Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS), DOM-based XSS (aka client side XSS).

learn more… | top users | synonyms

1
vote
3answers
318 views

How can I bypass double quotes in a attribute based xss attack

The code that I have is: <input type="text" name="some_name" value="<?php echo CHtml::encode($str); ?>" /> $str is the input data. 'CHtml::encode()' is Yii's way of encoding special ...
2
votes
3answers
85 views

Flash cookie and man-in-the-middle

I am using the Scala Play web framework. In it, there is a PLAY_FLASH cookie used to flash messages to the user (it's a cookie so it will still work after several redirects). I put HTML in the cookie ...
-1
votes
1answer
52 views

<,>,/ etc symbols are getting escaped while trying for xss,anyother alternatives for these symbols to carry out the attack successfully?

Symbols like >, <, / etc are getting escaped any alternative to carry out the xss attack ? most of the websites are having xss filters
1
vote
3answers
140 views

What is Reflected XSS?

Fed up with the following definition. Reflected attacks are those where the injected script is reflected off the web server, such as in an error message, search result, or any other response that ...
0
votes
2answers
159 views

Security issues in “Remember Me” function code example

I'm a beginner, and these may be very obvious for you, but I'm trying to understand if there are security issues with this example. Today on Stack Overflow, I saw the following post: PHP Sessions ...
0
votes
2answers
81 views

How the address bar manage the XSS?

I was playing with OWASP Mutillidae II and in one page I've found one vulnerability. In the address bar I've wrote something like : ...
3
votes
2answers
169 views

Exploiting XSS with window.name without iFrame

I know XSS is possible if the window.name is echoed onto the page, but from my understanding, this requires you to use an iFrame, but what if the page has clickjacking protection, stopping the page ...
9
votes
1answer
495 views

XSS Technique - & JavaScript Include

I was looking through the OWASP XSS Filter Evasion Cheat Sheet, and there was one technique that was completely new to me: & JavaScript includes <BR SIZE="&{alert('XSS')}"> I ...
1
vote
1answer
105 views

Could I XSS a page that filters &,",< and > characters and has Content-Type set to UTF-8?

I am trying to pentest a dummy website that has a form with a TEXTAREA input on one page. When the form is submitted, the contents of the form are displayed on a second page. However, the second page ...
1
vote
3answers
74 views

Session Fixation - Setting path to root without /

I have found an XSS vulnerability on the subdomain of a site I am testing, and using it I can set cookies for both the main site and all it's subdomains. My url currently looks like this: ...
2
votes
2answers
214 views

Is there a need to have XSS filters when I'm saving data as XML?

My web-app takes some configs from the user and saves into an XML file (it was not done to stop XSS). The input is XML encoded so that the ",& ... and such characters don't break the XML ...
1
vote
1answer
48 views

XSS attack remediation in older technologies

My application is vulnerable to XSS attack. Technology used in the application are Servlet 2.2, JSP 1.1, Jdk 1.3, WAS 4.0. I wanted to remediate XSS vulnerability with migration of technology or ...
1
vote
2answers
141 views

XSS in HOST header

I'm able to inject JavaScript payload in HOST header, a request will look like: Host: <script>alert(document.cookie)</script> User-Agent: Mozilla/5.0 Gecko/20100101 Firefox/29.0 Cookie ...
0
votes
1answer
97 views

Flash Objects SWF security (ExternalInterface.call)

I am performing a penetration test against a website that uses Flash. I found this piece of code: url = ExternalInterface.call("window.document.location.href.toString") as String; How it can be ...
-1
votes
2answers
103 views

Content sniffing XSS attack?

As a part of work, I've come across content sniffing, and i understand web apps can be vulnerable to xss because of it. There is another post, regarding content sniffing and xss, but didnt quite ...
0
votes
1answer
456 views

OWASP Zap proxy Fuzz XSS pentest against REST API

I am looking to PEN test my application against XSS attacks. The application is a REST API... As such when you POST some JSON to /cart/add to see the result of that attack you would need to GET ...
0
votes
1answer
90 views

An XSS attack is working on Firefox but not on Chrome..Suggest changes to make it work on Chrome

I am able to inject this: http://domain.com/search/songs/<img src='alert(document.cookie)' onerror='alert(document.cookie)'> to the page HTML. The onerror event is giving me the cookie on my ...
4
votes
3answers
180 views

What can we do with non persistent XSS vulnerabilities?

