Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS), DOM-based XSS (aka client side XSS).

learn more… | top users | synonyms

2
votes
1answer
25 views

REST API - XSS prevention - When and how?

I am currently developing a REST API with Java EE and MySQL, it will feed Data to a Android App. The Data comes from an AngularJS Frontend. So my questions are, when: When do I escape the data? Before ...
1
vote
0answers
55 views

What makes an Android application vulnerable to Cross-site scripting (XSS)?

Definition of XSS If you search the web, there are many different ways to define a cross site scripting attack. Simply put, XSS vulnerabilities occur when a malicious attacker is permitted to inject ...
2
votes
1answer
51 views

Preventing reflected XSS in URL [duplicate]

We have just had some pen testing completed against a web application and the one area identified as High Impact and Medium Probability was: Cross-Site scripting (reflected) The example given was ...
1
vote
1answer
76 views

Concerns discussing 'illegal' activities in a job interview [on hold]

Before I begin, I say 'illegal' because I guess the law is somewhat sketchy around the topic and that topic is XSS research. Apparently people have been taken to court over it and UK law does have a ...
0
votes
0answers
15 views

ASP.NET MVC XSS Validation [migrated]

We are using ASP.NET MVC 5.0 to build a website. If I enter into a textbox some javascript when I save I get a "potentially unsafe input detected" error page - great. However a couple of our screens ...
0
votes
2answers
65 views

Security issues on allowing Special characters in input field

I am building a web application, in which I am required to let user enter any character(even special characters - ~!@#$%^&*()_-+=|\{}[];:'"<,.>) in an input field. To mitigate the problems ...
2
votes
0answers
43 views

Exploitation of Reflected XSS on Android App

I am trying to do a security evaluation of an android application. I came across a situation where one of the activities of the app displays certain form fields in a webview. This form is very ...
-4
votes
1answer
40 views

Could blocking script in the url prevent DOM XSS? [closed]

On my site, if I were to block <script> from the url, could this prevent some cases of XSS? Any way someone could bypass that?
5
votes
1answer
105 views

How do I securely embed an <img> tag using a user-given URL?

If I hypothetically wanted to allow users to use an avatar from an arbitrary URL like this: <img class="avatar" src="{user input}" /> There are many problems that I can think about: There ...
3
votes
2answers
53 views

Why do ID attributes need stricter validation?

According to OWASP XSS Prevention Cheat Sheet, one should Strictly validate unsafe attributes such as background, id and name I understand that background could contain data: urls, and can ...
1
vote
1answer
33 views

Safe to render data directly to DOM from localStorage? XSS attack possible?

I read that localstorage is susceptible to XSS attacks. I currently store JSON Web Token (JWT) in localstorage, and I access and display data about the user through localstorage: var localstore = ...
1
vote
1answer
177 views

How to exploit CRLF Injection?

I was running a few tests on a website when I came across this: Request: GET /accounts?intended_destination=internal_api%2Fcampaigns_dashboard%7Cshow&intended_params=format%3Dhtml HTTP/1.1 ...
6
votes
3answers
435 views

Favicon Redirection Possible Security Flaw

I have the domain example.com When I enter the URL https://api.example.com, Chrome loads the page and also tries to load https://myapp.example.com/favicon.ico, and that request receives a 301 ...
0
votes
0answers
40 views

Problem in 'underscore.js' “new Function()” when CSP header is set.

In underscore.js, template rendering causes violation of the 'unsafe-eval' property, with CSP error at following line: "render = new Function(settings.variable || 'obj', '_', source);" The solution ...
0
votes
1answer
66 views

XSS with a torrent [closed]

Is it possible to XSS using a BitTorrent tracker. I have been hearing that you can use a torrent to perform XSS. Is it possible ? If so whats the general idea ?
3
votes
1answer
82 views

Bypassing XSS filter

<script> Something.execute("injectionpoint"); }, true); </script> I am trying to bypass an XSS filter but its not working since since " is filtered as \" or ;\" depending on where " is ...
0
votes
1answer
51 views

