Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS), DOM-based XSS (aka client side XSS).
9
votes
4answers
328 views
IMG tag vulnerability
Is it safe to display images from arbitrary domains? I.e. let's say I have an image on my page:
<img src="http://badguy.com/image.gif" />
What if image.gif will return some js attack vector, ...
3
votes
6answers
124 views
Is cookie-based XSS exploitable?
Today I've found interesting site that output your cookie value directly to the page, so if I modify the cookie value I can XSS myself.
e.g <span id=statistics>Last visit: ...
2
votes
2answers
67 views
Is it safer to store the XSRF value inside your JavaScript?
To protect yourself against XSRF, you need to have a separate token on a page.
See: Coding Horror: Preventing CSRF and XSRF Attacks, by Jeff Atwood
As the posting suggests, its best to have those ...
10
votes
5answers
419 views
CSRF protection with Session Id
To protect against CSRF, couldn't my page javascript just dynamically insert the session id from the cookie into the body of each HTTP request right before it's sent?
The server would then just ...
-3
votes
0answers
23 views
How to use FCKeditor safely ? [duplicate]
How can I implement FCKeditor in my website keeping it secure from Cross Site Scripting. I am using ASP.NET and C#.
4
votes
2answers
126 views
Type 2 XSS vs CSRF
Trying to create a thorough understanding of XSS and CSRF, i'm clear that a type 2 xss involves an exploit that is persistent on the server.
e.g.
<SCRIPT type="text/javascript">
new ...
3
votes
2answers
103 views
XSS: Parsing Javascript
Reading about DOM based XSS from http://www.webappsec.org/projects/articles/071105.shtml
It illustrates some examples like:
...
2
votes
1answer
88 views
XSS via Unicode
Reading about XSS and its countermeasures from http://www.xssed.com/xssinfo#Avoiding_XSS_vulnerabilities , it says (in the 2nd last paragraph of the link) that:
[…] support for Unicode character ...
0
votes
1answer
153 views
Security Testing AngularJS Web Application
An angularjs application stores user input to local/sessionStorage and retrieves it later to fill the form fields or display that content later. If a javascript is submitted as user input, it gets ...
10
votes
3answers
399 views
Is stripping out < and > characters an effective way of preventing XSS?
I'm guessing that HTML encoding the input would probably be a better solution, but I'm curious if just stripping out any < and > characters would be an effective defense against XSS attacks.
...
0
votes
1answer
82 views
Dom xss posibility question?
I have this snippet of code :
<script type="text/javascript">
$.extend({
getUrlVars : function() {
var vars = [], hash;
...
3
votes
4answers
285 views
how can you inject malicious code into an innocent-looking URL?
I am learning about XSS attacks. Wikipedia says that in a non-persistent attack an attacker may provide an innocent-looking URL that "points to a trusted site but actually has an XSS vector." What ...
3
votes
1answer
80 views
What are good tools for CRLF discovery? [closed]
What are good tools for finding CRLF injection vulnerabilities?
6
votes
3answers
239 views
Is there a way to bypass Django's XSS escaping with “unicode”?
Django (the Python web framework) escapes output to prevent XSS (Cross Site Scripting) attacks. It replaces ', ", <, >, & with their HTML safe versions.
However this presentation on slide ...
1
vote
1answer
85 views
XSS MySQL Database Accessible?
I'd like to know if there is any danger of someone being able to access the database via XSS vulnerabilities on this page.
I have the following link. When you go to this link, the text I've enclosed ...
1
vote
1answer
190 views
bypass a regex filtration to perform an xss attack
Does the regex [\w/$!.*-]+$ stop the injection of payloads like :
"><script>alert(4)</script>
" onload="alert(4)"
...
-1
votes
1answer
146 views
can someone break my anti dom based xss from the window location? [closed]
can someone break my anti dom based xss from the window location ?
function parseparameters()
{
var href = window.location.href;
var id = href.indexOf('#');
if (id ...
-1
votes
1answer
101 views
some questions about DOM based XSS [closed]
Is it possible to do a DOM based xss attack with window.location.protocol?
How can we use dom based xss with document.title?
