Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS), DOM-based XSS (aka client side XSS).

learn more… | top users | synonyms

4
votes
4answers
78 views

Famous XSS attacks over JavaScript [on hold]

I'm about to graduate in "Computer Science", and I'm writing thesis about the Javascript vulnerabilities. In particular, I'm analyzing the JS vulnerabilities that allow XSS attacks. I would like to ...
-4
votes
0answers
42 views

XSS filter evasion when “less than” followed by an English character is filtered [on hold]

In a recent penetration test, I encountered an XSS filter that allows <,> to pass without encoding, but blocks <a, for example. The filter allows < <_ <, <ש, but DOESN'T allow ...
2
votes
1answer
56 views

XSS in Content-Disposition

Lets assume i have found a xss on site example.com, now to trigger an XSS, i use the following URL: https://example.com/a.php?v=%22%3E%3Cimg%20src=x Which results in following response: HTTP/1.1 ...
2
votes
1answer
34 views

Content-Security-Policy data: scheme

I have a Cordova app that transforms some images to base64. This violates CSP with this message: Refused to load the image ...
-4
votes
1answer
39 views

Some good resources to learn about Javascript DoM based Cross site scripting? [on hold]

I'm learning Web Application Security, Please post some good resources to learn about DOM based XSS (Basics to advaned) Thanks... -Dave
2
votes
1answer
48 views

Tools for finding stored XSS vulnerabilities, given DB write access?

I'm aware that there are various tools for testing for XSS vulnerabilities. However, all the ones that I'm aware of (Vega, possibly BeEF, etc.) operate purely client-side. When testing for stored XSS ...
1
vote
1answer
41 views

What kind of attacks do Javascript WebWorkers protect against?

What kind of attack are prevented by running code submitted by the user in a Javascript Web Worker? Do they prevent attacks like XSS, or is it better to use some other sandboxing method to protect ...
-4
votes
0answers
25 views

Would it be possible to create a web crawler to perform XSS and SQL injection? [closed]

I feel like this would be the worst malware to come across, taking out small websites and maybe a few large sites as well. How do people protect against it?
0
votes
3answers
105 views

What are the different payloads used for XSS vulnerability? [closed]

I am new to information security field. I am searching for XSS vulnerabilities. In XSS mostly they use <script>alert('XSS')</script> payload for attacking a websites. In the case of ...
1
vote
1answer
215 views

XSS payload to capture login credentials

I am trying to solve this exercise http://pentesteracademylab.appspot.com/lab/webapp/jfp/3. The objective of this is to "Post the Username and Password to Attacker Controlled Server". There is a url ...
3
votes
0answers
62 views

XSS only works when GET request is submitted with form [duplicate]

I'm trying to create a POC for responsible disclosure, but I'm having an issue... When I use a textbox to submit my payload, it brings me to another page where the javascript executes and is present ...
1
vote
1answer
92 views

Any standard tests to prevent hacking? [closed]

I am very new in programming world so my question may sound weird. I am useing selenium to test an application, yesterday one of my colleagues found this issue that if someone enters this: <script ...
2
votes
4answers
81 views

Is it possible to exploit unescaped user input into JavaScript form which only gets data via AJAX request?

A logged in user can get to a page https://example.com/some/page which has an input field and some buttons. When user enters something into this field and clicks away on anything, the page makes ...
-1
votes
0answers
34 views

how to fix XSS Reflected in java [migrated]

I got fortify report which shows XSS Reflected defect from the below 2nd line. String name = request.getParameter("name"); response.getWriter().write("Name: " + name); Recommendation ...
2
votes
0answers
36 views

Is it safe to store bearer tokens in an iframe and/or pass them back to the parent window

I am not a security expert, so I am hoping that a few of you might be able to tell me if there are any gaping flaws in the security design for my web app. Hopefully I'll be able to explain this ...
0
votes
1answer
14 views

Security risks for a simple network configuration screen in android [closed]

I am building an Android App that pulls chart information from a server where the connection is specified on this view Ideally, the end user will put in a valid host and port resulting in business ...
3
votes
1answer
60 views