In Login page of web application, I have allowed drag and drop of any text. Is it vulnerable to XSS attack? [closed]

Will I need to add any attribute to restrict drag and drop of any file?
1
vote
1answer
61 views

XSS inside a javascript

Can an XSS be craft inside the following JS. $(function () { $("#panel").find(".form").each(function (index) { var that = this; $(that).overload(); ...
3
votes
3answers
93 views

Is CSP enough to prevent XSS attacks [duplicate]

Assuming that users are using modern browsers, is implementing a strict CSP policy enough to prevent all XSS attacks? I'm working on a Backbone app, and am wondering if I still need to be escape user ...
2
votes
1answer
76 views

What are some useful tags and payloads for HTML injection on CSP-protected sites?

I'm pen-testing a website that fixed most of its XSS vulnerabilities by just adding a Content Security Policy. There are still HTML injections in several places. I've tried to get a ...
-1
votes
1answer
76 views

How can you use XSS to break this security on a site? [closed]

To delete your account on a website, the following form is used: <form action="/deleteaccount" method="post"> <input type="hidden" name="user" ...
1
vote
1answer
52 views

Mandatory to implement HTTPOnly if Java Secure Cookies are set to 'true'?

Here is a test case from a recent application security asessment which I have had experienced: cookie = new Cookie(strKey1, EncryptDecrypt.encrypt(strValue)); cookie.setMaxAge(-1); ...
2
votes
1answer
265 views

Cannot turn off XSS filter in Chrome

I am using the following command to launch Chrome: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --args --disable-web-security to turn off XSS auditor in chrome in Windows 7, but ...
2
votes
2answers
61 views

Classifying Reflected and DOM-based XSS

Having referenced Difference between DOM & Reflected XSS , I observed that certain attacks could be both DOM-based and Reflected XSS. I wish to find out if my understand is accurate, or they ...
1
vote
2answers
358 views

XSS when some keywords are prevented on the server side

When I scan website with burp suite pro, I encountered a XSS. This XSS is <a b=c> When Burp suite test other payloads that contain keywords like script, alert, onerror, this parameters ...
1
vote
2answers
110 views

XSS via REQUEST_URI

Is there any situation where an XSS attack can be performed via the PHP $_SERVER['REQUEST_URI'] variable? For those unfamiliar with it: It contains the complete URL used to access that website, ...
5
votes
2answers
973 views

Does base64 encoding an image and storing it in a database introduce risk for XSS

Ok, here is a scenario for you here. You have a database. You have a table in it that you will store small 30x30 pixel PNG images. They are base64 encoded. They will be echoed out as an avatar for ...
3
votes
3answers
83 views

Temporary XSS Vulnerability

I found xss on a textarea field. When you enter a character to this field it output the character on realtime so when i input the following code: <input onclick=alert(document.cookie)> there ...
3
votes
1answer
141 views

How can I successfully perform an xss attack on a dummy website? [closed]

in my security course, we were told to practice an xss attack using firefox on this website; http://permalink.co/ No worries, this is a website specifically setup for us to practice ...
2
votes
0answers
15 views

How to Allow users to save html in Rails application without affecting security [duplicate]

After doing a lot of research I come to this forum hopefully i can get some help. I am building a Ruby on Rails application (version 4.2) My app allow users to create "one page" portfolio : user 1 ...
6
votes
2answers
175 views

How to safely display html emails like gmail does it?

I'm building a webmail, which must be able to display html emails. But how to prevent xss and similiar attacks, while not loosing html formatting? In gmail, when I receive some emails from, lets say, ...
5
votes
2answers
111 views

How to break out of URL context

The OWASP XSS Prevention Worksheet recommends "URL escape before inserting untrusted data into HTML URL parameter values". I don't understand how someone could break out of a URL context or inject a ...
0
votes
2answers
43 views

Is there standard guideline on how the sanitized input should appear in the error message?

