Questions tagged [xss]
Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).
214
questions
92
votes
4
answers
19k
views
How does XSS work? [closed]
I have very little experience in web development, but I'm interested in security. However, I haven't fully understood how XSS works. Can you explain it to med? The Wikipedia article give me a good ...
- 1,039
32
votes
7
answers
9k
views
Filter user input before the database or upon display?
Given a web application where user data must be properly escaped to avoid XSS, is it better to try to remove the "bad stuff" before it enters the database, or is it best to allow it in the database ...
- 4,968
33
votes
2
answers
15k
views
XSS prevention through Content Security Policy
How can Content Security Policy (CSP) significantly reduce the risk and impact of XSS attacks in modern browsers?
Is it possible to circumvent CSP in order to execute XSS?
- 4,844
17
votes
2
answers
15k
views
UTF-7 XSS attacks in modern browsers
I've recently read Ned Batchelders article on UTF-7 XSS-attacks. I tested his examples, but could not get any UTF-7 attack to work in modern browsers. I tried recent versions of Firefox, Chrome and ...
- 365
53
votes
2
answers
24k
views
Will same-site cookies be sufficient protection against CSRF and XSS?
I must say, that I like this idea and it seems that it will bring a new form of protection against CSRF and XSS or at least it will reduce those attacks.
So, how effective will this protection be?
...
- 10.2k
22
votes
1
answer
7k
views
Does the practice of blocking an off-site "Referer:" HTTP requests improve website security?
Is there any benefit for a security-paranoid website to disallow HTTP requests that have a Referer: from 3rd party sites?
The pitch is that if such a HTTP request were to come in, then certain XSS ...
- 50.9k
12
votes
4
answers
15k
views
PHP functions for preventing XSS
Is there a proven library with functions for preventing XSS attacks? Many people don't realise that htmlspecialchars is not enough to prevent XSS attacks. There are various contexts that need their ...
- 601
115
votes
9
answers
34k
views
Why is it dangerous to open a suspicious email?
I would like to know why is it considered to be dangerous to open an email from an unknown source?
I am using Gmail and I thought it's only unsafe to download an attachment and run it.
The first ...
- 1,341
2
votes
1
answer
10k
views
XSS payload without using < and >
I am performing testing on a site that takes input from the user and places it between <span> and </span>. However, < and > from the user are encoded as < and >. Is ...
- 121
101
votes
8
answers
118k
views
What could an "<img src=" XSS do?
Most WAFs when blocking XSS will block obvious tags like script and iframe, but they don't block img.
Theoretically, you can img src='OFFSITE URL', but what's the worse that can happen? I know you ...
- 1,053
56
votes
5
answers
23k
views
IMG tag vulnerability
Is it safe to display images from arbitrary domains? I.e. let's say I have an image on my page:
<img src="http://badguy.com/image.gif" />
What if image.gif will return some js attack vector, ...
- 2,847
20
votes
5
answers
21k
views
Does setting httponly prevent stealing a session using XSS?
If a session token is stored in a cookie that has httponly set, is there any way that a XSS vulnerability could allow a malicious user to steal a users session token?
- 8,195
11
votes
4
answers
4k
views
Is XSS possible when < is not escaped, but also removed if followed by a character?
I have figured out that < wasn't encoded as <.
However it is removed if followed by anything but a blank space. For example, <a will get removed but not < a> (note the space), which ...
- 2,924
3
votes
1
answer
22k
views
exploiting XSS in jQuery selector
My static code analyser flags this piece of Javascript on my client's web site as a potential DOM based XSS:
var x = $('#' + window.location.hash.substr(1))
x.addClass('highlighted').find('div').show(...
- 1,331
2
votes
1
answer
15k
views
Bypassing <, > XSS filter
<img class="avatar" src="MY INPUT SPACE">
I am trying to bypass an XSS filter but it is not working since given <, > are filtered. I feel like it I could break it since only these two ...
- 33
21
votes
4
answers
21k
views
What is the danger of Reflected Cross Site Scripting?
What is the danger of Reflected Cross Site Scripting?
I understand the Reflected XSS is dangerous, because it's possible. But what practical attacks can be performed using Reflected XSS?
- 54.4k
17
votes
1
answer
29k
views
Preventing XSS for REST API
I have a spring REST API and a client project. Client projects' HTML page uses jquery ajax calls to fetch data from REST API using json or xml format. My question is to avoid XSS attacks on a web page,...
