Tagged Questions

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS), DOM-based XSS (aka client side XSS).

learn more… | top users | synonyms

1
vote
3answers
139 views

What is Reflected XSS?

Fed up with the following definition. Reflected attacks are those where the injected script is reflected off the web server, such as in an error message, search result, or any other response that ...
0
votes
2answers
156 views

Security issues in “Remember Me” function code example

I'm a beginner, and these may be very obvious for you, but I'm trying to understand if there are security issues with this example. Today on Stack Overflow, I saw the following post: PHP Sessions ...
0
votes
2answers
81 views

How the address bar manage the XSS?

I was playing with OWASP Mutillidae II and in one page I've found one vulnerability. In the address bar I've wrote something like : ...
3
votes
2answers
168 views

Exploiting XSS with window.name without iFrame

I know XSS is possible if the window.name is echoed onto the page, but from my understanding, this requires you to use an iFrame, but what if the page has clickjacking protection, stopping the page ...
9
votes
1answer
495 views

XSS Technique - & JavaScript Include

I was looking through the OWASP XSS Filter Evasion Cheat Sheet, and there was one technique that was completely new to me: & JavaScript includes <BR SIZE="&{alert('XSS')}"> I ...
1
vote
1answer
105 views

Could I XSS a page that filters &,",< and > characters and has Content-Type set to UTF-8?

I am trying to pentest a dummy website that has a form with a TEXTAREA input on one page. When the form is submitted, the contents of the form are displayed on a second page. However, the second page ...
1
vote
3answers
72 views

Session Fixation - Setting path to root without /

I have found an XSS vulnerability on the subdomain of a site I am testing, and using it I can set cookies for both the main site and all it's subdomains. My url currently looks like this: ...
2
votes
2answers
214 views

Is there a need to have XSS filters when I'm saving data as XML?

My web-app takes some configs from the user and saves into an XML file (it was not done to stop XSS). The input is XML encoded so that the ",& ... and such characters don't break the XML ...
1
vote
1answer
48 views

XSS attack remediation in older technologies

My application is vulnerable to XSS attack. Technology used in the application are Servlet 2.2, JSP 1.1, Jdk 1.3, WAS 4.0. I wanted to remediate XSS vulnerability with migration of technology or ...
1
vote
2answers
140 views

XSS in HOST header

I'm able to inject JavaScript payload in HOST header, a request will look like: Host: <script>alert(document.cookie)</script> User-Agent: Mozilla/5.0 Gecko/20100101 Firefox/29.0 Cookie ...
0
votes
1answer
97 views

Flash Objects SWF security (ExternalInterface.call)

I am performing a penetration test against a website that uses Flash. I found this piece of code: url = ExternalInterface.call("window.document.location.href.toString") as String; How it can be ...
-1
votes
2answers
101 views

Content sniffing XSS attack?

As a part of work, I've come across content sniffing, and i understand web apps can be vulnerable to xss because of it. There is another post, regarding content sniffing and xss, but didnt quite ...
0
votes
1answer
439 views

OWASP Zap proxy Fuzz XSS pentest against REST API

I am looking to PEN test my application against XSS attacks. The application is a REST API... As such when you POST some JSON to /cart/add to see the result of that attack you would need to GET ...
0
votes
1answer
89 views

An XSS attack is working on Firefox but not on Chrome..Suggest changes to make it work on Chrome

I am able to inject this: http://domain.com/search/songs/<img src='alert(document.cookie)' onerror='alert(document.cookie)'> to the page HTML. The onerror event is giving me the cookie on my ...
4
votes
3answers
179 views

What can we do with non persistent XSS vulnerabilities?

