Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

learn more… | top users | synonyms

0
votes
1answer
65 views

XSS from image upload - does cropping solve most issues?

I am testing an image uploader but I'm a mere developer. Here are the main points to consider: There are no extension checks. The image is uploaded to memory. It is modified to be a certain size ...
3
votes
1answer
70 views

PHP - Is it safe to file_put_content raw HTML?

I'm planning to create a website to let people edit/customize their stories. Let's say the stories will store a lot of html tags ( paragraph, images & video ) I'm thinking using some javascript ...
-1
votes
1answer
113 views

XSS in hidden inputs [closed]

I have some cases of XSS in input fields when the type is set to (hidden) . There are some good injections that can use the access key but it will take high user interaction. Is there a way to inject ...
1
vote
0answers
61 views

Force Browser to not URL encode specific chars [duplicate]

I try to get a XSS to work but the problem is, that the XSS is only working within BURP because there I can send for example '>' as an not URL encoded String. As soon as I try it in the browser, it is ...
0
votes
2answers
153 views

Why can't I test XSS Vulnerability?

I am using DVWA and having trouble executing a simple, reflected XSS vulnerability. Entering the suggested text does not produce a popup in either Firefox or Chrome. Are there any settings that I need ...
5
votes
4answers
76 views

Would an official <disablescripts> HTML (6?) element/wrapper combat XSS effectively?

Would it not be possible to use such a method to wrap areas where user input/output is expected (eg. comment boxes), so that even if a script is successfully injected through regex evasion, the script ...
1
vote
0answers
49 views

Open source tool to test a WAF against OWASP Top 10? [closed]

Are there any open source tools to test a WAF against OWASP Top 10? Especially I am looking for a tool that tests a WAF against different types of attacks & reports test results.
1
vote
2answers
48 views

Started seeing jQuery function calls in URL requests, what is this?

I administer an E-commerce site, and recently I have been seeing odd URL requests containing jQuery function calls. Here are some examples of the requested URLs that are being logged as 302 permanent ...
1
vote
2answers
105 views

How to prevent reflected XSS with the Java Struts Framework? [closed]

I have an application that executes under Jboss server. I have an Apache server in front. My application contains a security vulnerability (XSS Cross-site scripting). I wanted to know that I had to ...
2
votes
1answer
59 views

Differences between Burp request and Browser - Has different responses

So I was put on an engagement over the last week and I found a potential XSS when using Burp's intruder/repeater. However, the strange thing that I noticed was that the response in Burp is different ...
0
votes
1answer
38 views

Is it possible to use CSP for a Javascript-based video player?

Some of my workmates are developing a video player using Javascript. AFAIK, we are not going to have any website. The clients will connect to the server, download the javascript code and then render ...
0
votes
1answer
19 views

Disabling post-pageload http requests to account for XSS

I have a website where JavaScript is used to process sensitive data (chat messages) on the client side. No communication is done with the server or any other service after the initial page load. It's ...
4
votes
1answer
124 views

JS snippets on my live project do not appear in my code residing on my production server

I have a Django website project that is live (let's call it example.com). It's a forum where users can submit comments and reply to them. It has a Postgresql database, and gunicorn + nginx reverse ...
0
votes
1answer
82 views

xss bypass for javascript elements filtered as [removed]

If we write test ">script>alert(1)/script>, application is filtering the JavaScript with test">[removed]alert(1)[removed]. And payloads like onmouseover,onmouseout are skipping. In this ...
4
votes
3answers
564 views

XSS - How serious can it be? [duplicate]

I am just wondering about XSS attacks. Lets say I have a normal website, but it displays a few things based on $_GET variables. The website has no login system, all users can do is browse different ...
1
vote
3answers
146 views

XSS - Can we steal cookies from another website on another tab?

Suppose I found a XSS bug in a eCommerce website. Can we steal the victim's cookies from their bank website (if that is opened in another tab)?
4
votes
2answers
114 views

Should I worry about NoScripts anti-XSS warning when making a 3DSecure payment?

