Tagged Questions
2
votes
2answers
65 views
Is it safer to store the XSRF value inside your JavaScript?
To protect yourself against XSRF, you need to have a separate token on a page.
See: Coding Horror: Preventing CSRF and XSRF Attacks, by Jeff Atwood
As the posting suggests, its best to have those ...
10
votes
3answers
394 views
Is stripping out < and > characters an effective way of preventing XSS?
I'm guessing that HTML encoding the input would probably be a better solution, but I'm curious if just stripping out any < and > characters would be an effective defense against XSS attacks.
...
3
votes
1answer
80 views
What are good tools for CRLF discovery? [closed]
What are good tools for finding CRLF injection vulnerabilities?
6
votes
3answers
233 views
Is there a way to bypass Django's XSS escaping with “unicode”?
Django (the Python web framework) escapes output to prevent XSS (Cross Site Scripting) attacks. It replaces ', ", <, >, & with their HTML safe versions.
However this presentation on slide ...
1
vote
1answer
186 views
bypass a regex filtration to perform an xss attack
Does the regex [\w/$!.*-]+$ stop the injection of payloads like :
"><script>alert(4)</script>
" onload="alert(4)"
...
-1
votes
1answer
146 views
can someone break my anti dom based xss from the window location? [closed]
can someone break my anti dom based xss from the window location ?
function parseparameters()
{
var href = window.location.href;
var id = href.indexOf('#');
if (id ...
1
vote
2answers
466 views
HTML encoding to protect against XSS
While going through some references about protection against XSS i found that it is a good practice to encode data (entered by users) before using it to generate a dynamic page. I was not able to find ...
1
vote
4answers
323 views
Simple solution to XSS
I've got an idea as to how to defeat XSS so simple that it may work and was wondering if anybody had already done something similar.
The goal here is not efficiency but security. In other words I ...
3
votes
1answer
209 views
Is it possible to exploit XSS inside User-Agent header? [duplicate]
I've found an xss bug inside user-agent header on one popular buy/sell site , and after reporting it to them , they answered that it is not dangerous as it can not be exploited without user ...
3
votes
1answer
179 views
CodeIgniter CSRF confusion
I have been working with CodeIgniter for about 3 weeks and am very well on the way to loving this framework. However I have been looking at the core code of the framework and I was reading over the ...
1
vote
2answers
152 views
Breaking out of attribute in double quotes
I have a piece of code that allows for
[url]someurl[/url]
BB-Code and replaces it with
<a href="someurl">someurl</a>
It takes two precautions to prevent XSS.
It replaces ...
11
votes
3answers
291 views
What does a HTML filter need to do, to protect against SVG attacks?
I recently learned that SVG (Scalable Vector Graphics) images introduce a number of opportunities for subtle attacks on the web. (See paper below.) While SVG images may look like an image, the file ...
3
votes
1answer
169 views
How did the Tumblr worm spread?
Recently Tumblr was hit by a fast-spreading worm.
How did the worm work? What was the vulnerability in Tumblr that it exploired? Did it exploit a XSS vulnerability in Tumblr? A CSRF vulnerability ...
2
votes
1answer
144 views
Possible to execute a non-persistent XSS attack without using the url/query string?
I've been reading up on non-persistent XSS and all of the examples I have found use the situation where a webpage takes something from the url/query string and places it on the page.
Is there any ...
2
votes
4answers
307 views
referrer checking as a defence for XSS attack
After reading the question about referrer and the answer of @D.W., I did not understand the following part:
XSS defense. Strict referer checking can make reflective XSS attacks
harder, because ...
2
votes
4answers
810 views
What XSS attacks doesn't “Reflective XSS Protection” defeat?
Its been quite a while since I have played with cross site scripting vulnerabilities but today I came across a website today that was crying out to be tested for a basic XSS vulnerability.
So ...
0
votes
1answer
376 views
How to escape user input in a value of javascript object?
How to properly escape user-controlled input when it's inserted as a value in JSON object?