Sorry for this stupid question but i'm thinking about what an attacker can do with a non persistent XSS attack on a website? An attacker can try to phish me with a malicious url, steal my cookies or ...
1
vote
1answer
83 views

Is it safe to call an untrusted service with jquery.ajax and dataType 'jsonp'

From what I understand, the JSON-P technique generates a script tag into the DOM of an HTML page to get across the single-origin restrictions imposed on the XMLHttpRequest JavaScript API for AJAX ...
-1
votes
4answers
185 views

Software for web hacking? [closed]

I want to learn sql injection, xss and other web attacks. I am new to all this, just a beginner. I want to know which software to use. Can I use Windows for these attacks ...
1
vote
2answers
201 views

XSS with input in onclick attribute

If I have... <table onclick="texttexttexttextUSERINPUTHERE"></table> Would XSS be possible? I mean with > and " filtered out. I know if there wasn't text behind the user input, you could ...
0
votes
2answers
91 views

trying to xss a site [closed]

http://XXX/?subscribe_message=%3Cscript%3Ealert(/zzz/);%3C/script%3E Why doesn't that popup with a /zzz/ alert? When I do javascript:alert(/zzz/); in the address bar it does so why not when I do it ...
1
vote
3answers
96 views

Perform XSS on a link where image path is passed in querystring

I have a page on my website like this : domain.com?img=test.jpeg And on the page, the javascript written is: var imgPath = getQuerystring('img'); $("#img").attr('src','/Images/' + imgPath); I was ...
2
votes
1answer
125 views

XSS - history stealing

I am little confused about this matter. By simply writing a JavaScript code we can go through our browser history and identify visited links. It is fine. But how an attacker use this to identify a ...
6
votes
2answers
1k views

Is this an XSS vulnerability?

My company recently had a security assessment done on our website and we had a XSS vulnerability reported. Below are the details of the reported vulnerability: If a user hits a URL like the one ...
3
votes
2answers
257 views

Learning XSS: Why is my javascript ignored?

<a href='mailto:</a><script>/*'></a><script>/*</a>: <br> <hr> <a href='mailto:*/location.href=/*'>*/location.href=/*</a>: <br> ...
0
votes
1answer
107 views

Understanding Same origin policy

I am trying to understand same origin policy better. From what I understand same origin policy restricts code from one "origin" not access data from another "origin". What I am trying to understand is ...
1
vote
0answers
86 views

How did the Tweetdeck XSS Vulnerability work

How exactly did the recent TweetDeck vulnerability work? It says here that it had something to do with the HTML heart character but I don't fully understand what the explanation means. From the link : ...
3
votes
1answer
408 views

How should I mitigate the XSS vulnerabilities in KnockoutJS described at mustache-security?

The site Mustache-Security describes XSS vulnerabilities in KnockoutJS... The vulnerabilities come from the use of eval (or some equivalent) to convert text in the data-bind attribute to executable ...
8
votes
3answers
1k views

Allowing users to input a safe subset of HTML

I recently posted this question on Code Review and it was recommended that I ask you guys about it. Basically, this will be used to allow users to generate formatted content. It gets put inside of ...
1
vote
0answers
93 views

XSS Vectors for new Image()

What are possible XSS vectors to this JavaScript code new Image().src = encodeURI('[user url here]'); Let's assume two cases: [user url here] is some string provided by user (with no validation) ...
2
votes
3answers
614 views

Why are scripts injected through innerHTML not executed whilst onerror and other on<event> attributes on elements are? - Google XSS Challenge 2

SPOILER ALERT : Do not continue if you do not want to be spoiled I am currently doing the Google XSS Challenge Level 2 . I am injecting XSS code that is inserted into the document using ...
0
votes
2answers
120 views

Javascript injection via document.cookie possible?

Let's say someone rooted a site, is it possible for the attacker to do XSS via document.cookie? Instead of giving the user a name=value, the attacker does something like this ...
2
votes
2answers
150 views

Is XSS through style attribute possible in modern browsers?

Let's say users can define content of the style attribute, but in a constrained way. They can't break out of its value, as white-listing parser will remove any unsafe attributes/tags produced this ...
3
votes
4answers
496 views

How is this XSS attack working?

SPOILER ALERT: This question contains an answer to one of the problems from the Google's XSS Challenge! Please stop reading further if you're not interested in knowing the answer right now. I'm ...
0
votes
1answer
76 views

XSS vulnerabilities: how much are they dangerous?