When I make an online payment using 3DSecure (Verified by Visa or Mastercard Securecode), NoScript informs me that it has stopped a potentially insecure script where site A (the bank or the credit ...
-1
votes
1answer
73 views

XSS Vector without < or > symbols or equal sign?

Just wondering if anyone could help me out with some XSS Vectors that work without having the < or > symbols. Basically the the input is stripped from < and > symbols and any equal signs such ...
3
votes
1answer
85 views

Break out of JavaScript data context to perform XSS when backslash and quotes are replaced?

Suppose I have a this on my site: <script> var x = "<? echo unsafe_data; ?>"; </script> This is obviously vulnerable to XSS. Now suppose I "clean" the unsafe data by replacing \ ...
4
votes
7answers
191 views

Any non alert() based non malicious XSS payloads?

I have been trying to find non malicious, non alert based, single command reflective XSS payloads, and have so far seen none. Anybody know of any good ones for pentesting purposes? What I mean by ...
3
votes
1answer
82 views

Could somebody explain how the ASDA site is vulnerable?

I'm sure many of you will have seen the CSRF exploit highlighted by Paul Moore that ASDA have known about for two years (Paul's blog) I am trying to find an explanation as to WHY the website is ...
1
vote
1answer
86 views

Security concerns of HTML echo endpoint

Consider a website with an endpoint that, when a payload of an HTML string (full document or partial segment) is POST to it, the server will transform the payload (and sometimes no transform is ...
4
votes
1answer
77 views

Wordpress.org pages refresh when logging out of Gmail

I've noticed that when I change my Gmail account by logging out of one account and then logging into another, all open Wordpress.org pages refresh. Additionally, when I recently changed a password on ...
4
votes
1answer
92 views

Style attribute XSS without quotes

If there is a page that allows user input into the following... .page { background: #userinput; } can it be exploited if <>'" are all filtered? I've seen width: expression(alert(0));, but ...
9
votes
3answers
1k views

Can I simply search-replace < and >?

I'm running a comment system, and I want to accept regular, un-formatted text. I don't want anything too complicated, so I thought of just searching and replacing all < to space (through regex or ...
0
votes
2answers
85 views

Is it possible to execute xss when response is of content type:application/json in latest IE? [duplicate]

Question is when response type of request is coming as application/json and also there is not any kind of escaping/encoding implemented then is it possible to execute xss there? Changing file ...
1
vote
0answers
59 views

From xss to rce in client side [closed]

I found a desktop application in Linux w/c getsvand that displays items from site xyz. xyz is vulnerable to XSS and code injected there is also executed on client side's desktop app.similar to this ...
1
vote
1answer
61 views

Executing XSS payload when “http” is added to payload

I have a context where every special characters are escaped properly except ':' &'/'. The output is reflected inside <a href="payload" tag. 1 )When I set payload to javascript:alert()(which ...
6
votes
1answer
72 views

Proper way to protect against XSS, when output is directly into JS not HTML?

I'm seeing plenty of examples when the output is going into HTML directly, but I'm seeing more conflicting information when the output is going straight into JS. For example if the code was: var ...
0
votes
2answers
147 views

Reflective XSS in script codes with Content Type “text/javascript”

I have a webpage that returns raw script code with the headerContent-Type: text/javascript. However I found that there is a reflective xss in one of the parameters passed to the url which is copied ...
3
votes
1answer
115 views

Is this vulnerable to XSS exploit?

A typical ajax call: $.ajax({ url: "http://mywebsite/script?param=" + $("#field").val(), dataType: "jsonp", success: function(response) { $("#id").html(response); }, }); sends a ...
11
votes
2answers
1k views

How does CORS prevent XSS?

I recently learned about CORS and got the impression that its purpose is to prevent XSS. With CORS, the browser blocks requests to different domains, unless particular headers are in place. But if a ...
6
votes
2answers
289 views

XSS via JSON: Why does a web application not sanitize either its incoming params hash or its outgoing JSON values of malicious tags like Script?