- 281
15
votes
3
answers
7k
views
How serious are XSS attacks
A website I visit allows this kind of attack, to be implemented with GET in the URL
<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
Along with many others on this page: http://ha.ckers....
- 259
14
votes
3
answers
26k
views
Is it possible to inject HTML into image to provoke XSS?
Some answers mention that it's possible to inject attacker-controlled HTML into images and therefore provoke XSS.
I guess that this HTML will be processed by browser only if hole exists in browser. ...
- 5,397
10
votes
7
answers
30k
views
Current best practices to prevent persistent XSS attacks
I have a text field that allows the user to type whatever he/she wants. After saving, the results are later displayed on the screen to potentially many people.
XSS seems a bit like black magic to me,...
- 557
8
votes
1
answer
4k
views
XSS inside HTML attribute where < and " are filtered
Is it possible to bypass an XSS filter where < and " are encoded as < and ", but > is not escaped?
My data is injected into an HTML value attribute. However I can't get out of ...
- 787
7
votes
2
answers
22k
views
HTML encoding to protect against XSS
While going through some references about protection against XSS i found that it is a good practice to encode data (entered by users) before using it to generate a dynamic page. I was not able to find ...
- 7,457
5
votes
1
answer
2k
views
Style attribute XSS without quotes
If there is a page that allows user input into the following...
.page
{
background: #userinput;
}
can it be exploited if <>'" are all filtered? I've seen width: expression(alert(0));, but ...
- 751
5
votes
1
answer
7k
views
Is it possible to exploit XSS inside User-Agent header? [duplicate]
I've found an xss bug inside user-agent header on one popular buy/sell site , and after reporting it to them , they answered that it is not dangerous as it can not be exploited without user ...
- 1,452
4
votes
3
answers
2k
views
Flash ignores Content-Type header, allowing XSS?
I recently read that the Flash plugin ignores the Content-Type header in certain circumstances. In particular, you can give Flash a URL, and the Flash plugin will happily fetch the content at that ...
- 99.6k
2
votes
2
answers
4k
views
XSS via REQUEST_URI
Is there any situation where an XSS attack can be performed via the PHP $_SERVER['REQUEST_URI'] variable? For those unfamiliar with it: It contains the complete URL used to access that website, ...
- 29.6k
2
votes
2
answers
44k
views
XSS with URL encoding
If a website URL gets encoded then is the website still vulnerable to XSS or no?
For example, if I try <script>alert(1)</script> and the site URL encodes my payload to %3Cscript%3Ealert(1)...
- 61
-1
votes
1
answer
1k
views
Why isn't this code running? [closed]
I found an area on a site (can't disclose name) that allows you to put input, and returns it in this form:
<p>
<strong>text here</strong>
</p>
It isn't filtered, so you ...
- 491
56
votes
2
answers
30k
views
Is including the data scheme in your Content Security Policy safe?
I have a Cordova app that transforms some images to base64. This violates CSP with this message:
Refused to load the image
'data:image/svg+xml;charset=US-ASCII,%3C%3Fxml%20version%3D%221.0%22%20encod…...
- 665
50
votes
2
answers
12k
views
How do I use Markdown securely?
How do I use the Markdown library safely? What do I need to do to make sure that its output is safe to include into my web page?
I want to allow untrusted users to enter content (in Markdown format)....
- 99.6k
50
votes
5
answers
10k
views
New XSS cheatsheet? [closed]
There is a great list of XSS vectors avaliable here: http://ha.ckers.org/xss.html, but It hasn't changed much lately (eg. latest FF version mentioned is 2.0).
Is there any other list as good as this, ...
- 1,135
26
votes
5
answers
52k
views
What is Reflected XSS?
Fed up with the following definition.
Reflected attacks are those where the injected script is reflected off the web server, such as in an error message, search result, or any other response that ...
- 363
22
votes
6
answers
16k
views
Is Chrome completely secure against Reflected XSS?
I notice that Chrome does not execute scrips that are part of the web request,
http://vulnerable_site?pageTitle=<script>alert('xss')</script>
With such links since the script is as part ...
- 305
18
votes
4
answers
3k
views
Web Security Cheatsheet / ToDo list
Can anyone suggest a cheatsheet or ToDo list of web site and application security?
