Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

learn more… | top users | synonyms

2
votes
1answer
114 views

Tweaks related to javascript execution in browser

Suppose, a filter validates the url, but not the protocol. In that case I can XSS that field with the following payload javascript://%0D%0Aalert(document.domain);//validurl.com You can paste above ...
0
votes
0answers
33 views

XSS script syntax problem

I have a server running on port 4444 on localhost that just echoes messages it receives. I have a JS script embedded in a message that is supposed to send the cookies of whoever looks at it. Here ...
2
votes
2answers
228 views

xss when http is added in the payload

If a field is not santized(except <,>) and all it does is add http in payload and reflects the output, is it possible to execute script in the client side? This is what output looks like for input ...
0
votes
2answers
192 views

Question - “D3 (js) allows you to bind arbitrary data to a DOM”

I have a security-related question with regards to d3.js D3.js essentially allows data to drive dynamic charts etc, among other features. The "d3js.org" landing page mentions "D3 (js) allows you to ...
2
votes
3answers
80 views

Is it possible to change code of website through an embedded image [duplicate]

say I allow my users to embed images that others can view, then the user rewrites the image to be a PHP file for instance. Would that pose a security risk of him injecting something into my code?
-2
votes
1answer
118 views

LFI exploitation using data:// [closed]

I found LFI in my website and I tried to exploit it, but when I use php://input or data:// it doesn't work, I cannot get the shell. Example: .index.php?lang=data:;base64,...
1
vote
1answer
83 views

Some tags I'm worried about when parsing html doc for xxs

I'm building a web app where users can make post which consist of an html doc. An user can change the document via the dev tool for example. So the document consists of literally any user input. I'm ...
2
votes
2answers
2k views

If using htmlentities or htmlspecialchars functions is enough for block XSS attack

I know this question was discussed on net various times. and people give some example how to bypass these functions through passing some code. But here one issue, All example of htmlentities/...
2
votes
0answers
67 views

What percent of stored XSS attacks use external JavaScript?

What % of XSS attacks use external JavaScript. For example: <script src="http://badsite.com/maliciouscode.js"></script> Instead of: <script>alert(document.cookie);</script> ...
1
vote
2answers
229 views

CSRF by manipulating HTTP headers from client side using JavaScript

I am trying to do CSRF vulnerability analysis for my website. My website uses an anti-CSRF-token which is sent by the server to the client with the session cookie and then Javascript in the client ...
3
votes
2answers
244 views

Are these four HTTP headers protection against Cross-Frame Scripting enough?

I would like to ask a question what is the best protection against Cross-Frame Scripting. I have set up my web server to adding these flags into HTTP HEADER: X-Same-Domain: 1 X-Content-Type-Options: ...
2
votes
2answers
140 views

Is this ASP site vulnerable to XSS or not?

I took a scan of a ASP site and it said that request validation was off. It caught it by sending a URL of example.com/?foo=<script> and received a response URL of example.com/?foo=<script> ...
2
votes
1answer
107 views

Is it safe to allow arbitrary image formats in comments?

I know it’s not safe to allow arbitrary images in comments without proxying. I just saw this feature. It seems that all current user agents which implement it disable scripting and external resource ...
1
vote
2answers
435 views

Is this sanitizer vulnerable to XSS?

To have a simple and secure editor for text fields of a django app, I have this snippet to sanitize input HTML into django code: from bs4 import BeautifulSoup def sanitize_html(value): ...
1
vote
3answers
185 views

Can these html tags and attribs make my site vulnerable?

I am developing a social website and want to allow user ONLY these html tags and attributes in their posts: tags: <img>, <b>, <strong>, <blockquote>, <a> attributes: '...
5
votes
3answers
123 views

Input validation: how to do it if I must accept HTML as part of my input?

