Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

learn more… | top users | synonyms

2
votes
2answers
71 views

Why do I have to do manual XSS testing in addition to using tools such as Burp Suite/XXSer/Xenotix?

At what point does manual testing for XSS come preferred to an automated attack like one through Burp Suite? Looking through bug bounties and various exploits and it's not clear where there is a ...
1
vote
1answer
93 views

XSS works when I save generated HTML to file, but not directly in browser

The hints of XSS game's level2 say that Entering a tag on this level will not work. Try an element with a JavaScript attribute instead. When entering <script>alert(1)</script> ...
-1
votes
1answer
76 views

Svg width element XSS

I'm working on a svg image generator. Now I want to set the user width and height value. Can a user exploit this element tags? And what should I do to make this secure? <?php $user_input = $...
-1
votes
1answer
81 views

Can this prevent XSS?

In PHP, I've always used this to represent inputs and textareas: $foo = trim(htmlentities($_POST['foo'], ENT_QUOTES); // the trim is to prevent empty submissions Can it also be valid to prevent SQL ...
0
votes
1answer
44 views

Site stores cookie name and user id in script tag after login. Is this an issue for either xss or session highjack?

Upfront I will say that this is not my website and that I am simply doing a general audit (for non security issues), but ran across this in the source after logging in. Another script tag for ...
9
votes
4answers
352 views

Is XSS possible when < is not escaped, but also not displayed if followed by a character?

I have figure out that < wasn't encoded as &lt;. Instead of that, it is simply not sent by the server if it is directly followed by something. For example, <a will display nothing. But I'm ...
3
votes
2answers
188 views

Can you exploit an XSS vulnerability on one page to run code on another page?

Lets say that page A is vulnerable to XSS, but contain nothing of interest to an attacker. Page A links to page B that is not vulnerable to XSS, but contains a high value target for an attacker (such ...
0
votes
1answer
61 views

Null byte injection to run PHP?

A website accepts form input and outputs it to the screen, but replaces every <? to <--? turning them to comments. Let's say I POST the following: <?php echo "xy"; /* arbitrary php code */ ...
3
votes
2answers
153 views

Preventing Browser from BeEF Exploitation

BeEF is a great exploitation Browser based tool. But in some cases, unknowingly people get Hooked due to beef when it's hook.js is kept in Invisible Iframe of an HTML source. So How, can we detect ...
2
votes
1answer
73 views

How and why does case insensitive XSS work, given that JavaScript is case sensitive?

I found a lot of instances where XSS scripts like the following work: <iMg SrC=x OnErRoR=window.location=123> Given that JavaScript is a case sensitive language, how is the browser able to ...
3
votes
1answer
205 views

Will same-site cookies be sufficent protection against CSRF and XSS?

I must say, that I like this idea and it seems that it will bring a new form of protection against CSRF and XSS or at least it will reduce those attacks. So, how effective will this protection be? ...
0
votes
0answers
28 views

Executing JS script in Bootstrap popover without “<” and “>” characters (XSS) [duplicate]

In the system that I am working on I have a simple form. In the form there is an input called "ID". The contents of the input is than displayed in a Bootstrap popover (after clicking the "i" icon) ...
0
votes
2answers
102 views

How to detect XSS in GET requests?

How to detect XSS in HTTP/1.1 GET requests? A request can be malicious and I want to know how to detect if the GET request to a server is trying to XSS my website?
5
votes
4answers
437 views

Is it safe to redirect to URL parameter without filtering?

A webpage redirects to an URL given in parameter redirect without filtering it, like this: $newURL=$_GET["redirect"]; header('Location: '.$newURL); login.php?redirect=home.php If it echoes the ...
2
votes
2answers
80 views

XSS on a single page web application

I'm practicing stored XSS attacks on my vulnerable single page web application. I want to achieve some kind of DoS attack, where the page keeps reloading from the server. I can easily inject window....
0
votes
1answer
48 views

XSS between tags when only < and > are encoded? [duplicate]

Let's say we have <span></span>. Our website takes the value of a query parameter and adds it between the tags so we have <span>Hello!</span>. If we sanitize the parameter by ...
2
votes
1answer
95 views

Bypass char filtering - security shephard

I'm stuck in the XSS part of the security shephard OWASP app. I am not looking for someone to tell me the solution, I just need to learn how to find it myself, I'm a bit rusty on XSS. So what I know ...
1
vote
1answer
482 views

exploiting XSS in jQuery selector

My static code analyser flags this piece of Javascript on my client's web site as a potential DOM based XSS: var x = $('#' + window.location.hash.substr(1)) x.addClass('highlighted').find('div').show(...
8
votes
3answers
989 views

Is a HTML form tag more exploitable than a HTML link in user submitted content?

