Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

learn more… | top users | synonyms

3
votes
3answers
41 views

What are the limitations of Content Security Policy?

I'm wondering what this new technique will not protect us against. As I see it, since inline scripts are disabled (and I assume that includes javascript: links) then it solves the issue of covert ...
2
votes
0answers
37 views

Is there a database with XSS vectors, possible reference and test information?

I recently had the idea to develop a public database in which unique cross-site scripting (XSS) vectors will be registered and get a reference assigned similar to the CVE system. I made a local PoC ...
1
vote
3answers
89 views

What is more secure practice? Hosting from CDN or Main website

There has been a long Debate on CSP modelling, I have a Web application and I use JQuery in it, For that i use JQuery main site http://code.jquery.com/jquery-x.yy.z.min.js to Host it on my Site to ...
-3
votes
1answer
47 views

Which WYSIWYG editor has the best security reputation? [closed]

I would like to use a pre-built WYSIWYG editor such as TinyMCE or CKEditor in a website that I'm building. Since I expect my users to be entering confidential information into the editor it is ...
0
votes
1answer
71 views

XSS payload without using < and >

I am performing testing on a site that takes input from the user and places it between <span> and </span>. However, < and > from the user are encoded as &lt and &gt. Is ...
0
votes
0answers
47 views

Stored XSS confirmed both by Netsparker and Acunetix

Both Acunetix and Netsparker are warning me about stored XSS. Acunetix URL encoded POST input langSelected was set to 1' onmouseover=prompt(973181) bad=' The input is reflected in www....../home....
2
votes
1answer
60 views

Cross domain iframe security

How exploitable is a site listening to browser messages from anyone? I am working on a site where I have found some iframe issues. The case is that site A has an iframe of site B, and site A listens ...
3
votes
1answer
42 views

Bottleneck while creating XSS scanner for a website which returns API response instead of HTML

I am trying to build an XSS scanner using Python for a website. The website has widget creation feature. The source code for the website has templates for each widget type. The website returns an API ...
1
vote
4answers
84 views

How to use XSS vulnerability to read file on server?

Can I use an XSS vulnerability to read files on the server by injecting PHP code to the page? Ex: Use document.write to inject PHP code that read the file.
2
votes
0answers
54 views

How can I protect my PHP app against XSS?

I am upgrading the security of an existing site (so can't redo everything with a framework that has xss functions built in), so I am looking for a way to protect against XSS attacks such as the ones ...
0
votes
1answer
34 views

Is there a way to calculate the complexity of an XSS-vector?

Is there a way to calculate/estimate the complexity of an XSS vector? I would like to consider a "XSS-vector complexity score" in the risk = likelihood * impact formula1. In my opinion the likelihood ...
0
votes
0answers
39 views

Can modifying the /etc/hosts file create holes for XSS counter-measures?

I normally modify the /etc/hosts file so I can map mock urls to my development server. Whenever I do this, the ajax requests being sent has for its origin header the mock url I used in mapping to the ...
0
votes
1answer
40 views

CSRF token generation and validation

I am trying to implement XSS best practices on a site I’m making. I am currently generating a secure token on my server and sending it back to the user as a form hidden field, then validating that ...
9
votes
7answers
5k views

Why does XSS affect so many websites?

According to an article I read 65% of all websites globally suffer from XSS. Why can't developers find and fix it? Please help me understand. I'm not from a security or tech background.
0
votes
2answers
93 views

Need help understanding OWASP Vulnerabilities [closed]

I am doing a whitepaper on simplifying OWASP 10 vulnerabilities based on an article our teachers suggested. Can you guys help or provide more resources here? What are your views? Will like to ...
7
votes
2answers
84 views

Ending a javascript block without slash character

Very frustrating situation on a pentest I am currently doing - I have found a place where I can inject almost all characters into a piece of javascript from a parameter. But the web developers seem ...
3
votes
1answer
82 views

XSS filter bypass to hook BeEF

I found a vulnerability on a website which allows me to trigger XSS. It's a very specific vulnerability, which is caused by a design-flaw. I want to write a PoC for them but I'm stuck at this step. ...
-2
votes
1answer
20 views

How do I perform output encoding on text boxes having fixed size?

