Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS), DOM-based XSS (aka client side XSS).

learn more… | top users | synonyms

-1
votes
0answers
20 views

Url quote escape (whenever I place a quote in the url, it escape it with '/) [on hold]

Title says it all, if you have any idea how to bypass that, please answer me :)
2
votes
1answer
46 views

What are some useful tags and payloads for HTML injection on CSP-protected sites?

I'm pen-testing a website that fixed most of its XSS vulnerabilities by just adding a Content Security Policy. There are still HTML injections in several places. I've tried to get a ...
1
vote
0answers
12 views

Protection against Cross site scripting on specific JSP and Servlet code [migrated]

Here are the servelet cum JSP code, let me know how we could protect them from XSS? Servlet Code: String strRequestScrip = SecurityCheck.getStringParameter(request,PARAM_SCRIP_CODE); List ...
-1
votes
1answer
62 views

How can you use XSS to break this security on a site? [closed]

To delete your account on a website, the following form is used: <form action="/deleteaccount" method="post"> <input type="hidden" name="user" ...
1
vote
1answer
29 views

Mandatory to implement HTTPOnly if Java Secure Cookies are set to 'true'?

Here is a test case from a recent application security asessment which I have had experienced: cookie = new Cookie(strKey1, EncryptDecrypt.encrypt(strValue)); cookie.setMaxAge(-1); ...
2
votes
1answer
107 views

Cannot turn off XSS filter in Chrome

I am using the following command to launch Chrome: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --args --disable-web-security to turn off XSS auditor in chrome in Windows 7, but ...
3
votes
0answers
225 views

Content not appear in body [migrated]

I have a file a.html, which has the following content: <script> var x=document.URL.substring(document.URL.indexOf('#')+1); document.write(x); alert(document.body.innerHTML); </script> ...
2
votes
2answers
44 views

Classifying Reflected and DOM-based XSS

Having referenced Difference between DOM & Reflected XSS , I observed that certain attacks could be both DOM-based and Reflected XSS. I wish to find out if my understand is accurate, or they ...
1
vote
2answers
342 views

XSS when some keywords are prevented on the server side

When I scan website with burp suite pro, I encountered a XSS. This XSS is <a b=c> When Burp suite test other payloads that contain keywords like script, alert, onerror, this parameters ...
1
vote
2answers
82 views

XSS via REQUEST_URI

Is there any situation where an XSS attack can be performed via the PHP $_SERVER['REQUEST_URI'] variable? For those unfamiliar with it: It contains the complete URL used to access that website, ...
5
votes
2answers
919 views

Does base64 encoding an image and storing it in a database introduce risk for XSS

Ok, here is a scenario for you here. You have a database. You have a table in it that you will store small 30x30 pixel PNG images. They are base64 encoded. They will be echoed out as an avatar for ...
2
votes
2answers
51 views

Temporary XSS Vulnerability

I found xss on a textarea field. When you enter a character to this field it output the character on realtime so when i input the following code: <input onclick=alert(document.cookie)> there ...
3
votes
1answer
120 views

How can I successfully perform an xss attack on a dummy website? [closed]

in my security course, we were told to practice an xss attack using firefox on this website; http://permalink.co/ No worries, this is a website specifically setup for us to practice ...
2
votes
0answers
14 views

How to Allow users to save html in Rails application without affecting security [duplicate]

After doing a lot of research I come to this forum hopefully i can get some help. I am building a Ruby on Rails application (version 4.2) My app allow users to create "one page" portfolio : user 1 ...
5
votes
2answers
145 views

How to safely display html emails like gmail does it?

I'm building a webmail, which must be able to display html emails. But how to prevent xss and similiar attacks, while not loosing html formatting? In gmail, when I receive some emails from, lets say, ...
5
votes
2answers
97 views

How to break out of URL context

The OWASP XSS Prevention Worksheet recommends "URL escape before inserting untrusted data into HTML URL parameter values". I don't understand how someone could break out of a URL context or inject a ...
0
votes
2answers
40 views

Is there standard guideline on how the sanitized input should appear in the error message?