I'm writing a service which receives FHIR data and it stores it. FHIR is an HL7 healthcare information standard format which contains HTML by definition, embedded into a JSON or XML, (to ensure human-...
2
votes
1answer
234 views

A possible router XSS vulnerability

I have been trying to analyze my router modem and see how it works and check for possible vulnerabilities in the system . and i would like some help . Router Security Research : router access ip : ...
-2
votes
2answers
72 views

XSS TRACE method [duplicate]

Could TRACE METHOD cause harm to my website? If this request is made: TRACE / <script>confirm("Java Script !")</script> HTTP/1.1 Host: xxxxxdomain.com X-Wing: <script>bar()</...
3
votes
2answers
225 views

Is always using HTTPS a good idea? [duplicate]

OK, this question might seem a no-brainer for a professional but keep in mind I am not a professional web developer so my knowledge in this field is very limited. I have been pondering over time ...
2
votes
1answer
413 views

302 redirect and the body on the page (you are redirected to …)

I have page which take URL on query and string and it. Then, you get redirected using 302 to another page, and the response of the page contains HTML code and the redirect header. Like this: <html&...
1
vote
1answer
124 views

Is it possible to get a flash src after a redirect or an element inside an embed/object/iframe tag (cross-domain)?

The URL example.com/auth will automatically redirect the user (HTTP 302) to example.com/signed_in.SWF?token=SENSITIVE. Is it possible for an attacker to steal the token, using javascript or flash, in ...
0
votes
2answers
129 views

Reflected XSS quote not encoded

I am attempting to exploit URL with a reflected XSS as follows: http://domain.com/vuln_parm= The contents of vuln_parm gets returned to the user as follows: <div attrib1="" attrib2="" ...
2
votes
1answer
78 views

How dangerous is reflected request query strings?

I have discovered a possible security flaw in a login for a site that many people rely on. I won't say the site but in the URL there is something similar to /Success?message=Success+please+wait+a+bit+...
1
vote
1answer
73 views

Why my XSS attack's onerror method not firing?

I have been able to inject an onerror event to the HTML. In the image you can see onerror has been injected, but it never fires.
10
votes
2answers
3k views

How to launch XSS code from an INPUT HTML tag upon page load?

Say I have the a website with the following code on it: <input type="text" id="search-text" name="query" value="?" /> Double quotes aren't escaped so I can break out of the value attribute, ...
5
votes
2answers
234 views

Dangers of XSS on the server-side vs client-side

I was looking here, and I understand that reflected-DOM XSS(Client-side XSS) does not go through a server-side script but Reflected XSS (Server-side XSS) does, but neither hits/gets stored in the ...
0
votes
1answer
668 views

Token contains a reflected XSS vector in the <form > tag error in Chrome

We have a web app and we send the back URL through post to various pages to enable users come back to the parent. The double quotes are translated to &quot; to avoid XSS and then translated back. ...
3
votes
1answer
800 views

Does a Content-Type: text/plain header protect against XSS in browsers?

I'm creating a small web script that mostly redirects the browser but has some error conditions when input parameters cannot be validated. I'd like to display error messages like parameter XXX had ...
1
vote
3answers
2k views

In NodeJS, what is a good way of ensuring user submitted data in (text input) forms is not malicious?

In addition to scanning user uploaded files, I would also like to ensure that forms for user profiles, comments, etc. cannot be misused to submit malicious script. What are some known good methods of ...
0
votes
1answer
48 views

Is XSS possible if I insert untrusted data into an quoted HTML attribute and HTML encode the " sign?

If I insert untrusted data in a HTML attribute like this: <img src="http://www.mydomain/<%untrusted_data%>"> and if I HTML encode the " sign in the untrusted data, is this particular ...
5
votes
4answers
1k views

XSS for stealing cookies … not anymore?

The other day I found a XSS vulnerability in a website that a friend told me to Pentest. It was a page from a school that he's managing, so the important thing here is the login credentials == COOKIES....
4
votes
2answers
483 views

http_only for cookies with JWT tokens

I'm trying to figure out how to use JWTs that are transmitted in cookies for an SPA It needs to be in cookies because we want non-ajax requests to also send the jwt, and it should "just work" for all ...
1
vote
0answers
93 views

XSSF cookie stealer not working

I am playing with XSSF with Metasploit and attacking Mutilldae(security 0). I was able to get the generic XSS inject working. The inject was added to the Mutilldae blog. However, when I try to get the ...
2
votes
1answer
182 views

Reflected XSS via $_FILES

Is it possible to perform a reflected XSS attack via the $_FILES variable? The vulnerable code I am imagining might look like this: echo $_FILES["file"]["name"]; I read that it's not possible to ...
0
votes
2answers
153 views

Persistent XSS in Blogger domain

I have discovered persistent XSS in blogger domain. I have reported vulnerability to Google Security Team and I received this is the response: Users are permitted to place arbitrary JavaScript, ...
1
vote
3answers
363 views

Is this code javascript vulnerable to DOM based XSS?

