0
votes
3answers
82 views

Does this reflected XSS vulnerability pose any real threat?

I have a web site where users can enter some text into a textbox and that text is immediately rendered in a div using javascript (strictly front end). If a user enders something like this: This is ...
4
votes
2answers
144 views

Does allowing the <cite> tag create any XSS vulnerabilities?

Backstory: Stack Exchange's markdown parser allows a couple of HTML tags (a,b,i,img) through, with some restrictions on the attributes to prevent XSS. We're thinking of requesting the <cite> tag ...
0
votes
1answer
77 views

False Positives- Server side protection against XSS

I read about XSS attacks and its prevention mechanism on server-side. It seems only protection is to sanitize the input by escaping special characters on server side (Using some PHP functions such as ...
0
votes
2answers
75 views

Is SSL a mitigating factor for HTTPonly not set on cookies?

I have a few sites that are using HTTPS (no mixed mode HTTPS/HTTP). The cookies do not have a HTTPOnly flag set. They do pass along session IDs. Also some of the sites do not have a "Secure"flag set ...
0
votes
1answer
107 views

XSS attack vector without forward slash?

is there an XSS attack vector that allows the inclusion of a external .js file without having to use forward slashes? let's say the path of the file is somewebsite.com/js/xss.js Is there a way to ...
1
vote
2answers
115 views

Is Temporary XSS a Problem?

I use a site on a regular basis so I wanted to make sure it was secure. One of the things I checked was that when I changed my first name to <img src="http://blah.blah/blah/blah.notanextension" ...
2
votes
3answers
155 views

OWASP escaping recommendation - why /?

In OWASP recommendations regarding escaping untrusted input for HTML element content, they list the following: & --> &amp; < --> &lt; > --> &gt; " --> &quot; ' ...
3
votes
2answers
162 views

Escaping rich text editor output

When having a rich text editor on a web application, what is the best way to escape HTML entities and prevent XSS attacks but keep the formatting (<b>, <i>, <u>, ...etc.) ?
2
votes
1answer
272 views

XSS cookie stealing without redirecting to another page

I'm practicing in VM following the OWASP guide. I know that is possible to steal the cookie by redirecting to "False" page etc. but I would like to steal the cookie without redirecting on another ...
0
votes
3answers
98 views

Regarding Cross-Site Scripting attacks

My application has an Upload Management Module and accepts Excel and text files to our server. I detected invalid data inside some uploaded files (the uploader put ...
5
votes
2answers
115 views

Any eventhandlers that apply to hidden elements?

Im trying to XSS a search field and my attack vector is getting reflected like this: <input type="text" id="txtRpHiddenKeyword" style="display: none;" value="ATTACK VECTOR HERE" /> Only ...
4
votes
2answers
233 views

XSS when <, > and " are escaped

I'm pentesting a website that has a reflected XSS, or at least a vector for a reflection, but the issue is the following : It escapes <, >, " to their URL entities (not &, ) or () You are ...
0
votes
1answer
88 views

Verifying one specific attack vector of Cross Site Scripting

Burp suggests that there is a reflection.. It changes a value of a cookie named as x as x=<script src=abc.js> and in response this value gets injected to a javascript function.. <script ...
2
votes
1answer
265 views

Using Selenium tool for xss scripts

Ok, so i need to know can Selenium webdriver tool be used for testing xss vulnerabilities and exploits. If its possible, then pleasee provide me with some example or tutorial. Apologizes, if am wrong ...
-1
votes
1answer
106 views

Cross site scripting in url? [duplicate]

I currently have a xss problem in this site. https://bbcpanningen.cupweb6.nl:1311/servlet/OMSALogin?msgStatus="><script>alert("hello") </script> But I don't understand how an ...
2
votes
2answers
151 views

Unsanitized HTML input

My school uses the website WebAssign for online math and science homework. One of WebAssign's features is a "My Notes" section that allows you to input notes for a problem and come back to it later ...
5
votes
2answers
307 views

XSS scripts in console

Well i need to know is it possible to enter xss script through console of developer's tools(e.g. : firebug of firefox)? Is this a proper way ?
2
votes
2answers
167 views

xss Scripting on clean-urls

I am learning about XSS vulnerability. I need to know what sort of XSS attack can be done on clean URLs. Clean URL example : //my url.net/project/public/#questions/question/edit/id/122/answer/1
1
vote
4answers
454 views

Can Cross site scripting lead to database access?

I wanna know that weather a site having XSS vulnerability can lead the hacker to access database? I know that he can get the username and password from the cookie stored but can he completely access ...
2
votes
1answer
175 views

Reflected XSS - Automatic understanding of filters

I'm currently facing this possible reflected XSS vulnerability on a webapp: URL = http://www.test.com/login/?login=[PAYLOAD] When a user clicks on this link, it displays a login page that includes ...
5
votes
5answers
854 views

Does setting httponly prevent stealing a session using XSS?

If a session token is stored in a cookie that has httponly set, is there any way that a XSS vulnerability could allow a malicious user to steal a users session token?
2
votes
3answers
271 views

Flash ignores Content-Type header, allowing XSS?

I recently read that the Flash plugin ignores the Content-Type header in certain circumstances. In particular, you can give Flash a URL, and the Flash plugin will happily fetch the content at that ...
3
votes
1answer
201 views

How effective is Caja at preventing XSS?

I recently found Caja which looks like an effective way of preventing XSS. From their site: The Caja Compiler is a tool for making third party HTML, CSS and JavaScript safe to embed in your ...
2
votes
3answers
514 views

Cross site scripting prevention removing &lt and &gt

I'm testing an application that only skips < and > symbols. The user input being validated is always inserted between html tags like <b>, <span>, <div>, etc. and never passed ...
8
votes
3answers
311 views

How could the string \";alert('XSS');// be used for XSS?

