Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

learn more… | top users | synonyms

-3
votes
0answers
12 views

How to create a simple chrome extension with ax XSS vulnerability? [migrated]

Could anyone point me to any tutorials or just offer some tips on how to create a basic web extension with an XSS vulnerability? I was thinking of something really basic, like an extension that tells ...
-3
votes
0answers
18 views

XSS - Can we made changes in cart items, delivery address etc [closed]

Suppose we found a XSS on shopping site. can we add the item in cart or change the billing address and payment method by sending a sequence of AJAX requests?
0
votes
3answers
58 views

XSS - Can we steal cookies from another website on another tab?

Suppose I found a XSS bug in a eCommerce website. Can we steal the victim's cookies from their bank website (if that is opened in another tab)?
1
vote
0answers
30 views

Should I worry about NoScripts anti-XSS warning when making a 3DSecure payment?

When I make an online payment using 3DSecure (Verified by Visa or Mastercard Securecode), NoScript informs me that it has stopped a potentially insecure script where site A (the bank or the credit ...
-1
votes
1answer
25 views

XSS Vector without < or > symbols or equal sign?

Just wondering if anyone could help me out with some XSS Vectors that work without having the < or > symbols. Basically the the input is stripped from < and > symbols and any equal signs such ...
2
votes
1answer
34 views

Break out of JavaScript data context to perform XSS when backslash and quotes are replaced?

Suppose I have a this on my site: <script> var x = "<? echo unsafe_data; ?>"; </script> This is obviously vulnerable to XSS. Now suppose I "clean" the unsafe data by replacing \ ...
4
votes
7answers
144 views

Any non alert() based non malicious XSS payloads?

I have been trying to find non malicious, non alert based, single command reflective XSS payloads, and have so far seen none. Anybody know of any good ones for pentesting purposes? What I mean by ...
3
votes
1answer
68 views

Could somebody explain how the ASDA site is vulnerable?

I'm sure many of you will have seen the CSRF exploit highlighted by Paul Moore that ASDA have known about for two years (Paul's blog) I am trying to find an explanation as to WHY the website is ...
1
vote
1answer
44 views

Security concerns of HTML echo endpoint

Consider a website with an endpoint that, when a payload of an HTML string (full document or partial segment) is POST to it, the server will transform the payload (and sometimes no transform is ...
4
votes
0answers
41 views

Wordpress.org pages refresh when logging out of Gmail

I've noticed that when I change my Gmail account by logging out of one account and then logging into another, all open Wordpress.org pages refresh. Additionally, when I recently changed a password on ...
4
votes
1answer
43 views

Style attribute XSS without quotes

If there is a page that allows user input into the following... .page { background: #userinput; } can it be exploited if <>'" are all filtered? I've seen width: expression(alert(0));, but ...
0
votes
0answers
28 views

Help with XSS Evasion [migrated]

I have a form which performs a strange kind of XSS Filtering. <script>alert(1);</script> is converted into <script>alert%281%29%3B<%2Fscript>. How do I bypass this kind of ...
9
votes
3answers
1k views

Can I simply search-replace < and >?

I'm running a comment system, and I want to accept regular, un-formatted text. I don't want anything too complicated, so I thought of just searching and replacing all < to space (through regex or ...
0
votes
2answers
52 views

Is it possible to execute xss when response is of content type:application/json in latest IE? [duplicate]

Question is when response type of request is coming as application/json and also there is not any kind of escaping/encoding implemented then is it possible to execute xss there? Changing file ...
1
vote
0answers
23 views

From xss to rce in client side [closed]

I found a desktop application in Linux w/c getsvand that displays items from site xyz. xyz is vulnerable to XSS and code injected there is also executed on client side's desktop app.similar to this ...
1
vote
1answer
44 views

Executing XSS payload when “http” is added to payload

I have a context where every special characters are escaped properly except ':' &'/'. The output is reflected inside <a href="payload" tag. 1 )When I set payload to javascript:alert()(which ...
0
votes
0answers
32 views

Client Side Attacks - XSS and CSRF [duplicate]

It is against the law injecting JavaScript scripts (simple pop out alert) or capturing and modifying with Burp/Fiddler HTTP request for identifying web application vulnerabilities (CSRF) without the ...
6
votes
1answer
58 views

Proper way to protect against XSS, when output is directly into JS not HTML?