I have a content editor in a web application which allows administrators to add and edit content in certain areas of the application. The editor component I have used automatically removes any script ...
3
votes
1answer
101 views

Is it possible for XSS to occur in src attribute?

I'm working on XSS vulnerability and understanding it. I know in following cases cross site script injection happen in Javascript context Inside <script> tag. Inside html tag in event handler ...
4
votes
2answers
90 views

Why would a modern browser allow internal resources to be loaded from an external page

Recently someone announced that several Arris surfboard models lacked any form of authentication to perform functions such as reboot and factory reset a modem with a single http call. Read more on ...
3
votes
1answer
37 views

Exploiting an XSS vulnerability

This question is related to a class project involving a team of 2 students against another team of two students. We both have servers with a default plugin that we have a week to patch vulnerabilities ...
-2
votes
1answer
81 views

Clicking a lot of website links in Google Maps, then sent through multiple URL redirects, and lastly to a page that made my laptop start beeping?

I was in Google maps clicking on all the website links listed in the side panel, looking at every website really fast. Note, they were all tattoo parlors. One of the links I clicked bounced me through ...
3
votes
2answers
143 views

Can CSRF protection work even if an XSS vulnerability exists?

Need for CSRF protection that withstands an XSS attack One of the big dangers of XSS is that it can often bypass CSRF protection and thus perform any action the victim can perform. If it would be ...
1
vote
1answer
184 views

Is JWT in cookies with any CSRF solution just as vulnerable to XSS as JWT in localStorage?

I've read that JWT tokens shouldn't be stored in localStroage because XSS attacks can read them. The proposed solution is to store JWT tokens in HTTPOnly cookies and use anti-CSRF w/ double-submit ...
0
votes
0answers
72 views

Using phpinfo() to get httponly cookies?

phpinfo() shows all cookies, even the httponly. So the question is - how can I receive users cookis on target website through xss with phpinfo? The xss will contain code that will open phpinfo page in ...
0
votes
3answers
128 views

Typical 'search box' XSS attack

When I develop a site, I'm always conscious of security flaws, but I'm struggling to see how a search box could ever be used to inject script that could be ran on a page of mine. So I understand that,...
-1
votes
1answer
36 views

Is this XSS filter safe or not?

I have a classified site, I was wondering if this is secure enough or not, between I got this filter from a friend of mine. var a = window.location.hash.replace(/[^\w\-#]/g, "_"); a = a + "....
1
vote
0answers
97 views

Can an attacker bypass this DOM XSS filter? [closed]

I'm not asking to break someone's security, but can an attacker bypass this filter? What should I add to secure it more or it is enough? var target = window.location.hash.replace(/[^\w-_]/g, ''); $('...
2
votes
1answer
99 views

Is this a secure method for dynamically setting X-Frame-Options? (multiple domains)

X-Frame-Options header will prevent your site from being iFramed by other domains. On browsers that accept the ALLOW-FROM directive you are limited to specifying only a single origin. You could use a ...
1
vote
2answers
67 views

XSS in GET request not decoded on backend

So I am pretty sure I know the answer to this question but I want to be 100% sure so I am looking for some input here. A vulnerability was reported to a site of mine that looks something like this: ...
1
vote
3answers
79 views

Safely downloading user submitted content

TL;DR We save the request payload and Content-Type header in a database. It should be JSON or CSV but may be malformed. Support users download the request payload as a file in their browsers using ...
1
vote
1answer
61 views

Stealing user cookies with flash/actionscript

I know I am asking a dumb question here, but pardon me, I am learning. I found two questions viz, How do I access cookies within Flash? and How to Make a button send an email using AS3 automatically....
4
votes
1answer
97 views

Is this sanitization method secure?

