140 views

JS snippets on my live project do not appear in my code residing on my production server

I have a Django website project that is live (let's call it example.com). It's a forum where users can submit comments and reply to them. It has a Postgresql database, and gunicorn + nginx reverse ...
1
vote
1answer
44 views

Serving javascript from an API and having that execute on the client

I have been proposed a solution where our API serves up some JavaScript which will be executed on the client. The code will render some HTML on the client and provide some functionality such as ...
1
vote
1answer
120 views

Is it possible to get a flash src after a redirect or an element inside an embed/object/iframe tag (cross-domain)?

The URL example.com/auth will automatically redirect the user (HTTP 302) to example.com/signed_in.SWF?token=SENSITIVE. Is it possible for an attacker to steal the token, using javascript or flash, in ...
0
votes
1answer
77 views

How trivial is identifying a Tor user with JavaScript enabled/ 'allow scrips globally'?

I was browsing using Tor, with Javascript enabled/ 'allow scripts globally'. I made an automated take-down request for something posted on a website, and the next day went back to check if the item ...
0
votes
1answer
58 views

Is it secure to get auth TOKEN from server with javascript?

Is it secure to manipulate with auth token inside client side javascript over https ? I want to pass that token to websocket after login. $.getJSON( $SCRIPT_ROOT + '/jscript_get_auth_token', {}, ...
3
votes
0answers
72 views

How to indicate that content in an iframe is untrusted

As part of a website I am developing, untrusted content is displayed in a sandboxed iframe. The content is loaded using the srcdoc attribute, but the iframe is sandboxed using sandbox="allow-scripts", ...
3
votes
0answers
261 views

Problem in underscore.js with “new Function()” when CSP header is set

In underscore.js, template rendering causes violation of the 'unsafe-eval' property, with CSP error at following line: render = new Function(settings.variable || 'obj', '_', source); The solution ...
2
votes
0answers
49 views

Prevent external script from loading using Burp

I am using free edition of Burp Suite to analyze some requests. Suppose, website is https://www.example.com. Now, there is a javascript file in https://www.example.com/templates/scripts/xyz.js. I ...
2
votes
0answers
83 views

Do any specific steps need to be taken into account for the user's browser and browser caching for a HIPAA compliant web application?

I'm currently writing a web application that will need to be HIPAA compliant. It is very JavaScript heavy, and ePHI will be sent over an encrypted connection in the form of JSON. The transmission ...
2
votes
0answers
58 views

Can static analysis of JavaScript be done?

Is it possible to statistically analyze JavaScript to find obfuscated JavaScript? Any algorithms or equations with coefficients that can find obfuscated JavaScript?
2
votes
0answers
100 views

Suspicious web-application requests containing encoded JavaScript function(?)

I've been seeing some odd traffic in the logs for a web-application (Apache) that I'm wondering about, and I'm hoping that someone here has seen this before. The raw requests were variations of: ...
2
votes
0answers
187 views

How does JavaScript Injection work?

I was watching a DefCon talk and the speaker was saying he was able to infect JavaScript cache files, once the user visited his website/server. From there he was able to load scripts from other sites ...
2
votes
0answers
105 views

Securing a JavaScript app with RESTful backend

I went through the question Securing a JavaScript Single Page App with RESTful backend that has discussions / options around securing a Javascript client side app that invokes RESTful APIs. However, ...
1
vote
0answers
32 views

Detecting disabled Chrome plugins using JavaScript

My cable was on the fritz this weekend and I had to visit a friend to watch HBO online. Something weird happened that has been bothering me. I have disabled the Flash plugin on Chrome, since all ...
1
vote
0answers
59 views

JavaScript variable evasion when quote is escaped, but not newline

I'm searching a way to properly evade from a JavaScript variable to perform XSS. A normal user input will give var a='<b>user input</b>'. a isn't eval anywhere and is not usable. Howewer,...
1
vote
0answers
28 views

Is it safe to use DOMParser to parse client side XML files

Some javascript frameworks or libraries use the DOMParser API to parse XML files from the client. Is it safe to do this. Malicious code can easily be embedded into the XML file (in either the ...
1
vote
0answers
56 views

Compilations of PoC of JavaScript vulnerabilities?