Sorry for this stupid question but i'm thinking about what an attacker can do with a non persistent XSS attack on a website? An attacker can try to phish me with a malicious url, steal my cookies or ...
1
vote
1answer
85 views

Is it safe to call an untrusted service with jquery.ajax and dataType 'jsonp'

From what I understand, the JSON-P technique generates a script tag into the DOM of an HTML page to get across the single-origin restrictions imposed on the XMLHttpRequest JavaScript API for AJAX ...
-1
votes
4answers
187 views

Software for web hacking? [closed]

I want to learn sql injection, xss and other web attacks. I am new to all this, just a beginner. I want to know which software to use. Can I use Windows for these attacks ...
1
vote
2answers
214 views

XSS with input in onclick attribute

If I have... <table onclick="texttexttexttextUSERINPUTHERE"></table> Would XSS be possible? I mean with > and " filtered out. I know if there wasn't text behind the user input, you could ...
0
votes
2answers
91 views

trying to xss a site [closed]

http://XXX/?subscribe_message=%3Cscript%3Ealert(/zzz/);%3C/script%3E Why doesn't that popup with a /zzz/ alert? When I do javascript:alert(/zzz/); in the address bar it does so why not when I do it ...
1
vote
3answers
96 views

Perform XSS on a link where image path is passed in querystring

I have a page on my website like this : domain.com?img=test.jpeg And on the page, the javascript written is: var imgPath = getQuerystring('img'); $("#img").attr('src','/Images/' + imgPath); I was ...
2
votes
1answer
131 views

XSS - history stealing

I am little confused about this matter. By simply writing a JavaScript code we can go through our browser history and identify visited links. It is fine. But how an attacker use this to identify a ...
6
votes
2answers
1k views

Is this an XSS vulnerability?

My company recently had a security assessment done on our website and we had a XSS vulnerability reported. Below are the details of the reported vulnerability: If a user hits a URL like the one ...
3
votes
2answers
258 views

Learning XSS: Why is my javascript ignored?

<a href='mailto:</a><script>/*'></a><script>/*</a>: <br> <hr> <a href='mailto:*/location.href=/*'>*/location.href=/*</a>: <br> ...
0
votes
1answer
108 views

Understanding Same origin policy

I am trying to understand same origin policy better. From what I understand same origin policy restricts code from one "origin" not access data from another "origin". What I am trying to understand is ...
1
vote
0answers
86 views

How did the Tweetdeck XSS Vulnerability work

How exactly did the recent TweetDeck vulnerability work? It says here that it had something to do with the HTML heart character but I don't fully understand what the explanation means. From the link : ...
3
votes
1answer
418 views

How should I mitigate the XSS vulnerabilities in KnockoutJS described at mustache-security?

The site Mustache-Security describes XSS vulnerabilities in KnockoutJS... The vulnerabilities come from the use of eval (or some equivalent) to convert text in the data-bind attribute to executable ...
8
votes
3answers
1k views

Allowing users to input a safe subset of HTML

I recently posted this question on Code Review and it was recommended that I ask you guys about it. Basically, this will be used to allow users to generate formatted content. It gets put inside of ...
1
vote
0answers
93 views

XSS Vectors for new Image()

What are possible XSS vectors to this JavaScript code new Image().src = encodeURI('[user url here]'); Let's assume two cases: [user url here] is some string provided by user (with no validation) ...
2
votes
3answers
645 views

Why are scripts injected through innerHTML not executed whilst onerror and other on<event> attributes on elements are? - Google XSS Challenge 2

SPOILER ALERT : Do not continue if you do not want to be spoiled I am currently doing the Google XSS Challenge Level 2 . I am injecting XSS code that is inserted into the document using ...
0
votes
2answers
124 views

Javascript injection via document.cookie possible?