Let us say your web app is sanitizing bad input and displaying the user what the bad input was. Before XSS measure was put in place web app is spitting out malicious script as is. For example Bad ...
3
votes
1answer
59 views

Limiting latter dom-based XSS when setting document.title

Given some JavaScript which modifies the page's title by taking in variable data document.title = someVariable I am looking to address dom based XSS while keeping the title fairly readable. ...
2
votes
2answers
159 views

Stealing document.cookie from Google domain, is this a privacy breach?

When I am logged into the Google and prints document.cookie I could see following cookies. My doubt is what all an attacker can do if attacker could steal these cookies of the victim using exploiting ...
9
votes
2answers
735 views

Cross site scripting when the greater than and less than signs are escaped?

If a website encodes < to &lt; and > becomes &gt;, is it still possible to perform cross site scripting? What would you enclose the script tags in? For example, on one of my sites I can ...
-1
votes
1answer
40 views

Shortened links and social media [closed]

I've been into IT-sec for a few years now and I have recently gotten in to the whole reddit/r/netsec, twitter, security.stackexchange thing, to get more involved with the community. What surprises me ...
1
vote
2answers
299 views

Should CSRF token without session cookie work?

Let's say that website example.com has CSRF protection. They send CSRF token in custom header and in hidden input fields. For example to add new folder, your http request need to contain CSRF token. ...
-1
votes
1answer
186 views

Hack to change the webpage of a website? [closed]

Recently, there is a website by Malaysia Airline got hacked and their main page has been defaced, below is a link to that article ...
1
vote
2answers
114 views

XSS outside of the DOM

I have the following JS (using jQuery for brevity's sake but it isn't necessary for the question): $("<i></i>").html(userInput); Is it possible for someone to input some string, ...
0
votes
1answer
47 views

From a security perspective, why not a screenshot api for browser? [closed]

I mean a javascript api for capturing a renderered html page, or current viewport, and dump content onto an image. While there are obvious attacks, such as taking screenshot of sensitive information, ...
2
votes
2answers
98 views

How does xss work with web applications that take payload not through url

Most of the examples of XSS, I have seen examples of websites that get its parameter tampered through url query parameter. For example: ...
9
votes
2answers
2k views

How do the Stack Exchange sites protect themselves from XSS? [duplicate]

It seems to me that because Users can post questions and comments in them with HTML markup (possibly <script> tags), Stack Exchange sites would be very exposed to XSS attacks. How do they ...
0
votes
0answers
61 views

XSS encode / decode strange char interpretation

Can anyone tell me why i cant get this XSS to reflect ? or why is this Filtered or not rendering ? The Post sent is : ... Content-Length: 91 add=1&reference=A</><img src=a ...
0
votes
1answer
71 views

XSS in options tag without forward slash

I am trying work on an XSS scenario. Would appreciate if anyone can help. URL: www.example.com/mydata "mydata" is landing in html as follows: 200 OK ... Content-Type: text/html; charset=utf-8 ... ...
4
votes
2answers
241 views

How to bypass .Net 4.5 request validation, for an XSS attack?

.Net has a feature called request validation which detects malicious inputs and blocks the request. By its nature, request validation is not a precise science. OWASP clearly recommend to only rely on ...
2
votes
1answer
54 views

Sanitise specific HTML attribute values against XSS

We want to implement a "safe mode" in a Markdown parser called Parsedown. We have a MarkupEscaped option that disables HTML input, but this is not enough. In order to be safe, the parser needs to ...
2
votes
4answers
104 views

Allowing users to upload & download XML safely

We have a requirement to allow users to upload an XML document into our system. We don't process it, we just allow them to download it again. Given various browser XSS vulnerabilities such as this: ...
1
vote
4answers
200 views

Vulnerable XSS Test [closed]

I have to do a presentation about XSS. I want to give a demo but I can't find test platforms. I found http://zero.webappsecurity.com/index.html but this site always shows a FireHost-block when I try ...
1
vote
0answers
27 views

Can't mail stolen session ID [closed]

I'm working on this platform: http://testfire.net/ With this script I can see the cookie: "><script>alert(document.cookie)</script> So now I'm trying to mail this cookie to me. ...