Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS), DOM-based XSS (aka client side XSS).
2
votes
2answers
450 views
Removing Google Analytics cookie string from URL - security hole?
On our site, we use google analytics and we have to put the GA cookie in the URL since we have a two letter domain and IE imposes some cookie limitations on those. This means that when going between ...
0
votes
2answers
143 views
How much security should I use for my web application?
My question is, for a "normal" site, what do you think is enough to secure against methods used by "script kiddies"? For example, SQL injection, XSS, and stuff like that.
Same question for password ...
-2
votes
2answers
164 views
Cross Site Scripting Related Query | Web Application Security [closed]
In some tutorial i have read that we can filter meta characters and all that. I know all about that. in that tutorial there were written like this.
People who attack site with script, its basic ...
2
votes
2answers
2k views
Is this JSON encoding vulnerable to CDATA injection?
I ran across an odd notation in the jsfiddle.net generated pages
<script type='text/javascript'>//<
0
votes
2answers
3k views
Bypassing XSS filters [duplicate]
Possible Duplicate:
New XSS cheatsheet?
Can anyone give me list of ways to encode XSS payload , or to be precise what are the ways to encode XSS payload to bypass encoding of <> or ().
I ...
5
votes
1answer
2k views
Is this jQuery ajax call vulnerable to XSS?
If somebody can edit $("#field").val(), can they change the url property here to point to another location?
$.ajax({
url: "http://mywebsite/script?param=" + $("#field").val(),
dataType: "jsonp",
...
6
votes
3answers
227 views
Is XSS dangerous on web without login/sensitive user's data?
Is XSS dangerous when the web application doesn't have a login/register function, the user isn't logged in or when the website doesn't store any sensitive user information?
10
votes
2answers
1k views
Is strip_tags() horribly unsafe?
I always use strip_tags to prevent XSS attacks, but today I saw a post which was telling it's horribly unsafe. As the manual says, it doesn't check for malformed HTML!
Is it true?
What can I do to ...
7
votes
3answers
571 views
How bad is a Self Contained XSS attack?
Some of you might be familiar with this attack called Self Contained XSS. I recently stumbled upon this article about it. So how bad this kind of attack can be, even though this doesn't have access to ...
6
votes
2answers
190 views
Presentation on Web App Security (ACM Student Chapter)
I am a member of the local ACM student chapter in my university and as part of our activities I am scheduled to give a talk on current issues on Web Application Security (and possibly secure coding ...
6
votes
1answer
488 views
Is Request.getHeader(“host”) vulnerable?
If the following is the code snippet, what would be your suggestions?
<script type="text/javascript" src="<%=request.getHeader("Host")%>/XXX/xxx.js"></script>
Is this a clear ...
3
votes
1answer
706 views
XSS in SWF file
I have the following code in an SWF file that a vulnerability scanner marks as XSS:
// Action0
{
var __callResult_6 = getURL(_root.thankYou, "_self");
var __callResult_7 = stop();
...
4
votes
6answers
589 views
Filter user input before the database or upon display?
Given a web application where user data must be properly escaped to avoid XSS, is it better to try to remove the "bad stuff" before it enters the database, or is it best to allow it in the database ...
2
votes
2answers
935 views
Is there a way to bypass escape function in javascript?
Is there a way to bypass escape function in javascript for exploiting a XSS vulnerability ?
0
votes
2answers
302 views
DOM XSS : Need Help
I was trying my hands at DOM based XSS. I came across a scenario where user controlled string from the URL is included in javascript as below
var userControlled=substring of URL;
...
7
votes
1answer
543 views
Closing an HTML element without using literal slashes?
I'm investigating a vulnerability in an application that echoes a user-supplied filename without sanitizing the filename.
E.g. a file named test-<script>alert("evil");.txt will result in that ...
4
votes
4answers
723 views
Server wide javascript injection
UPDATE: The server was rooted, php.ini was replaced that cause the injection to appear. Still haven't figured out which directive is injecting the javascript.
I'm troubleshooting a hacked website ...
3
votes
1answer
2k views
URLEncode vs HTMLEncode for XSS prevention
I have one project (in Java) that the programmer used URLEncode to output content as part of HTML instead of HTMLEncode.
What is the risk that it is XSS vulnerable?
(Let’s forget that it’s different ...
6
votes
3answers
3k views
PHP functions for preventing XSS
Is there a proven library with functions for preventing XSS attacks? Many people don't realise that htmlspecialchars is not enough to prevent XSS attacks. There are various contexts that need their ...
6
votes
3answers
509 views
How serious are XSS attacks
A website I visit allows this kind of attack, to be implemented with GET in the URL
<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
Along with many others on this page: ...
20
votes
2answers
1k views
JavaScript written only with brackets?
I once saw JavaScript code which was only written as multiple brackets (). Does anybody remember this kind of code? There was also an online converter to convert "normal" JS into this style of code. I ...
2
votes
1answer
259 views
Has The IE8 XSS Filter XSS Flaw Been Fixed?
You may remember: X-XSS-Protection: 0
http://hackademix.net/2009/11/21/ies-xss-filter-creates-xss-vulnerabilities/
Has this been fixed in IE8? IE9? IE10? Is it implemented in IE7?
14
votes
1answer
934 views
Does the practice of blocking an off-site “Referer:” HTTP requests improve website security?
Is there any benefit for a security-paranoid website to disallow HTTP requests that have a Referer: from 3rd party sites?
The pitch is that if such a HTTP request were to come in, then certain XSS ...
3
votes
5answers
248 views
Is it possible to see if a script on a website steals session cookies?
I'm looking as some web analytics solutions, I know it sounds paranoid. but cookie-based web analytics need for you to paste their JavaScript code on your web-site.
