Tagged Questions

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS), DOM-based XSS (aka client side XSS).

learn more… | top users | synonyms

-4
votes
2answers
33 views

What is the best exploit of XSS within 100 characters? [on hold]

I found a vulnerable php script on my website. The script allows an user input (textarea), which is not encoded by htmlspecialchars(). Therefore it is possible to add html and javascript code. The ...
3
votes
1answer
119 views

XSS: terminology [on hold]

Where does the name XSS come from? Why "cross-site"? Also, the book "The Web Application Hacker's Handbook" says that the name XSS is a misnomer when talking about "stored XSS" or second-order XSS ...
-2
votes
0answers
32 views

How is there an XSS possible here? [on hold]

How is there an XSS possible with the following code and would it still be possible without an iframe? ...
-4
votes
0answers
48 views

XSS scripting for Search textbox [on hold]

I have a textbox which is used for searching the data within the site. What my client wants that, 1)Enter any text in the search field and click the search symbol. 2)The request going to the server ...
5
votes
2answers
749 views

Should every output element be filtered, or just those which contain user-editable data? [duplicate]

I'm combing through a legacy app updating SQL to prevent Injections and XSS vulnerabilities. I know to apply PHP's htmlspecialchars() anything that is directly passed to a script and displayed on a ...
-1
votes
0answers
69 views

Is this XSS filter i.e <[space][0-9a-z]/> can be bypassed?

I was testing a web application that had an stored XSS vulnerability. After reporting the project team, they came up with a filter <[space][a-z1-9]/> (for example will be converted into < img ...
2
votes
1answer
141 views

Is preventing XSS/HTML Injection really this simple?

A colleague suggested to me just to prevent letter characters from occurring immediately after an opening angle bracket as a way to protect against XSS and HTML injection. Obviously, this doesn't ...
1
vote
4answers
68 views

Would this be considered an XSS or an RFI or nothing?

I'm a beginner network security student and as practice my dad let me look over his personal business online store website. I found a script called image.asp which when fed a file parameter returns a ...
0
votes
0answers
26 views

XSSER get and post

I am using xsser for XSS vulnerability testing and I have a doubt about the parameters when it's a POST method. I have tried against DVWA (which uses get) with success like this: xsser -u ...
0
votes
1answer
96 views

How to execute an XSS attack against a site that uses client side protection?

Say I have a site that allows me to save my name to the database, and that name is then displayed to other users. I have determined that if I save the following as my name: Abe ...
2
votes
3answers
81 views

Stored Cross-Site Scripting Without Parentheses or Spaces

I'm testing a commenting application that takes a link of the form http://google.com and puts it in an href tag as so: <a rel="nofollow" href="http://google.com"> The resulting comment is ...
0
votes
1answer
104 views

XSS - Bypass this RegExp

How could this anti-xss regexp be bypassed: /<(?:\w+)\W+?[\w]/ I am working on it but I can't find a way. Just to be sure that I have understood it correctly, this regexp search for a pattern ...
0
votes
1answer
45 views

extracting JSESSIONID from document.cookie

I was trying cookie stealing on a java and spring based web application. Normally, a cookie can be obtained through <script>alert(document.cookie)</script>, but in the above code, cookie ...
4
votes
3answers
95 views

Reflected XSS through cookie value?

I have always looked at reflected XSS as an attack that would take place through a URL. So, for example, you would have a URL like below: ...
1
vote
2answers
69 views

Is XSS a vulnerability or an attack?

Why so many people use different defenitions(attack or vulneraibility) for XSS? I think that XSS is attack, that exploits insufficient filtering vulnerability. Am I right? The answer for this ...
0
votes
2answers
117 views

How did an attacker spoof (or add to) this myspace's login form?

In the attack detailed here, I see that a hacker has actually added a malicious post link. What I do not understand is how the attacker added it to the actual myspace.comdomain. Obviously this is an ...
1
vote
1answer
67 views

Is XSS prevention only on the frontend enough for JSON services? [duplicate]

We have an application with a form where user can enter a comment. The form is submitted using AJAX. Values are read also through AJAX and returned by the backend as JSON, and then parsed by ...
0
votes
1answer
97 views

How is Cross Site Flashing performed?