Code : <script> document.theform.reference.onchange = function(){ var id = document.theform.reference.selectedIndex; var url = document.theform.reference[id].value; ...
3
votes
4answers
845 views

Famous XSS attacks over JavaScript [closed]

I'm about to graduate in "Computer Science", and I'm writing thesis about the Javascript vulnerabilities. In particular, I'm analyzing the JS vulnerabilities that allow XSS attacks. I would like to ...
2
votes
1answer
440 views

XSS in Content-Disposition

Lets assume i have found a xss on site example.com, now to trigger an XSS, i use the following URL: https://example.com/a.php?v=%22%3E%3Cimg%20src=x Which results in following response: HTTP/1.1 ...
3
votes
1answer
565 views

Content-Security-Policy data: scheme

I have a Cordova app that transforms some images to base64. This violates CSP with this message: Refused to load the image 'data:image/svg+xml;charset=US-ASCII,%3C%3Fxml%20version%3D%221.0%22%...
1
vote
0answers
181 views

Tools for finding stored XSS vulnerabilities, given DB write access? [closed]

I'm aware that there are various tools for testing for XSS vulnerabilities. However, all the ones that I'm aware of (Vega, possibly BeEF, etc.) operate purely client-side. When testing for stored XSS ...
1
vote
1answer
102 views

What kind of attacks do Javascript WebWorkers protect against?

What kind of attack are prevented by running code submitted by the user in a Javascript Web Worker? Do they prevent attacks like XSS, or is it better to use some other sandboxing method to protect ...
1
vote
3answers
942 views

What are the different payloads used for XSS vulnerability? [closed]

I am new to information security field. I am searching for XSS vulnerabilities. In XSS mostly they use <script>alert('XSS')</script> payload for attacking a websites. In the case of ...
1
vote
1answer
560 views

XSS payload to capture login credentials

I am trying to solve this exercise http://pentesteracademylab.appspot.com/lab/webapp/jfp/3. The objective of this is to "Post the Username and Password to Attacker Controlled Server". There is a url ...
3
votes
0answers
62 views

XSS only works when GET request is submitted with form [duplicate]

I'm trying to create a POC for responsible disclosure, but I'm having an issue... When I use a textbox to submit my payload, it brings me to another page where the javascript executes and is present ...
1
vote
1answer
106 views

Any standard tests to prevent hacking? [closed]

I am very new in programming world so my question may sound weird. I am useing selenium to test an application, yesterday one of my colleagues found this issue that if someone enters this: <script ...
2
votes
4answers
490 views

Is it possible to exploit unescaped user input into JavaScript form which only gets data via AJAX request?

A logged in user can get to a page https://example.com/some/page which has an input field and some buttons. When user enters something into this field and clicks away on anything, the page makes ...
0
votes
1answer
16 views

Security risks for a simple network configuration screen in android [closed]

I am building an Android App that pulls chart information from a server where the connection is specified on this view Ideally, the end user will put in a valid host and port resulting in business ...
3
votes
1answer
129 views

Possible issues when one or more cookie not HttpOnly

I have a question related to HttpOnly cookie. Tracking other threads wasn't of much help, hence I am posting my query here to learn if you can foresee any issues with my understanding. There is a ...
3
votes
1answer
579 views

Dom based Xss Query - location.hash

I was just looking at Dom based xss and wondering if hash value is written to a variable in javascript context can lead to Cross site scripting. The code looks something like this: <script> var ...
2
votes
6answers
136 views

Close XSS vulnerability

I run a vulnerability scanner on my website which showed me a couple of vulnerabilities which look like this: http://.../search?text=&ClassIDNames[37]=<script>alert('Found')</script>&...