I don't like the idea too much of ...
4
votes
2answers
718 views
Are PHP Sessions based on cookies or a cookie-IP pair?
I have a PHP website and my question is:
If someone manages to steal my users' cookies via an XSS attack,
is it enough for him to be identified as the user?
Or does his IP also have to be the same as ...
3
votes
2answers
404 views
Is this an example of XSS attack?
A scripter sees on certain web pages it's technically possible to include markup like HTML and CSS/JS. It's technically possible to submit a javascript or iframe and have it display to the visitor ...
5
votes
4answers
525 views
Is XSS dangerous in application without database?
I think it definitelly isn't, because XSS which isn't saved anywhere would damage ONLY attacker.
Am I right or are there any cases where XSS could hurt non-db-application? (I mean datas are not saved ...
11
votes
5answers
1k views
Solution to allow JavaScript input but prevent XSS
We have a simple Blog system that allows users to input html and JavaScript to build a blog page. I'm aware that allowing javascript open up the door to xss attacks. We do however need to allow users ...
9
votes
2answers
482 views
Cross site scripting verification on a field which does not accept more than 20 characters
While performing penetration testing, I got stuck to a point. There is a text field which does not accept more than 20 characters(server side validation). I inserted following piece of code to check ...
3
votes
2answers
1k views
How to protect from new Javascript Injection technique that doesn't use eval()?
There is a new Javascript injection technique that is generating chatter on the forums mentioned here
Here is the code sample:
String.prototype.code = function(){ return (new Function('with(this) { ...
8
votes
2answers
470 views
Recent Facebook XSS exploit details
There was a recent XSS exploit on Facebook that posted a vulgar message and got users to click on a link to spread the payload. What vulnerability was exploited, and what can other sites do to avoid a ...
5
votes
4answers
1k views
Does default ModSecurity protect enough against XSS?
It's been a few years since I mucked around with modsecurity...
Will simply installing the package with the default rules provide enough validation to prevent any (okay, let's be honest - best we ...
13
votes
4answers
747 views
Web Security Cheatsheet / ToDo list
Can anyone suggest a cheatsheet or ToDo list of web site and application security?
A local small business owner prompted a question about web security, basically her company website just got XSS ...
3
votes
3answers
287 views
Is Content Security Policy an approach that is worth to support?
Mozilla Firefox 4.0 supports something called Content Security Policy that disables the interpretation of embedded Java Script. Only external Java Script files that are referenced using a script tag ...
1
vote
2answers
309 views
AntiXSS for ASP.NET 1.1
Unfortunately, a client of mine still has an application based on ASP.NET 1.1.
Yes yes, I know - horribly insecure, support ending, and on and on... I've already been through that with them.
...
0
votes
4answers
118 views
Safely changing text links to HTML anchors
I'm trying to change text links to real anchors. So for example I want to change http://example.com to <a href="http://example.com">http://example.com</a>.
Since this is a user given ...
3
votes
2answers
3k views
Testing PHP form injection
I'm writing a very small PHP app that takes input via a form. As could be expected for a first revision, the code does no escaping or sanitisation of input:
if( $_POST["var"] != "" ) {
print ...
1
vote
1answer
289 views
Is this enough to tackle script / malicious code insertion in GET, POST requests?
I've got legacy PHP code which attempts to prevent script / SQL injection with the following:
if (!empty($_POST)) {
reset($_POST);
while (list($k,$v)=each($_POST)) {
...
3
votes
3answers
773 views
Altering a $_SESSION variable in PHP via XSS?
Not sure if what I'm saying makes sense... but is it possible for me to alter a $_SESSION variable from outside the target PHP script?
One of our scripts uses a $_SESSION variable and I'm not sure if ...
0
votes
1answer
165 views
Replicating javascript actions from different website (XSS?)
I've got html / javascript code on my site like this:
<a ...
3
votes
3answers
269 views
Protecting websites from outdated browsers and plugins via a whitelist/blacklist combination?
Aside from using browser headers, I want to blacklist/whitelist browser and plugins from my site so that I can prevent these older unpatched systems from (1) being a general user of my site (2) ...
9
votes
2answers
2k views
How to address XSS security issues in FCKeditor / CKeditor?
A security report we conducted through an outside company reported XSS vulnerabilities in FCKeditor which we're using in our PHP application.
They pointed out that accessing URLs such as:
...
43
votes
6answers
3k views
Can anybody explain XSS to an idiot?
That idiot being me, of course.
I work programming Enterprise Java applications and do very little web development in 2002. I'm interested in security and like to read articles about it. However, I ...
6
votes
4answers
858 views
Escaping JavaScript constants
how can untrusted values be included in a html-page as javascript string constants? Although the case i am asking uses JSF and Rails, I think this is a general problem independent of the server side ...
8
votes
7answers
915 views
Whitelisting DOM elements to defeat XSS
As we know, developers are responsible for correctly escaping/validating data provided by the user before rendering or storing them. However, we must agree that it's relatively easy to forget a single ...
30
votes
4answers
2k views
New XSS cheatsheet?
There is a great list of XSS vectors avaliable here: http://ha.ckers.org/xss.html, but It hasn't changed much lately (eg. latest FF version mentioned is 2.0).
Is there any other list as good as this, ...
19
votes
6answers
308 views
User input data, is filtering enough or should it be parsed?
In a webapplication there could be two approaches to migate XSS attacks. All the input data could be filtered (removing all 'bad' data), or the input could be parsed, tokenized and output with only ...
13
votes
3answers
673 views
Rails - protection against code injection and XSS
I've started using Ruby on Rails, and I was wondering if there were any security gotchas to watch out for with Rails, particularly regarding code injection and XSS?
I know Rails tries to prevent ...