<script>
$(document).ready(function() {
new MyObject({
key1: "user_input",
key2: ...
4
votes
2answers
100 views
filtering content in Content disposition header
I was reading "The Tangled Web"(A book that I'm enjoying very much) and I have a doubt in the following excerpt taken from it :-
When Handling User-Controlled Filenames in Content-Disposition Headers
...
4
votes
2answers
234 views
CSRF Protection on static pages
I have a static site which has forms. The forms submit to a Rails endpoint which captures the submitted data. The static site and the Rails endpoint are on the same domain, on different subdomains and ...
2
votes
6answers
900 views
Efficient way for finding XSS vulnerabilities?
Manual (reliable) way: Put string containing characters that have special meaning in HTML into some parameter of HTTP request, look for this string in HTTP response (and possibly) in other places ...
4
votes
5answers
983 views
XSS : Blacklist characters vs. whitelist
I have been studying to prevent my web app against XSS.
I read about it on OWASP and other security channels, they all say that use ESAPI and similar library, and also do input filtering through ...
3
votes
2answers
322 views
Is Drupal's filter_xss enough for filtering HTML?
Drupal has filter_xss function. Is it safe to use for filtering arbitrary user HTML input?
If not, what should be used instead when using Drupal 7?
This questuion is a duplicate of Drupal's built-in ...
2
votes
4answers
622 views
What is the danger of Reflected Cross Site Scripting?
What is the danger of Reflected Cross Site Scripting?
I understand the Reflected XSS is dangerous, because it's possible. But what practical attacks can be performed using Reflected XSS?
1
vote
1answer
146 views
Web Application Firewall Rule Optimization
Following are the two Rules taken from ModSecurity CRS core Ruleset. These two rules are base Rules for XSS attacks. If we look at these two rules their variables and actions are same what they differ ...
2
votes
2answers
189 views
What is cross-site-scripting? [duplicate]
Possible Duplicate:
Can anybody explain XSS to an idiot?
First I ask is there an aboslute definition? I've done some Googleing and it seems like everyone says something different.
On SO ...
1
vote
1answer
311 views
LFI or RFI from XSS?
Could XSS lead us to the Local File Include or Remote File Include?
I read article that it's possible to upload shell via XSS vulnerability, but I still have no idea how it had been achieved.
3
votes
1answer
184 views
Multibyte Character Exploits JSP/PostgreSQL
I am trying to secure a web application, written in Java/JSP and running on PostgreSQL, against SQL injection. I ran into this very interesting answer, which refers to PHP and MySQL. Is there any ...
5
votes
3answers
1k views
Is it possible to inject HTML into image to provoke XSS?
Some answers mention that it's possible to inject attacker-controlled HTML into images and therefore provoke XSS.
I guess that this HTML will be processed by browser only if hole exists in browser. ...
3
votes
5answers
1k views
How can I execute a XSS with these conditions?
I am trying to learn penetration testing and I have downloaded a vulnerable application called "Bodgeit Store". I have finished almost all the challenges except one which is to execute a Cross-Site ...
12
votes
2answers
923 views
How do I use Markdown securely?
How do I use the Markdown library safely? What do I need to do to make sure that its output is safe to include into my web page?
I want to allow untrusted users to enter content (in Markdown ...
3
votes
4answers
750 views
XSS : Content-type: application/json
Background information
- Application responds to request to a particular URL with content-type: application/json
JSON response contains a parameter from the request
Escapes the quote with a slash
...
4
votes
4answers
5k views
Security issues using iframes
We are looking to move to iframes due to technical challenges. By moving to iframes it will be easier to manage the technical issues. But we are not totally sure of security implications of iframes.
...
7
votes
2answers
587 views
Interpolique: transparently preventing SQL Injection and XSS with base64 encoding, what happened?
For the keynote at The Next HOPE a couple of years ago, Dan Kaminsky unveiled Interpolique (the talk is really fun btw). The problem he raised was how to defend against injection attacks, including ...