Lot of articles underline that XSS vulnerabilities can be very dangerous for the website on which they exist. I wonder how much is this true when we find these XSS vulnerabilities on the frontend of a ...
0
votes
2answers
175 views

Way to decode an encoded payload [closed]

I am facing an XSS vulnerability in my ASP.Net Web application where the malicious code may be encrypted and html encoded Bottomline: I am trying to prevent XSS via code obfuscation. Question: I ...
1
vote
1answer
163 views

CSRF Token Stealing

I came across this link that dicusses how an attacker could exploit access control allow origin to get an anti-CSRF token: ...
2
votes
3answers
128 views

XSS prevention by black-listing

I have a reflected XSS vulnerability in my Web application. I have decided to take the black-list approach instead of the popular white-list approach. My question is can there exist a malicious ...
1
vote
1answer
148 views

How to prevent XSS when transferring web page content within XML

I have an ASP.NET web application which uses HTTPS and XML based request-response. It seems a user's session cookie can be retrieved via XSS, if the request/response is intercepted and malicious ...
2
votes
2answers
345 views

XSS in HTML meta tag

There is a web application which contains a search function. When I search for aaaaaaaaxss I get this: <meta property="the:property" content="100 Results for aaaaaaaaxss (Page 1)" /> It strips ...
1
vote
0answers
201 views

XSS in HTML title tag without forward slash

I am trying to find out whether this is vulnerable against XSS: I can control the content of the title tag through the URL. This would make the site vulnerable if it wasn't for the fact that the site ...
2
votes
2answers
513 views

Content-Security-Policy hash of script

<?php header("Content-Security-Policy: default-src 'sha256-".base64_encode(hash('sha256', 'console.log("Hello world");', true))."'"); ?> <script>console.log("Hello world");</script> ...
-1
votes
3answers
146 views

Find and solve XSS in this code

I need to find a XSS and propose a solution in the following code: <form action="#" method="post"> <input type="hidden" name="id" value="<?=$id?>"><br> <textarea ...
0
votes
3answers
152 views

How to leverage a stored XSS to perform a file inclusion?

I have identified a stored XSS and I'm wondering, how could I leverage that vulnerability to upload a shell.
3
votes
2answers
126 views

Webapp vulnerability scanner that understands continuations

I'm researching XSS vulnerabilities in a web application which uses continuations. That means that for a given form, the URI the form data is posted to is unique and different every time. A first GET ...
5
votes
4answers
845 views

Suggestions to avoid cookie-hijacking in a web application

I've been developing web-apps for quite some time now. While making websites, the "remember me" feature is one of the most trivial(read as must-have-for-clients) feature to be implemented. Until ...
1
vote
1answer
185 views

Content sniffing XSS vulnerable browsers

In order to prevent Cross-site scripting (XSS) in a private web application that supports image upload, I intend to reject browsers that are vulnerable to content sniffing. Which browsers are ...
0
votes
2answers
122 views

Can running a script while logged in compromise my facebook password?

In websites related to facebook malware analysis and information, we often see messages to the effect of if you have run this facebook app then your account has been compromised, or if you went to ...
1
vote
2answers
891 views

Is cross site scripting possible with the img alt attribute?

My question is, if any characters are allowed in the alt attribute of an img tag (except for double quotes), is XSS possible? Valid image or not.
0
votes
3answers
111 views

XSS in the context of a CDN

Say there is a website example.com. It hosts static content from a CDN, example.net. This site allows uploading an image, which will then be served from the CDN. This images can be SVGs and they are ...
0
votes
0answers
256 views

How safe is Apache's Commons StringEscapeUtils.escapeXml function to prevent XSS

I am using escapeXML StringEscapeUtils.escapeXml to prevent XSS in my Java application. But I am wondering if it resolves XSS to the fullest. I have tried some XSS attack vectors, and escapeXml seems ...
0
votes
2answers
300 views

How does the anchor tag (<a>) lets you do an Reflected XSS?

I was going through the OWASP XSS Filter Evasion Cheat Sheet and and I came across this section where there is an anchor tag used to do an XSS. I can imagine its use in a stored XSS attacks (like some ...