I have a fixed size text box which expects '<' and '>' symbols as input. It is a requirement for that text box to expect '<' and '>' in its input so I can't perform input validation for that ...
0
votes
1answer
39 views

Access to raw html source code after angular client side processing

I need help to check if parameters are sensible to XSS injections in a webpage generated by angularjs. Today, many websites are using angularjs in order to deport client page construction at the ...
4
votes
2answers
787 views

Why can't persistence XSS be detected by a Web Application Firewall?

This OWASP article mentioned that "Using data validation, only reflected XSS can be detected and prevented, persistent XSS cannot be detected, DOM-based XSS only to be limited degree if part of the ...
3
votes
2answers
236 views

Disclosure of end user files / Installation of Trojan horses via XSS

I've stumbled upon following examples of XSS attacks on OWASP: "Other damaging attacks include the disclosure of end user files, installation of Trojan horse programs..." Link to the example: https://...
0
votes
1answer
30 views

Reflecting user input within a JavaScript variable

I am struggling to understand whether the following would be considered as a DOM-based XSS or reflected XSS and was hoping that someone could help me distinguish the the difference. Imagine the ...
3
votes
1answer
109 views

How secure is HTML5 web storage (sessionStorage and localStorage)?

I'm thinking of using either sessionStorage or localStorage to store some important user data. The extension's functionality will only work in the context of a particular website that defaults to ...
1
vote
0answers
31 views

url-encoded original URL in error page via og:url meta tag - Risk assessment?

I'm asked to advise on a scenario where meta tags in a 404 error page include the Open Graph og:url, which is (I'm told) being populated by React libraries. The full url as presented to the server ...
0
votes
0answers
67 views

XSS attack without special chars [duplicate]

I found a website vulnerable to XSS, but it disallows these characters: ( ) / \ Can I do an XSS attack without these characters?
7
votes
2answers
630 views

Did XSS reach its end-of-life with the introduction of the HTTP X-XSS-Protection header?

With the introduction of the HTTP X-XSS-Protection header it seems to me that the vulnerability impact (read: amount of possibly affected users with modern browsers) is drastically reduced. Firstly, ...
3
votes
2answers
92 views

Does displaying images on profiles by URL have security implications?

I am Developing a Web Application Currently, in which users can Make a Profile and Fill out the User's information, In this i have also kept a Section for Profile Picture, in that i have used a logic ...
-1
votes
2answers
71 views

Under which conditions wouldn't a script tag run [duplicate]

I'm trying to understand how XSS works, and I bumped into Google's XSS games (https://xss-game.appspot.com/). Level 1 is easily solvable with the most common XSS (<script>alert(0)</script&...
1
vote
1answer
485 views

Using htmlentities() in a BBCode-supporting textarea to stop XSS

I want to have a text area to post stuff to the database with BBCode. So, I downloaded a JavaScript code (to write in the specific BBCode when the image is clicked) but it didn't transform the text. ...
2
votes
2answers
111 views

XSS payload with ten character length restriction

There is an input field which is not getting encoded at the server side. But if you give a whole script say <img src=a onerror=alert(1)>, it shows an error like: <img src=a....' is not a ...
0
votes
2answers
58 views

Can we consider injection of HTML tags without event attributes as XSS?

I'm wondering if we can consider the injection of HTML tags like a, image, img, video, audio, marquee or iframe without an event attribute as XSS? Since no JavaScript is involved and therefor no ...
2
votes
1answer
146 views

XSS not exploitable when POST data is sent in JSON?

There is a reflected XSS flaw in an application I am testing. Initially, the payload is sent in POST request as value of a JSON key and the response is also a JSON object. The returned value in the ...
-4
votes
1answer
103 views

Is this script vulnerable to XSS? If yes, how can I exploit it? [closed]

Is this script is vulnerable to XSS? If yes then how can I exploit it? <script> //<![CDATA[ var _gaq=[['_setAccount','UA-34064858-1'],['_trackPageview']]; (function(d,t){var ...
2
votes
2answers
78 views

Why shouldn't I put user input in HTML comments?