I'm seeing plenty of examples when the output is going into HTML directly, but I'm seeing more conflicting information when the output is going straight into JS. For example if the code was: var ...
0
votes
2answers
63 views

Reflective XSS in script codes with Content Type “text/javascript”

I have a webpage that returns raw script code with the headerContent-Type: text/javascript. However I found that there is a reflective xss in one of the parameters passed to the url which is copied ...
3
votes
1answer
100 views

Is this vulnerable to XSS exploit?

A typical ajax call: $.ajax({ url: "http://mywebsite/script?param=" + $("#field").val(), dataType: "jsonp", success: function(response) { $("#id").html(response); }, }); sends a ...
9
votes
2answers
737 views

How does CORS prevent XSS?

I recently learned about CORS and got the impression that its purpose is to prevent XSS. With CORS, the browser blocks requests to different domains, unless particular headers are in place. But if a ...
6
votes
2answers
126 views

XSS via JSON: Why does a web application not sanitize either its incoming params hash or its outgoing JSON values of malicious tags like Script?

Recently working on a Rails-based web application for a company, I had to look into XSS vulnerability. It turns out that the application, in some places, could take an HTML tag (e.g., jscodehere ...
4
votes
1answer
140 views

How make Firefox ignore X-XSS-Protection header from server?

I have two questions: 1)How can I make Firefox ignore X-XSS-Protection header? I have a website which sends X-XSS-Protection: 1 header and I want my Firefox to ignore that header, because it destroys ...
9
votes
2answers
57 views

Personal stylesheets

In reference to this question, I was researching whether or not there would be any security risks in letting users add their own stylesheets. He brings up a scenario in which a dev might use ...
0
votes
1answer
28 views

Javascript Valuable Webpage Data

When malicious users and attackers seek to steal data using XSS, they can send attributes like document.cookie to a malicious server, correct? Does this attribute have all of a users cookies for a ...
4
votes
1answer
75 views

How can I exploit a web application if content sniffing is not disabled?

I just come across one of the customer's website for penetration testing having JSON callback reflecting the user input in the response body. like this: ...
0
votes
1answer
149 views

Can someone tell me whether this is Cross-site scripting attack or normal log entry?

Can someone shed light on this logs . ****GET /list25/ADMN/Eligibility/EligibilityResponse.aspx ...
2
votes
1answer
59 views

XSS via -confirm()-

I was reading this article here, in the middle I saw the author used -confirm()- as the payload. I'd like to know what is this payload? I mean what's the difference between -confirm()- and ...
0
votes
0answers
22 views

Different chanels for BeEF UI and Communication Server

I am working with BeEF tool and I want to access the UI interface using https (I don't want to communicate via VPN to access the control panel), while at the same time, I need to serve the http hooks ...
6
votes
3answers
247 views

How to convince team mate about using a whitelist?

Context In our development team, we have to build a component. This component is a full client side one written in Javascript. A client web application wishing to embed this component will call it ...
2
votes
0answers
36 views

How to validate Excel data to protect against XSS?

My application is dynamically constructing a source URL and then writing the resource file (Excel) directly to the response. The URL is read from a properties file, based on the application ...
4
votes
1answer
41 views

Does using creating a seprate firefox profile cause a seprate security context to protect against XSS and DNS Re-binding?

I read here that I should use separate security profiles for different sorts of things; accessing sensitive information, doing system administration vs. opening links from emails. I know that ...
0
votes
0answers
34 views

Is Primefaces vulnerable to host header attack?

