Tagged Questions
16
votes
4answers
897 views
IMG tag vulnerability
Is it safe to display images from arbitrary domains? I.e. let's say I have an image on my page:
<img src="http://badguy.com/image.gif" />
What if image.gif will return some js attack vector, ...
3
votes
4answers
303 views
how can you inject malicious code into an innocent-looking URL?
I am learning about XSS attacks. Wikipedia says that in a non-persistent attack an attacker may provide an innocent-looking URL that "points to a trusted site but actually has an XSS vector." What ...
1
vote
1answer
258 views
bypass a regex filtration to perform an xss attack
Does the regex [\w/$!.*-]+$ stop the injection of payloads like :
"><script>alert(4)</script>
" onload="alert(4)"
...
3
votes
1answer
1k views
DOM Based XSS attacks: what is the most dangerous example?
I knew that XSS attacks (“non-persistent” and “persistent”) can hijack user session, deface websites, conduct phishing attack, etc.
However, I can't understand what is dangerous of DOM Based XSS if ...
2
votes
4answers
851 views
What XSS attacks doesn't “Reflective XSS Protection” defeat?
Its been quite a while since I have played with cross site scripting vulnerabilities but today I came across a website today that was crying out to be tested for a basic XSS vulnerability.
So ...
5
votes
1answer
141 views
Where does the responsibility lie for a XSS vulnerability
I am an avid user of Workflowy (online outliner/note taking tool) and I installed the Chrome extension 'Workflowy for Coders', which formats the text within notes.
I discovered that one of my notes ...
3
votes
2answers
214 views
Risks of serving untrusted content under HTTP Content-Type: text/plain?
Am I gonna run into XSS attacks by doing this, or will a file download be prompted?
Are there security problems that would rise in a modern browser?
2
votes
1answer
2k views
Does Google Chrome protect against cross site scripting (XSS)?
In Firefox I've been using the NoScript extension to protect myself from certain malware attacks. NoScript is well known as it's a very powerful extension for Firefox and introduced protection from ...
4
votes
4answers
5k views
Security issues using iframes
We are looking to move to iframes due to technical challenges. By moving to iframes it will be easier to manage the technical issues. But we are not totally sure of security implications of iframes.
...
12
votes
5answers
1k views
Solution to allow JavaScript input but prevent XSS
We have a simple Blog system that allows users to input html and JavaScript to build a blog page. I'm aware that allowing javascript open up the door to xss attacks. We do however need to allow users ...
3
votes
3answers
294 views
Is Content Security Policy an approach that is worth to support?
Mozilla Firefox 4.0 supports something called Content Security Policy that disables the interpretation of embedded Java Script. Only external Java Script files that are referenced using a script tag ...
3
votes
3answers
271 views
Protecting websites from outdated browsers and plugins via a whitelist/blacklist combination?
Aside from using browser headers, I want to blacklist/whitelist browser and plugins from my site so that I can prevent these older unpatched systems from (1) being a general user of my site (2) ...