2
votes
2answers
116 views
For untrusted user upload sites: what should the contents of crossdomain.xml and clientaccesspolicy.xml be?
Flash has a long history of ignoring MIME types of files and reading the file directly for executable content or for cross domain execution permissions. That means a malicious user can take advantage ...
-2
votes
2answers
164 views
Cross Site Scripting Related Query | Web Application Security [closed]
In some tutorial i have read that we can filter meta characters and all that. I know all about that. in that tutorial there were written like this.
People who attack site with script, its basic ...
7
votes
3answers
572 views
How bad is a Self Contained XSS attack?
Some of you might be familiar with this attack called Self Contained XSS. I recently stumbled upon this article about it. So how bad this kind of attack can be, even though this doesn't have access to ...
4
votes
6answers
599 views
Filter user input before the database or upon display?
Given a web application where user data must be properly escaped to avoid XSS, is it better to try to remove the "bad stuff" before it enters the database, or is it best to allow it in the database ...
6
votes
3answers
515 views
How serious are XSS attacks
A website I visit allows this kind of attack, to be implemented with GET in the URL
<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
Along with many others on this page: ...
3
votes
2answers
407 views
Is this an example of XSS attack?
A scripter sees on certain web pages it's technically possible to include markup like HTML and CSS/JS. It's technically possible to submit a javascript or iframe and have it display to the visitor ...
5
votes
4answers
527 views
Is XSS dangerous in application without database?
I think it definitelly isn't, because XSS which isn't saved anywhere would damage ONLY attacker.
Am I right or are there any cases where XSS could hurt non-db-application? (I mean datas are not saved ...
11
votes
5answers
1k views
Solution to allow JavaScript input but prevent XSS
We have a simple Blog system that allows users to input html and JavaScript to build a blog page. I'm aware that allowing javascript open up the door to xss attacks. We do however need to allow users ...
3
votes
2answers
1k views
How to protect from new Javascript Injection technique that doesn't use eval()?
There is a new Javascript injection technique that is generating chatter on the forums mentioned here
Here is the code sample:
String.prototype.code = function(){ return (new Function('with(this) { ...
8
votes
2answers
472 views
Recent Facebook XSS exploit details
There was a recent XSS exploit on Facebook that posted a vulgar message and got users to click on a link to spread the payload. What vulnerability was exploited, and what can other sites do to avoid a ...
13
votes
4answers
749 views
Web Security Cheatsheet / ToDo list
Can anyone suggest a cheatsheet or ToDo list of web site and application security?
A local small business owner prompted a question about web security, basically her company website just got XSS ...
3
votes
3answers
289 views
Is Content Security Policy an approach that is worth to support?
Mozilla Firefox 4.0 supports something called Content Security Policy that disables the interpretation of embedded Java Script. Only external Java Script files that are referenced using a script tag ...
1
vote
2answers
315 views
AntiXSS for ASP.NET 1.1
Unfortunately, a client of mine still has an application based on ASP.NET 1.1.
Yes yes, I know - horribly insecure, support ending, and on and on... I've already been through that with them.
...
0
votes
4answers
118 views
Safely changing text links to HTML anchors
I'm trying to change text links to real anchors. So for example I want to change http://example.com to <a href="http://example.com">http://example.com</a>.
Since this is a user given ...
3
votes
3answers
786 views
Altering a $_SESSION variable in PHP via XSS?
Not sure if what I'm saying makes sense... but is it possible for me to alter a $_SESSION variable from outside the target PHP script?
One of our scripts uses a $_SESSION variable and I'm not sure if ...
0
votes
1answer
167 views
Replicating javascript actions from different website (XSS?)
I've got html / javascript code on my site like this:
<a ...
43
votes
6answers
3k views
Can anybody explain XSS to an idiot?
That idiot being me, of course.
I work programming Enterprise Java applications and do very little web development in 2002. I'm interested in security and like to read articles about it. However, I ...