Recently working on a Rails-based web application for a company, I had to look into XSS vulnerability. It turns out that the application, in some places, could take an HTML tag (e.g., jscodehere ...
5
votes
1answer
996 views

How make Firefox ignore X-XSS-Protection header from server?

I have two questions: 1)How can I make Firefox ignore X-XSS-Protection header? I have a website which sends X-XSS-Protection: 1 header and I want my Firefox to ignore that header, because it destroys ...
9
votes
2answers
61 views

Personal stylesheets

In reference to this question, I was researching whether or not there would be any security risks in letting users add their own stylesheets. He brings up a scenario in which a dev might use ...
0
votes
1answer
29 views

Javascript Valuable Webpage Data

When malicious users and attackers seek to steal data using XSS, they can send attributes like document.cookie to a malicious server, correct? Does this attribute have all of a users cookies for a ...
4
votes
1answer
122 views

How can I exploit a web application if content sniffing is not disabled?

I just come across one of the customer's website for penetration testing having JSON callback reflecting the user input in the response body. like this: ...
0
votes
1answer
166 views

Can someone tell me whether this is Cross-site scripting attack or normal log entry?

Can someone shed light on this logs . ****GET /list25/ADMN/Eligibility/EligibilityResponse.aspx ...
2
votes
1answer
114 views

XSS via -confirm()-

I was reading this article here, in the middle I saw the author used -confirm()- as the payload. I'd like to know what is this payload? I mean what's the difference between -confirm()- and ...
0
votes
0answers
26 views

Different chanels for BeEF UI and Communication Server

I am working with BeEF tool and I want to access the UI interface using https (I don't want to communicate via VPN to access the control panel), while at the same time, I need to serve the http hooks ...
6
votes
3answers
251 views

How to convince team mate about using a whitelist?

Context In our development team, we have to build a component. This component is a full client side one written in Javascript. A client web application wishing to embed this component will call it ...
2
votes
0answers
47 views

How to validate Excel data to protect against XSS?

My application is dynamically constructing a source URL and then writing the resource file (Excel) directly to the response. The URL is read from a properties file, based on the application ...
4
votes
1answer
46 views

Does using creating a seprate firefox profile cause a seprate security context to protect against XSS and DNS Re-binding?

I read here that I should use separate security profiles for different sorts of things; accessing sensitive information, doing system administration vs. opening links from emails. I know that ...
0
votes
0answers
98 views

Is Primefaces vulnerable to host header attack?

Is the Primefaces JSF framework vulnerable, or secured against host header attack?
1
vote
1answer
86 views

XSS - Using firebug to inject Scripts

Recently I did a bit of digging around XSS and found that to prevent XSS the best way is to encode user input/output. Being a newbie in this field I am unable to get my head around this and have a ...
-1
votes
1answer
69 views

How do a basic tests for webapp - online tool made with PHP (forms, shell access, session) [closed]

I created a webapp in PHP (MySQL, jQuery) and now I want to take necessary security measures in order to keep it up and running and harmless for my VPS. App has several public forms ($_POST, $_GET, ...
-1
votes
1answer
137 views

XSS display cookie of another website

Trying to practice XSS on dummy website. My end goal is to display the victim's cookies on my "attacker" site. Currently what I have is that when the user enters my site, it will pop up the dummy ...
0
votes
2answers
146 views

How can I demonstrate the reflected XSS via post methods

I was trying to make a PoC of XSS: Attack sample: I have injected script into the value: <html> <body> <form action="https://test.com/api/users.prefs.set?t=1447648400" ...
6
votes
1answer
124 views

How does X-XSS-Protection: “0” affect the security of my website?

How does disabling XSS protection affect my website? What security vulnerabilities does it open? My site requires the header to be used on certain pages, so what can I do to secure the pages with the ...
2
votes
1answer
68 views

Is this code vulnerable to DOM based attacks?

We are developing code for a Banking web application. We want to make sure that the code is secure and since we are using a lot of javascript code, we are kind of worried if any chance of a web based ...