Possible issues when one or more cookie not HttpOnly

I have a question related to HttpOnly cookie. Tracking other threads wasn't of much help, hence I am posting my query here to learn if you can foresee any issues with my understanding. There is a ...
1
vote
1answer
47 views

Dom based Xss Query - location.hash

I was just looking at Dom based xss and wondering if hash value is written to a variable in javascript context can lead to Cross site scripting. The code looks something like this: <script> var ...
2
votes
6answers
120 views

Close XSS vulnerability

I run a vulnerability scanner on my website which showed me a couple of vulnerabilities which look like this: ...
5
votes
4answers
334 views

XSS using JSF**k

I was reading about JSf**k. From their website: JSF**k is an esoteric and educational programming style based on the atomic parts of JavaScript. It uses only six different characters to write and ...
1
vote
2answers
33 views

Security implications of providing users subdomains on my domain?

I want to provide users with sub domains on my website. Users will provide an ip address and the sub domain they want and I will then use a DNS service to redirect to that IP through an A record or ...
2
votes
2answers
369 views

What do I do if I find XSS on my website?

I found reflected XSS on my website. And its fixed now. There are a lot of websites which tell how a XSS can be detected or what can be compromised but I could not find what measures should be taken ...
4
votes
1answer
44 views

Practical implications of 2014's android SOP vulnerability

For a project at university I have done research about all kinds of security issues, especially privacy-related ones, that have come up on mobile OS and applications over the last few years. One of ...
3
votes
2answers
124 views

Are phone apps vulnerable to XSS or CSRF? (Webview, Phonegap, chrometab)

I need to provide evidence that CSRF or XSS is possible on a phone... using PhoneGap, a Webview, or specifically a "Chrome Tab" or iOS equivalent. I believe in theory this is possible, and mitigation ...
3
votes
3answers
93 views

Any Security Risks for using mailto:?

I use a PHP script which performs a database search and when no result are found, user is presented with a mailto link with this format mailto:example@test.com?subject=SEARCHED_QUERY_HERE The ...
1
vote
1answer
69 views

Is this reflected or DOM-based XSS?

Scenario: Server-side script takes URL parameter parameter1 and writes it without encoding into cookie cookie1. Then regular HTML page containing client-side script is returned. Client-side script, ...
2
votes
1answer
59 views

REST API - XSS prevention - When and how?

I am currently developing a REST API with Java EE and MySQL, it will feed Data to a Android App. The Data comes from an AngularJS Frontend. So my questions are, when: When do I escape the data? Before ...
-1
votes
1answer
198 views

What makes an Android application vulnerable to Cross-site scripting (XSS)?

Definition of XSS If you search the web, there are many different ways to define a cross site scripting attack. Simply put, XSS vulnerabilities occur when a malicious attacker is permitted to inject ...
2
votes
1answer
90 views

Preventing reflected XSS in URL [duplicate]

We have just had some pen testing completed against a web application and the one area identified as High Impact and Medium Probability was: Cross-Site scripting (reflected) The example given was ...
1
vote
1answer
95 views

Concerns discussing 'illegal' activities in a job interview [closed]

Before I begin, I say 'illegal' because I guess the law is somewhat sketchy around the topic and that topic is XSS research. Apparently people have been taken to court over it and UK law does have a ...
1
vote
2answers
167 views

Security issues on allowing Special characters in input field

I am building a web application, in which I am required to let user enter any character(even special characters - ~!@#$%^&*()_-+=|\{}[];:'"<,.>) in an input field. To mitigate the problems ...
2
votes
0answers
94 views

Exploitation of Reflected XSS on Android App

I am trying to do a security evaluation of an android application. I came across a situation where one of the activities of the app displays certain form fields in a webview. This form is very ...
-4
votes
1answer
55 views

Could blocking script in the url prevent DOM XSS? [closed]

On my site, if I were to block <script> from the url, could this prevent some cases of XSS? Any way someone could bypass that?
5
votes
1answer
148 views

How do I securely embed an <img> tag using a user-given URL?