Let's say someone rooted a site, is it possible for the attacker to do XSS via document.cookie? Instead of giving the user a name=value, the attacker does something like this ...
2
votes
2answers
156 views

Is XSS through style attribute possible in modern browsers?

Let's say users can define content of the style attribute, but in a constrained way. They can't break out of its value, as white-listing parser will remove any unsafe attributes/tags produced this ...
3
votes
4answers
498 views

How is this XSS attack working?

SPOILER ALERT: This question contains an answer to one of the problems from the Google's XSS Challenge! Please stop reading further if you're not interested in knowing the answer right now. I'm ...
0
votes
1answer
76 views

XSS vulnerabilities: how much are they dangerous?

Lot of articles underline that XSS vulnerabilities can be very dangerous for the website on which they exist. I wonder how much is this true when we find these XSS vulnerabilities on the frontend of a ...
0
votes
2answers
175 views

Way to decode an encoded payload [closed]

I am facing an XSS vulnerability in my ASP.Net Web application where the malicious code may be encrypted and html encoded Bottomline: I am trying to prevent XSS via code obfuscation. Question: I ...
1
vote
1answer
168 views

CSRF Token Stealing

I came across this link that dicusses how an attacker could exploit access control allow origin to get an anti-CSRF token: ...
2
votes
3answers
129 views

XSS prevention by black-listing

I have a reflected XSS vulnerability in my Web application. I have decided to take the black-list approach instead of the popular white-list approach. My question is can there exist a malicious ...
1
vote
1answer
149 views

How to prevent XSS when transferring web page content within XML

I have an ASP.NET web application which uses HTTPS and XML based request-response. It seems a user's session cookie can be retrieved via XSS, if the request/response is intercepted and malicious ...
2
votes
2answers
353 views

XSS in HTML meta tag

There is a web application which contains a search function. When I search for aaaaaaaaxss I get this: <meta property="the:property" content="100 Results for aaaaaaaaxss (Page 1)" /> It strips ...
1
vote
0answers
205 views

XSS in HTML title tag without forward slash

I am trying to find out whether this is vulnerable against XSS: I can control the content of the title tag through the URL. This would make the site vulnerable if it wasn't for the fact that the site ...
2
votes
2answers
526 views

Content-Security-Policy hash of script

<?php header("Content-Security-Policy: default-src 'sha256-".base64_encode(hash('sha256', 'console.log("Hello world");', true))."'"); ?> <script>console.log("Hello world");</script> ...
-1
votes
3answers
146 views

Find and solve XSS in this code

I need to find a XSS and propose a solution in the following code: <form action="#" method="post"> <input type="hidden" name="id" value="<?=$id?>"><br> <textarea ...
0
votes
3answers
152 views

How to leverage a stored XSS to perform a file inclusion?

I have identified a stored XSS and I'm wondering, how could I leverage that vulnerability to upload a shell.
3
votes
2answers
126 views

Webapp vulnerability scanner that understands continuations

I'm researching XSS vulnerabilities in a web application which uses continuations. That means that for a given form, the URI the form data is posted to is unique and different every time. A first GET ...
5
votes
4answers
859 views

Suggestions to avoid cookie-hijacking in a web application

I've been developing web-apps for quite some time now. While making websites, the "remember me" feature is one of the most trivial(read as must-have-for-clients) feature to be implemented. Until ...
1
vote
1answer
186 views

Content sniffing XSS vulnerable browsers

In order to prevent Cross-site scripting (XSS) in a private web application that supports image upload, I intend to reject browsers that are vulnerable to content sniffing. Which browsers are ...
0
votes
2answers
123 views

Can running a script while logged in compromise my facebook password?

In websites related to facebook malware analysis and information, we often see messages to the effect of if you have run this facebook app then your account has been compromised, or if you went to ...
1
vote
2answers
902 views

Is cross site scripting possible with the img alt attribute?

My question is, if any characters are allowed in the alt attribute of an img tag (except for double quotes), is XSS possible? Valid image or not.