I am a researcher looking for some proof-of-concept JavaScript vulnerabilities like XSS that exists in some website or JavaScript libraries in the past. Are there any compilations of them?
1
vote
0answers
77 views

Security flaws while storing auto-login token

I must to accomplish auto-login with a token on my website. Token is generated on back-end, on front-end (Single-Page Application) I have to store token in secure way. I'm using secured channels (...
1
vote
0answers
48 views

How to remember the trusted machine in an application

We need to remember trusted devices in our application. I have done some R&D for this and found out that Facebook achieves this using cookies. But, if I see Google, they don't use cookies, I guess....
1
vote
0answers
39 views

Authenticate with ADFS without Javascript?

I'm trying to allow a search engine that doesn't support javascript to crawl content protected by ADFS. Is there a way to allow clients that don't support javascript to authenticate to an ADFS ...
1
vote
0answers
160 views

Securing a JavaScript Single Page App with SAML

I would like to secure a JavaScript Single Page App with SAML. My server is powered using Node.js and serves a RESTful API. What are my options? Details: I have worked with OAuth2 in the past, but I ...
1
vote
0answers
88 views

Should javascript and css “.map” source maps be included on production servers?

Source maps are a convenient way to work with directly with code that has been obfuscated and/or minified, yet trace errors back to the original "pretty" code. My understanding is that obfuscating ...
1
vote
0answers
114 views

ASP.NET WCF security, javascript and handling sensitive information

I've come upon what I would call some "nasty" javascript coding (I come from a KnockoutJS / Angular / Web API 'world') in which WCF services are exposed to javascript by production URL's, i.e. "...
1
vote
0answers
188 views

XSS Vectors for new Image()

What are possible XSS vectors to this JavaScript code new Image().src = encodeURI('[user url here]'); Let's assume two cases: [user url here] is some string provided by user (with no validation) [...
1
vote
0answers
118 views

Hacking attempts:in.js

A client of mine keeps getting hacked by seemingly SQL injection where a script tag containing a link to an "in.js" file is added. Sometimes from a domain called sportserve.co.uk, other times from ...
0
votes
0answers
64 views

How can JavaScript be uploaded safely to a server through a web app?

Can users who have access to web content management system be allowed to upload JavaScript files to the web server through a web app in a safe way? Or shouldn't uploading JavaScript be allowed by ...
0
votes
0answers
24 views

Security risks with setDomStorageEnabled(true) in Android?

What are the security risks associated with enabling setDomStorageEnabled(true) method? Reference.
0
votes
0answers
28 views

From a credential flow perspective, whats the difference between FIDO UAF and FIDO 2.0 Web Services?

The FIDO Standard allows for devices and authentication schemes to be certified as UAF or U2F. This allows for flexible unified authentication, and optional second factor enrollment and registration. ...
0
votes
0answers
47 views

Encoding payloads for GWT version 7

I'm auditing a website built with Google Web Toolkit. It uses serialization version 7, so the tools from GDS Security won't work (they only work till version 5). Using this technique I got all classes,...
0
votes
0answers
37 views

Youtube API security

I was playing about with youtube's API yesterday and did some research about its security. Now.. I have a website which I would like to apply Youtube API for it and I just wonder how NON-secure is to ...
0
votes
0answers
107 views

Adobe Flash-based site's UI misbehaves when it's accessed through a VPN. Is it leaking my real ip address?

Here is a setup: A Linux/Windows VM at home (will call it "hidden VM" from now on) which is placed into an isolated environment (it's located in its own isolated virtual network, and the only way ...
0
votes
0answers
33 views

XSS script syntax problem

I have a server running on port 4444 on localhost that just echoes messages it receives. I have a JS script embedded in a message that is supposed to send the cookies of whoever looks at it. Here ...
0
votes
0answers
42 views

Widget to client web encryption on an uncontrolled LAN

I asked a broader question related to this on serverfault, but I think probably the specific case I'm thinking of might be best considered here. My basic problem is this: I am providing physical ...
0
votes
0answers
170 views

injecting javascript in webviews in Android

I am relatively new to mobile application security. Currently I am supposed to audit an android application which uses a webview to display some static FAQ page in an activity. The webview in ...
0
votes
0answers
108 views

Securing my API: concept of access tokens

First of all I want to excuse for the bad spelling and grammar. English is not my mother tongue. I have built a JSON communication between a front-end (website) and my Node.js web server. I want to ...
-1
votes
0answers
35 views

How does this XSS “filter bypass based polyglot” from OWASP work?

I tried some XSS on a practice site and copied random codes from the OWASP cheat sheet to see what happens and I found this code: '">><marquee><img src=x onerror=confirm(1)></...