Let us say your web app is sanitizing bad input and displaying the user what the bad input was. Before XSS measure was put in place web app is spitting out malicious script as is. For example Bad ...
2
votes
1answer
42 views

Limiting latter dom-based XSS when setting document.title

Given some JavaScript which modifies the page's title by taking in variable data document.title = someVariable I am looking to address dom based XSS while keeping the title fairly readable. ...
2
votes
2answers
137 views

Stealing document.cookie from Google domain, is this a privacy breach?

When I am logged into the Google and prints document.cookie I could see following cookies. My doubt is what all an attacker can do if attacker could steal these cookies of the victim using exploiting ...
9
votes
2answers
683 views

Cross site scripting when the greater than and less than signs are escaped?

If a website encodes < to &lt; and > becomes &gt;, is it still possible to perform cross site scripting? What would you enclose the script tags in? For example, on one of my sites I can ...
-1
votes
1answer
39 views

Shortened links and social media [closed]

I've been into IT-sec for a few years now and I have recently gotten in to the whole reddit/r/netsec, twitter, security.stackexchange thing, to get more involved with the community. What surprises me ...
1
vote
2answers
207 views

Should CSRF token without session cookie work?

Let's say that website example.com has CSRF protection. They send CSRF token in custom header and in hidden input fields. For example to add new folder, your http request need to contain CSRF token. ...
-1
votes
1answer
133 views

Hack to change the webpage of a website? [closed]

Recently, there is a website by Malaysia Airline got hacked and their main page has been defaced, below is a link to that article ...
1
vote
2answers
112 views

XSS outside of the DOM

I have the following JS (using jQuery for brevity's sake but it isn't necessary for the question): $("<i></i>").html(userInput); Is it possible for someone to input some string, ...
0
votes
1answer
43 views

From a security perspective, why not a screenshot api for browser? [closed]

I mean a javascript api for capturing a renderered html page, or current viewport, and dump content onto an image. While there are obvious attacks, such as taking screenshot of sensitive information, ...
2
votes
2answers
83 views

How does xss work with web applications that take payload not through url

Most of the examples of XSS, I have seen examples of websites that get its parameter tampered through url query parameter. For example: ...
9
votes
2answers
2k views

How do the Stack Exchange sites protect themselves from XSS? [duplicate]

It seems to me that because Users can post questions and comments in them with HTML markup (possibly <script> tags), Stack Exchange sites would be very exposed to XSS attacks. How do they ...
0
votes
0answers
56 views

XSS encode / decode strange char interpretation

Can anyone tell me why i cant get this XSS to reflect ? or why is this Filtered or not rendering ? The Post sent is : ... Content-Length: 91 add=1&reference=A</><img src=a ...
0
votes
1answer
61 views

XSS in options tag without forward slash

I am trying work on an XSS scenario. Would appreciate if anyone can help. URL: www.example.com/mydata "mydata" is landing in html as follows: 200 OK ... Content-Type: text/html; charset=utf-8 ... ...
4
votes
2answers
193 views

How to bypass .Net 4.5 request validation, for an XSS attack?

.Net has a feature called request validation which detects malicious inputs and blocks the request. By its nature, request validation is not a precise science. OWASP clearly recommend to only rely on ...
2
votes
1answer
44 views

Sanitise specific HTML attribute values against XSS

We want to implement a "safe mode" in a Markdown parser called Parsedown. We have a MarkupEscaped option that disables HTML input, but this is not enough. In order to be safe, the parser needs to ...
2
votes
4answers
92 views

Allowing users to upload & download XML safely

We have a requirement to allow users to upload an XML document into our system. We don't process it, we just allow them to download it again. Given various browser XSS vulnerabilities such as this: ...
1
vote
4answers
183 views

Vulnerable XSS Test [closed]

I have to do a presentation about XSS. I want to give a demo but I can't find test platforms. I found http://zero.webappsecurity.com/index.html but this site always shows a FireHost-block when I try ...
1
vote
0answers
25 views

Can't mail stolen session ID [closed]

I'm working on this platform: http://testfire.net/ With this script I can see the cookie: "><script>alert(document.cookie)</script> So now I'm trying to mail this cookie to me. ...
2
votes
1answer
52 views

Is there a strong protection against CSRF executed from the sames server via stored XSS?