How can we bypass the escape javascript function if it is used?
thank ...
0
votes
1answer
210 views
Sanitizing JavaScript to prevent XSS
I'm going through a vulnerability remediation exercise for a client and am trying to figure out how to best mitigate this particular hole. There's a script on our site that calls up content into a new ...
2
votes
1answer
92 views
Does prepending “http://” to a user-provided string yield a safe-to-use URL?
Is it safe (in terms of XSS vulnerability) to get a parameter X from the user, escape its double-quotations and insert it as href?
Pseudo-code:
Y = escape_double_quotes(X);
print '<a ...
2
votes
1answer
112 views
Is appending a double quote at the end of an input query a valid XSS prevention method?
I was wondering if appending a double quote at the end of a query is considered a valid XSS filter. Let's say we have a search function and I entered:
"><script>alert('hi')</script>
...
3
votes
1answer
166 views
How can one recover from the Yahoo! XSS attack?
Many Yahoo!/SBC Global email accounts have been hijacked via an infamous XSS attack. The accounts are often used to send spam to random members of the user's personal address book. The spam often ...
0
votes
1answer
96 views
Automating tests for XSS in bash?
The book:"Web Security Testing Cookbook
By Paco Hope, Ben Walther" is the only source I could find which covers the topic. They use cURL. I just want to write some scripts to automate testing for ...
2
votes
1answer
69 views
How to do security configuration for ibm http server?
We are using IBM HTTP Server Version 7.0
Need help related to Cross Site Scripting Prevention in IBM http server.
Cross Site Scripting Prevention in Sun Java System Web Server 7.0 mentioned in ...
1
vote
2answers
469 views
HTML encoding to protect against XSS
While going through some references about protection against XSS i found that it is a good practice to encode data (entered by users) before using it to generate a dynamic page. I was not able to find ...
1
vote
2answers
95 views
Guarding against XSS when setting Cookies based on URI?
I have a web-site written in nginx.conf — http://mdoc.su/ — which essentially accepts two parameters, an operating system and a manual page name, and does a redirect to a different site based on the ...
1
vote
2answers
181 views
Can XSS vulnerabilities present in 3rd party js libraries be used to attack the app that uses the lib?
I am using various 3rd party libs like cordova.js, jquery, jquery mobile, mobilizer and so on, in a an android mobile app.. These libs are found to have various XSS vectors through insecure use of ...
1
vote
4answers
323 views
Simple solution to XSS
I've got an idea as to how to defeat XSS so simple that it may work and was wondering if anybody had already done something similar.
The goal here is not efficiency but security. In other words I ...
3
votes
1answer
1k views
DOM Based XSS attacks: what is the most dangerous example?
I knew that XSS attacks (“non-persistent” and “persistent”) can hijack user session, deface websites, conduct phishing attack, etc.
However, I can't understand what is dangerous of DOM Based XSS if ...
2
votes
1answer
112 views
Newline XSS vulnerability
So I was experimenting with XSS using new line (%0A) character.
So I got to the usual vector: '%0Aalert(/xss/)//
and one thing came to my mind. What if you can't insert a quote?
A new line will break ...
3
votes
1answer
211 views
Is it possible to exploit XSS inside User-Agent header? [duplicate]
I've found an xss bug inside user-agent header on one popular buy/sell site , and after reporting it to them , they answered that it is not dangerous as it can not be exploited without user ...
3
votes
1answer
179 views
CodeIgniter CSRF confusion
I have been working with CodeIgniter for about 3 weeks and am very well on the way to loving this framework. However I have been looking at the core code of the framework and I was reading over the ...
6
votes
3answers
203 views
How and where can I best announce an XSS vulnerability in a relatively well-known website?
I'd like advice on how and where to announce an XSS vulnerability (persistent XSS to be exact). My greatest fear is the announcement getting snowed under, thus rendering the disclosure ineffective in ...
2
votes
2answers
154 views
HTTPOnly Cookies: Security Depends on Client Cooperation?
I've been implementing HTTPOnly cookie-based session handling and have some questions about what HTTPOnly means.