I read about cross site flashing in the OWASP testing guide. I know the difference between XSS and XSF. But what I am looking for is how attackers perform a XSF attack. How is it possible since there ...
0
votes
1answer
56 views

Pivoting through XSS

I'll start off by saying this is a purely academic question; I'm trying to fill some gaps in my knowledge. If a website is vulnerable to XSS, and the target host is another machine that can browse to ...
3
votes
2answers
100 views

Principal DOM Based XSS detect using python

I am working for a project make a XSS scan tool using python. I have a sample url: http://www.foo.bar/index.php?ids=111 I've found that it has a vulnerability by ...
8
votes
4answers
563 views

Session Hijacked in case javascript blocked [closed]

If I blocked Javascript to be executed. Then what are the ways by which XSS can occur and what are possible threats in case of intranet application.
-1
votes
1answer
46 views

Why injecting a php tag with XSS dosn't work? [closed]

So you all know about the XSS vulnerability but what I cannot understand is how come injecting a <?php ?> tag doesn't work? eg.: suppose there is a Stored XSS vulnerability in the index.php of a ...
-2
votes
1answer
53 views

Escape from <script> to cause a XSS (XSS when reflection is already under <script>) [duplicate]

I am trying my level best to solve this issue i am totally not able to create a XSS i still thinks it to be a vulnerability and i think it is exploitable. I am frustrated around it for 8 days . Please ...
0
votes
1answer
42 views

What is the difference between XSS and Cross Site Flashing? [duplicate]

I want to know the basic differences between XSS and XSF
-2
votes
1answer
66 views

What is DOM based XSS? And How to prevent it? [duplicate]

I know very well about the classic XSS vulnerabilities such as reflected & stored XSS. I have read a lot about DOM and DOM based XSS vulnerabilities. I came to an inference that there is nothing ...
-1
votes
2answers
92 views

XSS InJavaScript

Recently i was figuring out a web application and found that the url is reflected among the source of the page which make it bit obvious for xss but the input from url which is reflected on source is ...
0
votes
1answer
103 views

Reflected XSS script passing through URL how to make it work and what are the preconditions for it to work?

Trying to learn about security I set up the most simple website on my localhost consisting of one html page that a apache server serves. I first started trying and appending the JS script that would ...
1
vote
2answers
345 views

How do hackers deploy keyloggers?

I know the use of keyloggers. What I wish to know is how a hacker can install the keylogger onto the victim's system? If it can be done by XSS then to where this keylogger is actually installed (I ...
0
votes
2answers
53 views

Possible security issues with on demand generated image from database

I want to know what could be the potential risk with the displaying part of this behavior. For the upload part : 1- A form with a file upload for image. 2- Image content is save into Mysql ...
1
vote
2answers
128 views

Why doesn't this XSS attack work?

I have a site that has the following javascript that is being executed: var t=location.hash.slice(1); $("div[id="+t+"]").text("The DOM is now loaded and can be manipulated."); I was thinking that ...
2
votes
1answer
86 views

XSS: alert() not executed on different OS/computer

I've encountered a strange behavior while I was performing a security audit of a web application. Some user controlled inputs were displaying their values, unencoded, into the page that processed the ...
0
votes
1answer
60 views

Is addslashes + htmlentities sufficiently secure?

I have addslashes(htmlentities($userInput)). It gets inserted into my database. (NOT a mysql db) Is it sufficiently safe from xss? Thank you!
2
votes
1answer
53 views

Understanding cross origing requests from a web page

Reading up the XSS attacks on wiki I see that it says an injected script could send data/cookies to the attackers site. How is this achieved? Are there no checks/restrictions on cross origin requests ...
0
votes
0answers
35 views

Possible cross site scripting vulnerability caused by url_with_protocol

I used pullreview to review my project. It came back with a security concern ( Possible cross site scripting vulnerability) on this line: link_to portfolio.website, ...
-1
votes
1answer
92 views

“<” and “>” is filtered, is there any way bypass it? [closed]

I found that the characters; < and > are filtered (shown as: &lt; and &gt;), when I pen test for a website. Is there any methods to bypass < and >?
5
votes
1answer
107 views

What are the risks of accepting URL param for automatic redirection?