If we have a domain with stored-XSS vulnerability. I know it's already critical!.. But, I'm talking about limiting the damage. The hacker can't get the session cookie of the admin, because it's ...
2
votes
1answer
122 views

How is the QSS tag used as payload in an XSS attack?

I have received a report from a client that lists XSS vulnerabilities. The report shows reflected XSS vulnerabilities. In each vulnerability, the payload reflected is a single, unclosed <qss> ...
2
votes
1answer
242 views

Snort IDS for Amazon deployment

Is Snort a good choice for monitoring network and web application traffic on Amazon EC2? If not, why and what IDS would you suggest? Is Snort a good choice to monitor for XSS, Sql Injection, attempt ...
-1
votes
2answers
117 views

Is JavaScript console vulnerable to XSS

Assume the content of the name variable below is controlled by an attacker. Is this line of code vulnerable to XSS? console.log(name) When I send an injection in name variable I see its value ...
0
votes
1answer
446 views

is HttpOnly and Secure cookie enough to prevent CSRF in rest api?

I created one RESTful API using spring. I am transmitting a secret key as HttpOnly & Secure cookie with login response. After login every rest request will check with that cookie and update it ...
1
vote
3answers
165 views

Beyond SQL injections and XSS

I'm a programmer working on a web service (by myself). Given the fact that I am not a security expert, I came to this website to ask my question. I did all the major things to secure my website. I ...
4
votes
2answers
109 views

How do honeypots remain secure to 0days and newer exploits?

If honeypots are designed for a specific set of exploits, such as SQL injection and XSS, how do they protect themselves against other exploits? For instance, if I created a honeypot a few months ago, ...
49
votes
6answers
5k views

Does injecting querystring values directly into HTML pose a security risk?

Someone reported a bug on my site that I don't really consider an issue. My site has an URL akin to this: www.site.com/ajax/ads.asp?callback=[text injection] So filetype is application/json, and I ...
3
votes
2answers
453 views

Using classic ASP, is this the right way to do to protect against XSS?

Using classic ASP, is this the right way to do to protect against XSS? var1=untrusteduserinput Showing a text in the body <%=server.htmlencode(var1)%> Showing a link in the body <a ...
5
votes
3answers
117 views

XSS vulnerability in raw script response?

We recently had a security scan done on our production web applications and received a notification of a potential XSS vulnerability on a particular URL that is used to retrieve a combined response ...
2
votes
1answer
293 views

What is the shortest malicious XSS possible? [closed]

Sometimes you stumble upon input fields that don't escape input properly, but who still appear to be to short to actually be used for anything malicious, at least to someone with my limited ...
2
votes
2answers
115 views

is it sufficient to convert '(single-quote) to ` &#039; `

Is it sufficient to convert ' to &#039; , > converted to &gt; and < converted to &lt; to avoid xss A bit of context: the payload would be going through the URL and landing in a ...
4
votes
3answers
1k views

Is this PHP code XSS proof?

Is the following PHP code XSS proof? <?php $site = $_GET["url"]; echo "<a href='".str_replace(array("\"", "'", "javascript:", "vbscript:"), array("%22", "%27", "", ""), ...
14
votes
6answers
2k views

Is XSS a server-side or client-side vulnerability?

My colleagues claim that XSS is a vulnerability on the server side. I always thought that this is a client side vulnerability. Which one of us is correct, and why?
2
votes
1answer
101 views

How does this wordpress XSS work?

There is a new Wordpress exploit in wp-includes/formatting.php $textarr = preg_split('/(<.*>|\[.*\])/Us', $text, -1, PREG_SPLIT_DELIM_CAPTURE); General problem here is that they try to parse ...
2
votes
5answers
756 views

Is converting `<` to `&lt;` sufficient to prevent execution of JavaScript from arbitrary HTML?

This is kind of a bar-bet question. An acquaintance of mine has made the claim that, given an arbitrary glob of HTML, it can be completely prevented from executing JavaScript if, before slapping it ...