Is the Primefaces JSF framework vulnerable, or secured against host header attack?
1
vote
1answer
58 views

XSS - Using firebug to inject Scripts

Recently I did a bit of digging around XSS and found that to prevent XSS the best way is to encode user input/output. Being a newbie in this field I am unable to get my head around this and have a ...
-1
votes
1answer
64 views

How do a basic tests for webapp - online tool made with PHP (forms, shell access, session) [closed]

I created a webapp in PHP (MySQL, jQuery) and now I want to take necessary security measures in order to keep it up and running and harmless for my VPS. App has several public forms ($_POST, $_GET, ...
-1
votes
1answer
65 views

XSS display cookie of another website

Trying to practice XSS on dummy website. My end goal is to display the victim's cookies on my "attacker" site. Currently what I have is that when the user enters my site, it will pop up the dummy ...
0
votes
2answers
90 views

How can I demonstrate the reflected XSS via post methods

I was trying to make a PoC of XSS: Attack sample: I have injected script into the value: <html> <body> <form action="https://test.com/api/users.prefs.set?t=1447648400" ...
6
votes
1answer
108 views

How does X-XSS-Protection: “0” affect the security of my website?

How does disabling XSS protection affect my website? What security vulnerabilities does it open? My site requires the header to be used on certain pages, so what can I do to secure the pages with the ...
2
votes
1answer
65 views

Is this code vulnerable to DOM based attacks?

We are developing code for a Banking web application. We want to make sure that the code is secure and since we are using a lot of javascript code, we are kind of worried if any chance of a web based ...
3
votes
1answer
22 views

XSS Injection invalidate meta redirection tag

When injecting into the url part of an HTML META redirect like this: <meta http-equiv='refresh' content='0;URL=$URL' where $URL (note the missing quotes) is the part I can inject, is there any ...
5
votes
1answer
175 views

What is the benefit of the X-XSS-Protection: 0 header in a production environment?

X-XSS-Protection is a non-standard but widely used header that instructs browsers to enable or disable their builtin protection against reflected XSS attacks. Most websites I visit send ...
4
votes
4answers
100 views

Xssing without opening a new html tag <

Example: test.php?p=test give output: <p style="...">test</p> I can inject anything other than '<', when injected I got redirected. So can it be exploited ?
4
votes
3answers
174 views

HOW is the malicious URL/payload is delivered to the user on a DOM based XSS attack?

Testing for DOM based XSS at OWASP reads: The first hypothetical example uses the following client side code: <script> document.write("Site is at: " + document.location.href + "."); ...
2
votes
1answer
113 views

Security of cross-origin XMLHttpRequest Javascript

I am building a Chrome extension that will be making cross origin "get" and "post" requests to a few third party websites. I have been researching this process for hours and I am becoming increasingly ...
1
vote
1answer
166 views

Does using ASP.NET prevent XSS [duplicate]

I was reading about XSS, and I know that ASP.NET doesn't allow saving HTML to database. So my question is Does using ASP.NET make my web application secure regarding XSS completely, without ...
67
votes
5answers
4k views

Strange Payment Gateway

I have a freelance client that wants me to integrate a payment gateway into their Woocommerce site but I am being increasingly concerned about their choice of provider and the project as a whole. The ...
6
votes
2answers
309 views

How does BeEF work and how can it be persistent

BeEF - the browser exploitation framework. I think (thought) I had a basic working understanding of how it works. Recently, though, I was watching, this DEFCON talk, where a hacker used a ...
4
votes
1answer
75 views

XSS through modifying a UI element value?

I send an AJAX request and when the HTML loads back, I retrieve the values of some UI elements at the client side and present them to the user, like so: var displ="<h1>"+$( "#myslider" ...
2
votes
1answer
61 views

Mitigating reflected XSS in node/express requests for static assets

I've asked this on Stack Overflow because it is related to a programming problem (how to mititgate vulnerabilities in code) but I do have some broader questions, and a lack of understanding about how ...
1
vote
1answer
73 views

Tweaks related to javascript execution in browser

Suppose, a filter validates the url, but not the protocol. In that case I can XSS that field with the following payload javascript://%0D%0Aalert(document.domain);//validurl.com You can paste above ...