I realise it's a flag that gets passed around in the HTTP header when setting cookies. ...
2
votes
2answers
255 views
Minimum size of input text box required for XSS attacks
I have below code to accept User login ID as input from User.
<input name="userName" type="text" id="userID" maxlength="8"/></td>
Maximum number of characters that a end user can input ...
2
votes
2answers
309 views
Is XSS possible here? Challenge
Is possible to bypass my regex and execute any javascript?
<script>
function json(a){
if (/^\s*$/.test(a) ? 0 : /^[\],:{}\s\u2028\u2029]*$/.test(a.replace(/\\["\\\/bfnrtu]/g, ...
3
votes
1answer
204 views
Do javascript: URLs starting with // allow XSS?
I found a markup processor that allows users to include arbitrary links, as long as they contain a "netloc" (// after the first :). Due to the myriad of exploitable protocol handlers, this is ...
1
vote
0answers
32 views
How can I explain Cross Site Scripting in a non-technical way? [duplicate]
Possible Duplicate:
Can anybody explain XSS to an idiot?
I can reasonably explain Cross Site Scripting (XSS) in technical terms to other technically minded people or people familiar with ...
1
vote
2answers
278 views
What vulnerabilities in the OWASP Top 10 are relevant to WordPress?
I have been looking at the OWASP Top 10, and am wondering which of the top 10 security risks are relevant to a WordPress installation with various plugins installed?
I know injections and XSS are ...
4
votes
3answers
274 views
XSS risk for an application which can be accessed from localhost only
I have an web app which can used via an browser. The web app can be accessed on localhost only. No remote access is possible. A security tool discovered an XSS issue. Now if this web app is works only ...
1
vote
2answers
152 views
Breaking out of attribute in double quotes
I have a piece of code that allows for
[url]someurl[/url]
BB-Code and replaces it with
<a href="someurl">someurl</a>
It takes two precautions to prevent XSS.
It replaces ...
12
votes
1answer
520 views
Is Django's built-in security enough?
I have learned that Django provides built-in protection against the three main types of web app attacks (SQL injection, XSS and CSRF), which is really awesome.
Yet I have spoken to a few Django ...
2
votes
1answer
213 views
Email Compromised due to Yahoo Mail Exploit
On Monday due to XSS vulnerability present in the Yahoo mail my email has been compromised. I have immediately changed my password but i am not sure is this enough i.e. do i need to delete my cookies ...
5
votes
1answer
176 views
Question about XSS example
A friend of mine received an email from someone (a reputable sender), and I noticed that the following was tagged onto the end of the subject:
...
1
vote
1answer
132 views
Closing an HTML tag without using the actual character
I'm currently learning how to perform XSS on websites, but there is a constant problem that keeps recurring that I'm sure must be easy to bypass.
Quite often, the website will filter out quotation ...
11
votes
3answers
292 views
What does a HTML filter need to do, to protect against SVG attacks?
I recently learned that SVG (Scalable Vector Graphics) images introduce a number of opportunities for subtle attacks on the web. (See paper below.) While SVG images may look like an image, the file ...
0
votes
3answers
294 views
How can this xss challenge be solved? [closed]
I found this :
http://research.insecurelabs.org/xssmas/
And so far my solutions were:
1.http://research.insecurelabs.org/xssmas/search.php?query=<script>alert(0)</script>
2. ...
1
vote
2answers
554 views
What does scorecardsresearch.com/beacon.js - added by Disqus.com - do?
I recently added Disqus to my site. Looking at the "scripts" tab on Firebug, I noticed a script called, http://scorecardresearch.com/beacon.js (here is a prettified version - the script is not ...
3
votes
1answer
169 views
How did the Tumblr worm spread?
Recently Tumblr was hit by a fast-spreading worm.
How did the worm work? What was the vulnerability in Tumblr that it exploired? Did it exploit a XSS vulnerability in Tumblr? A CSRF vulnerability ...
1
vote
1answer
128 views
Need an explanation of Cross-Site Flashing?
I found this : http://demo.testfire.net/vulnerable.swf
Can anyone provide me examples of how these issues are exploited.
Thanks