The OWASP XSS Prevention Cheat Sheet has a list of locations where untrusted data should never be put: <script>...NEVER PUT UNTRUSTED DATA HERE...</script> directly in a script <!...
5
votes
1answer
55 views

Why don't web templating frameworks HTML escape all data by default?

I recently discovered an XSS vulnerability in an application that uses JSP to render pages. The vulnerable code in the JSP was something like this: <td>${customer.notes}</td> It was ...
0
votes
0answers
16 views

Does CKEditor for ASP.NET do auto sanitation?

I don't see anywhere to enable a sanitizer in the CKEditor ASP.NET implementation. How are we supposed to do sanitation?
10
votes
2answers
160 views

Using Single Domain Name to Identify Multiple Servers Improves Security? (Google's use of 1e100.net)

Since 2009, Google has been using a single domain name to identify its servers across multiple products: Following standard industry practice, we make sure each IP address has a corresponding ...
4
votes
1answer
77 views

Is displaying a non-encoded HTTP Referer header vulnerable to XSS?

Consider the following PHP script (it could be any other language; I chose PHP for simplicity): <?php echo $_SERVER['HTTP_REFERER']; ?> Is it vulnerable to XSS? Of course I can send a ...
8
votes
2answers
183 views

Can XHR patching prevent XSS side-effects?

XSS & Single-Page Apps I'm researching on web security, and have seen that token based authentication is good for CSRF prevention, distributed system architectures and processing performance. ...
64
votes
1answer
5k views

Tell browser my site has no scripts

I have created a Tor hidden service site which has absolutely no JavaScript or other types of client side scripts. The page is HTML, CSS, images, and some JSP for handling user input. I encourage ...
0
votes
2answers
163 views

exploiting CSRF in ajax request via XSS flaw

In an application i am testing, there is a stored XSS flaw. Now, I was testing for CSRF and I constructed an HTML page with a javascript that sends the ajax request (XHR). It caused a pre-flight ...
1
vote
2answers
134 views

XSS vectors in img src and background-image url

I'm a little confused about XSS vulnerabilities when serving img.src and background url. From what I understand, the only way to execute javascript in this case, is to use javascript protocol. Let's ...
3
votes
1answer
139 views

Can a simple comment on WordPress harm my system (CVE-2016-4567)?

What risks are associated with the WordPress vulnerability CVE-2016-4567? Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in ...
-5
votes
1answer
59 views

Is possible to get password with stored XSS? [closed]

Is it possible to get password from a site with stored XSS? I have a forum where I can put JavaScript not directly but inside HTML (like <div onclick="alert()">CLICK</div>). Is it possible ...
2
votes
2answers
142 views

JavaScript variable evasion when quote is escaped, but not newline

I'm searching a way to properly evade from a JavaScript variable to perform XSS. A normal user input will give var a='<b>user input</b>'. a isn't eval anywhere and is not usable. Howewer,...
2
votes
1answer
68 views

Does removing user interaction create a secure sandbox that nullifies XSS?

Say there is a service online that takes as input a DOM string, loads that DOM in a browser on their server, and returns a screenshot. Would it be possible for the online service to completely ...
1
vote
1answer
65 views

XSS Page Cannot be Displayed

When I try XSS on various websites, such as inserting " onmouseover="alert(1) in a search box, I either get a message saying You don't have permission to access this page or This page cannot be ...
1
vote
1answer
100 views

DOM based XSS: jQuery(“#HiddenReferral”).val(jQuery(location).attr('href'));

DOM based XSS has been reported by Burp Suite and showed this query as vulnerable: The application may be vulnerable to DOM-based cross-site scripting. Data is read from location and passed to ...
2
votes
1answer
53 views

Having malicious code stored in your DB

Let's say that there is a website which has an input field from which the input is saved to a database and then displayed somewhere else on the website. Is it safe to only sanitize/escape the output,...
0
votes
1answer
58 views

XSS to overcome HTML entities

In a search box (<input value=" *insert search term here* "...>), when I input " onmouseover="alert(1), the double quotes are converted to their entities, so it's not possible to break out of ...