Can anybody name all the risks of the following scenario: User visits a page, but his session is expired, so he is auto-redirected to login page with his previous page and params added as a single ...
2
votes
1answer
65 views

encodeURIComponent in a unquoted HTML attribute

My gut feeling is that the following should be attackable: $("<td><a href=somefile.php?url="+encodeURIComponent(somevar)+">Download Here</a></td>"); In contrast to ...
7
votes
2answers
645 views

Does CSRF prevention also prevent reflected XSS attack?

What I understand about reflected XSS is ... When a web application is vulnerable to this type of attack, it will pass unvalidated input sent through requests back to the client... [1] ...
4
votes
1answer
154 views

How can document.referrer be used for XSS?

A very simple example... <div id="cat"></div> <script> document.getElementById("cat").innerHTML = document.referrer; </script> or <script src="' + document.referrer + ...
-2
votes
1answer
101 views

Interesting security demos for beginners [closed]

I am thinking about a creating short security demo to get people interested in the security topic. I've had a couple of ideas just want to see if anyone has anything else interesting. Edit: I was ...
0
votes
0answers
40 views

securing my API: concept of accesstokens

first of all I want to excuse for the bad spelling and grammar. English is not my mothertongue. I have built a JSON communication between frontend(website) and my NodeJS webserver. I want to keep in ...
0
votes
1answer
100 views

Testing XSS - how to validate manually?

I have Burp and Appscan telling me that Reflected XSS is possible due to a particular variable on a particular page. The following example is given of what Appscan injected ...
5
votes
4answers
672 views

What is a good browser for web application pen testing? [closed]

I am getting started in testing web applications, and I am having trouble verifying vulnerabilities. It seems all modern browsers have protections against things like XSS. When something like Burp ...
1
vote
1answer
99 views

Basic Website Protection (XSS,SQL-inject,hashing)

I have a very simple app that does allow unauthenticated users to leave comments (maybe later I will incorporate a capatcha). The app then stores the comments in a mysql db. I do my best to filter out ...
0
votes
1answer
101 views

Is PHP FILTER_VALIDATE_IP secure enough to $_GET an IP address?

I need to pass an IP to a PHP page, and it would be convenient to be able to use GET, but I know that's sort of asking for trouble, so I want to triple-check that I'm handling it securely. ...
0
votes
1answer
96 views

XSS echoed in pages html code but no pop up window

So i have a https login page with standard username and password inputs. I put in simple xss test such as, alert(‘XSS attack’) the page displays a "credentials you have supplied are incorrect" ...
1
vote
1answer
92 views

Can location.pathname lead to XSS?

<div id="cat"></div> <script> $("#cat").html(location.pathname); </script> I think that example would work, but anyway, if location.pathname has to be a valid page, can this ...
1
vote
3answers
303 views

How can I bypass double quotes in a attribute based xss attack

The code that I have is: <input type="text" name="some_name" value="<?php echo CHtml::encode($str); ?>" /> $str is the input data. 'CHtml::encode()' is Yii's way of encoding special ...
2
votes
3answers
84 views

Flash cookie and man-in-the-middle

I am using the Scala Play web framework. In it, there is a PLAY_FLASH cookie used to flash messages to the user (it's a cookie so it will still work after several redirects). I put HTML in the cookie ...
-1
votes
1answer
52 views

<,>,/ etc symbols are getting escaped while trying for xss,anyother alternatives for these symbols to carry out the attack successfully?

Symbols like >, <, / etc are getting escaped any alternative to carry out the xss attack ? most of the websites are having xss filters