A local small business owner prompted a question about web security, basically her company website just got XSS ...
- 283
14
votes
4
answers
22k
views
Is XSS possible with jQuery(location.hash)?
Is it possible to exploit XSS in the following code?
jQuery(window.location.hash)
It seems to me that window.location.hash always starts with a hash #, and modern jQuery always interpretes this as ...
- 30.6k
14
votes
7
answers
4k
views
Whitelisting DOM elements to defeat XSS
As we know, developers are responsible for correctly escaping/validating data provided by the user before rendering or storing them. However, we must agree that it's relatively easy to forget a single ...
- 197
14
votes
1
answer
7k
views
Cross site scripting and the use of http-only cookies?
I have been a developer and now I am trying to look at XSS from the point of view of a developer. I was thinking of a particular case of reflected XSS . Let us say we have a vulnerable website and if ...
- 7,457
13
votes
1
answer
21k
views
Does Google Chrome protect against cross site scripting (XSS)?
In Firefox I've been using the NoScript extension to protect myself from certain kinds of malware attacks. NoScript is well known as a very powerful extension for Firefox and introduced protection ...
user10356
11
votes
2
answers
3k
views
How reliable is ASP.NET's Request Validation feature?
ASP.NET offers an extra layer to protect your application from XSS attacks and injection in general which is called Request validation.
On their official topic, they mention that:
Even if you're ...
- 3,202
10
votes
2
answers
21k
views
Why are scripts injected through innerHTML not executed whilst onerror and other on<event> attributes on elements are? - Google XSS Challenge 2
SPOILER ALERT : Do not continue if you do not want to be spoiled
I am currently doing the Google XSS Challenge Level 2 .
I am injecting XSS code that is inserted into the document using element....
- 2,431
9
votes
2
answers
19k
views
What is the difference between ordinary XSS and Dom XSS vulnerabilities? [duplicate]
I'm not a computer guy, but just out of curiosity I've recently started to learn PHP for programming my own website and I've read about some most common vulnerabilities that exist in web applications. ...
- 193
9
votes
1
answer
2k
views
Proper way to protect against XSS, when output is directly into JS not HTML?
I'm seeing plenty of examples when the output is going into HTML directly, but I'm seeing more conflicting information when the output is going straight into JS.
For example if the code was:
var ...
- 93
7
votes
2
answers
23k
views
How to prevent XSS from url
I found an XSS vulnerability which is exploited by appending attack in the URL parameters.
For eg. the original URL site.com/?s=login&m=forgotten
And the attack URL site.com/?s=login&m=...
- 183
6
votes
2
answers
5k
views
XSS - arbitrary file in background-image css property
Is it possible to make an XSS attack if you can inject an arbitrary file (any extension, like: .js, .html etc...) in background-image CSS property? If yes, how to do it?
- 63
6
votes
3
answers
26k
views
How can I control the content of the HTTP HOST header in requests issued from my website?
Is anyone familiar with a way in which I can post a link on my website, that when accessed will cause users to issue an HTTP request to a 3rd party site with custom content in the HOST header (...
- 561
5
votes
1
answer
7k
views
Does a Content-Type: text/plain header protect against XSS in browsers?
I'm creating a small web script that mostly redirects the browser but has some error conditions when input parameters cannot be validated.
I'd like to display error messages like parameter XXX had ...
- 673
4
votes
2
answers
35k
views
XSS payload without - &<>"=()
Is it possible to construct a XSS payload without the use of these chars - &<>"=()? The server is not doing any output encoding.
Consider both the cases where the user input is being put into ...
- 571
2
votes
2
answers
3k
views
Reflected XSS quote not encoded
I am attempting to exploit URL with a reflected XSS as follows:
http://domain.com/vuln_parm=
The contents of vuln_parm gets returned to the user as follows:
<div attrib1="" attrib2="" vulnattrib=...
- 39
1
vote
1
answer
939
views
Bypass a simple XSS filter that only looks at <
Say, I have a page where the input from the user is taken and is passed through a simple client-side XSS filter. That filter only replaces < characters with ''.
in = in.replace(/[<]/g, '');
...
- 223
1
vote
3
answers
7k
views
Reflective XSS in script codes with Content Type "text/javascript"
I have a webpage that returns raw script code with the headerContent-Type: text/javascript. However I found that there is a reflective xss in one of the parameters passed to the url which is copied ...
- 111