If I hypothetically wanted to allow users to use an avatar from an arbitrary URL like this: <img class="avatar" src="{user input}" /> There are many problems that I can think about: There ...
3
votes
2answers
63 views

Why do ID attributes need stricter validation?

According to OWASP XSS Prevention Cheat Sheet, one should Strictly validate unsafe attributes such as background, id and name I understand that background could contain data: urls, and can ...
1
vote
1answer
97 views

Safe to render data directly to DOM from localStorage? XSS attack possible?

I read that localstorage is susceptible to XSS attacks. I currently store JSON Web Token (JWT) in localstorage, and I access and display data about the user through localstorage: var localstore = ...
1
vote
1answer
384 views

How to exploit CRLF Injection?

I was running a few tests on a website when I came across this: Request: GET /accounts?intended_destination=internal_api%2Fcampaigns_dashboard%7Cshow&intended_params=format%3Dhtml HTTP/1.1 ...
6
votes
3answers
460 views

Favicon Redirection Possible Security Flaw

I have the domain example.com When I enter the URL https://api.example.com, Chrome loads the page and also tries to load https://myapp.example.com/favicon.ico, and that request receives a 301 ...
0
votes
0answers
67 views

Problem in 'underscore.js' “new Function()” when CSP header is set.

In underscore.js, template rendering causes violation of the 'unsafe-eval' property, with CSP error at following line: "render = new Function(settings.variable || 'obj', '_', source);" The solution ...
0
votes
1answer
72 views

XSS with a torrent [closed]

Is it possible to XSS using a BitTorrent tracker. I have been hearing that you can use a torrent to perform XSS. Is it possible ? If so whats the general idea ?
3
votes
1answer
132 views

Bypassing XSS filter

<script> Something.execute("injectionpoint"); }, true); </script> I am trying to bypass an XSS filter but its not working since since " is filtered as \" or ;\" depending on where " is ...
0
votes
1answer
72 views

In Login page of web application, I have allowed drag and drop of any text. Is it vulnerable to XSS attack? [closed]

Will I need to add any attribute to restrict drag and drop of any file?
1
vote
1answer
72 views

XSS inside a javascript

Can an XSS be craft inside the following JS. $(function () { $("#panel").find(".form").each(function (index) { var that = this; $(that).overload(); ...
3
votes
3answers
123 views

Is CSP enough to prevent XSS attacks [duplicate]

Assuming that users are using modern browsers, is implementing a strict CSP policy enough to prevent all XSS attacks? I'm working on a Backbone app, and am wondering if I still need to be escape user ...
4
votes
1answer
123 views

What are some useful tags and payloads for HTML injection on CSP-protected sites?

I'm pen-testing a website that fixed most of its XSS vulnerabilities by just adding a Content Security Policy. There are still HTML injections in several places. I've tried to get a ...
-1
votes
1answer
91 views

How can you use XSS to break this security on a site? [closed]

To delete your account on a website, the following form is used: <form action="/deleteaccount" method="post"> <input type="hidden" name="user" ...
1
vote
1answer
149 views

Mandatory to implement HTTPOnly if Java Secure Cookies are set to 'true'?

Here is a test case from a recent application security asessment which I have had experienced: cookie = new Cookie(strKey1, EncryptDecrypt.encrypt(strValue)); cookie.setMaxAge(-1); ...
2
votes
1answer
832 views

Cannot turn off XSS filter in Chrome

I am using the following command to launch Chrome: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --args --disable-web-security to turn off XSS auditor in chrome in Windows 7, but ...
2
votes
2answers
91 views

Classifying Reflected and DOM-based XSS

Having referenced Difference between DOM & Reflected XSS , I observed that certain attacks could be both DOM-based and Reflected XSS. I wish to find out if my understand is accurate, or they ...
1
vote
2answers
373 views

XSS when some keywords are prevented on the server side

When I scan website with burp suite pro, I encountered a XSS. This XSS is <a b=c> When Burp suite test other payloads that contain keywords like script, alert, onerror, this parameters ...