I implemented this sanitization fix: function san($str, $type="full") { switch ($type) { case "full": $str = preg_replace("/[^a-zA-Z0-9_\-]/i", "", $str); break; ...
2
votes
3answers
92 views

Unable to upload a file on xss vulnerable page

I was wondering, if I have a php script, which could upload a file, What if I inject it in a page which is vulnerable to Xss. So, I created one and Here is the code of index.php <html> <...
3
votes
2answers
222 views

How can I execute a XSS when a web application transforms a data from lowercase to uppercase?

I'm testing a web application, when I send an input data to web application, this places the data in an onlcick function, something like this: <a href="#" onclick="someFunction('dataFromServer', '...
3
votes
2answers
90 views

Does DOM XSS work on pages that don't use js?

Can an XSS attack be done on a static page that doesn't use any JavaScript?
3
votes
1answer
77 views

How to prevent data from Interception?

I am a web developer. A few days ago, I used Burp, to intercept facebook's official App over network, by setting up proxy. I noticed that the data was encrypted. While I have been using Json to ...
1
vote
1answer
142 views

Setting the HTTP header X-Frame-Options DENY for static assets

I am checking the security of my Django application through a security scanner and I wonder if it useful to set the X-Frame-Options DENY header on static assets like CSS, images or JS files? I guess ...
4
votes
2answers
191 views

Why are cookies considered more secure against XSS?

This article discusses storing session tokens in a cookie vs in localStorage: https://stormpath.com/blog/where-to-store-your-jwts-cookies-vs-html5-web-storage/ The article states: Cookies, when ...
0
votes
1answer
68 views

XSS from image upload - does cropping solve most issues?

I am testing an image uploader but I'm a mere developer. Here are the main points to consider: There are no extension checks. The image is uploaded to memory. It is modified to be a certain size (...
3
votes
1answer
86 views

PHP - Is it safe to file_put_content raw HTML?

I'm planning to create a website to let people edit/customize their stories. Let's say the stories will store a lot of html tags ( paragraph, images & video ) I'm thinking using some javascript ...
-1
votes
1answer
187 views

XSS in hidden inputs [closed]

I have some cases of XSS in input fields when the type is set to (hidden) . There are some good injections that can use the access key but it will take high user interaction. Is there a way to inject ...
1
vote
0answers
76 views

Force Browser to not URL encode specific chars [duplicate]

I try to get a XSS to work but the problem is, that the XSS is only working within BURP because there I can send for example '>' as an not URL encoded String. As soon as I try it in the browser, it is ...
0
votes
2answers
172 views

Why can't I test XSS Vulnerability?

I am using DVWA and having trouble executing a simple, reflected XSS vulnerability. Entering the suggested text does not produce a popup in either Firefox or Chrome. Are there any settings that I need ...
5
votes
4answers
79 views

Would an official <disablescripts> HTML (6?) element/wrapper combat XSS effectively?

Would it not be possible to use such a method to wrap areas where user input/output is expected (eg. comment boxes), so that even if a script is successfully injected through regex evasion, the script ...
1
vote
0answers
55 views

Open source tool to test a WAF against OWASP Top 10? [closed]

Are there any open source tools to test a WAF against OWASP Top 10? Especially I am looking for a tool that tests a WAF against different types of attacks & reports test results.
1
vote
2answers
52 views

Started seeing jQuery function calls in URL requests, what is this?

I administer an E-commerce site, and recently I have been seeing odd URL requests containing jQuery function calls. Here are some examples of the requested URLs that are being logged as 302 permanent ...
1
vote
2answers
157 views

How to prevent reflected XSS with the Java Struts Framework? [closed]

I have an application that executes under Jboss server. I have an Apache server in front. My application contains a security vulnerability (XSS Cross-site scripting). I wanted to know that I had to ...
2
votes
1answer
81 views

Differences between Burp request and Browser - Has different responses

So I was put on an engagement over the last week and I found a potential XSS when using Burp's intruder/repeater. However, the strange thing that I noticed was that the response in Burp is different ...