I was using Burp Suite for some testing and I noticed that they included the following string: \";alert('XSS');// as an attack string for an XSS payload. How could this string be used to execute ...
2
votes
1answer
597 views

How to show XSS popup without using alert and script keywords?

I have come across a field that is vulnerable to XSS. It accepts and tags however keywords script,alert, msgbox, prompt are blocked. I have tried every encoded version of these keywords but its not ...
13
votes
3answers
2k views

Cross Site Scripting without special chars

I'm testing a web application and I found a XSS vulnerability. I can break a tag and inject some code to the application but nothing potentialy dangerous for the client. The application has a filter ...
2
votes
2answers
132 views

Is it safer to store the XSRF value inside your JavaScript?

To protect yourself against XSRF, you need to have a separate token on a page. See: Coding Horror: Preventing CSRF and XSRF Attacks, by Jeff Atwood As the posting suggests, its best to have those ...
11
votes
3answers
520 views

Is stripping out < and > characters an effective way of preventing XSS?

I'm guessing that HTML encoding the input would probably be a better solution, but I'm curious if just stripping out any < and > characters would be an effective defense against XSS attacks. ...
1
vote
1answer
70 views

Benefits of Content Security Policy

I would like to know how really good is the content security policy header for preventing XSS considering the following : Many sites have inline JS / CSS. The request/ response headers can be ...
3
votes
1answer
140 views

What are good tools for CRLF discovery? [closed]

What are good tools for finding CRLF injection vulnerabilities?
7
votes
3answers
2k views

Is there a way to bypass Django's XSS escaping with “unicode”?

Django (the Python web framework) escapes output to prevent XSS (Cross Site Scripting) attacks. It replaces ', ", <, >, & with their HTML safe versions. However this presentation on slide ...
1
vote
1answer
808 views

bypass a regex filtration to perform an xss attack

Does the regex [\w/$!.*-]+$ stop the injection of payloads like : "><script>alert(4)</script> " onload="alert(4)" ...
-1
votes
1answer
238 views

can someone break my anti dom based xss from the window location? [closed]

can someone break my anti dom based xss from the window location ? function parseparameters() { var href = window.location.href; var id = href.indexOf('#'); if (id ...
2
votes
2answers
2k views

HTML encoding to protect against XSS

While going through some references about protection against XSS i found that it is a good practice to encode data (entered by users) before using it to generate a dynamic page. I was not able to find ...
1
vote
4answers
568 views

Simple solution to XSS

I've got an idea as to how to defeat XSS so simple that it may work and was wondering if anybody had already done something similar. The goal here is not efficiency but security. In other words I ...
3
votes
1answer
1k views

Is it possible to exploit XSS inside User-Agent header? [duplicate]

I've found an xss bug inside user-agent header on one popular buy/sell site , and after reporting it to them , they answered that it is not dangerous as it can not be exploited without user ...
4
votes
1answer
483 views

CodeIgniter CSRF confusion

I have been working with CodeIgniter for about 3 weeks and am very well on the way to loving this framework. However I have been looking at the core code of the framework and I was reading over the ...
1
vote
2answers
315 views

Breaking out of attribute in double quotes

I have a piece of code that allows for [url]someurl[/url] BB-Code and replaces it with <a href="someurl">someurl</a> It takes two precautions to prevent XSS. It replaces ...
12
votes
3answers
451 views

What does a HTML filter need to do, to protect against SVG attacks?

I recently learned that SVG (Scalable Vector Graphics) images introduce a number of opportunities for subtle attacks on the web. (See paper below.) While SVG images may look like an image, the file ...
3
votes
1answer
233 views

How did the Tumblr worm spread?

Recently Tumblr was hit by a fast-spreading worm. How did the worm work? What was the vulnerability in Tumblr that it exploired? Did it exploit a XSS vulnerability in Tumblr? A CSRF vulnerability ...
2
votes
1answer
196 views

Possible to execute a non-persistent XSS attack without using the url/query string?

I've been reading up on non-persistent XSS and all of the examples I have found use the situation where a webpage takes something from the url/query string and places it on the page. Is there any ...
2
votes
4answers
833 views

referrer checking as a defence for XSS attack

After reading the question about referrer and the answer of @D.W., I did not understand the following part: XSS defense. Strict referer checking can make reflective XSS attacks harder, because ...
2
votes
4answers
1k views

What XSS attacks doesn't “Reflective XSS Protection” defeat?

Its been quite a while since I have played with cross site scripting vulnerabilities but today I came across a website today that was crying out to be tested for a basic XSS vulnerability. So ...
0
votes
1answer
894 views

How to escape user input in a value of javascript object?

How to properly escape user-controlled input when it's inserted as a value in JSON object? <script> $(document).ready(function() { new MyObject({ key1: "user_input", key2: ...
4
votes
2answers
174 views

filtering content in Content disposition header

I was reading "The Tangled Web"(A book that I'm enjoying very much) and I have a doubt in the following excerpt taken from it :- When Handling User-Controlled Filenames in Content-Disposition Headers ...
4
votes
2answers
423 views

CSRF Protection on static pages

I have a static site which has forms. The forms submit to a Rails endpoint which captures the submitted data. The static site and the Rails endpoint are on the same domain, on different subdomains and ...
2
votes
5answers
3k views

Efficient way for finding XSS vulnerabilities?

Manual (reliable) way: Put string containing characters that have special meaning in HTML into some parameter of HTTP request, look for this string in HTTP response (and possibly) in other places ...
5
votes
5answers
3k views

XSS : Blacklist characters vs. whitelist

I have been studying to prevent my web app against XSS. I read about it on OWASP and other security channels, they all say that use ESAPI and similar library, and also do input filtering through ...