Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS), DOM-based XSS (aka client side XSS).

learn more… | top users | synonyms

5
votes
1answer
1k views

How should I mitigate the XSS vulnerabilities in KnockoutJS described at mustache-security?

The site Mustache-Security describes XSS vulnerabilities in KnockoutJS... The vulnerabilities come from the use of eval (or some equivalent) to convert text in the data-bind attribute to executable ...
8
votes
3answers
2k views

Allowing users to input a safe subset of HTML

I recently posted this question on Code Review and it was recommended that I ask you guys about it. Basically, this will be used to allow users to generate formatted content. It gets put inside of ...
1
vote
0answers
136 views

XSS Vectors for new Image()

What are possible XSS vectors to this JavaScript code new Image().src = encodeURI('[user url here]'); Let's assume two cases: [user url here] is some string provided by user (with no validation) ...
3
votes
3answers
2k views

Why are scripts injected through innerHTML not executed whilst onerror and other on<event> attributes on elements are? - Google XSS Challenge 2

SPOILER ALERT : Do not continue if you do not want to be spoiled I am currently doing the Google XSS Challenge Level 2 . I am injecting XSS code that is inserted into the document using ...
0
votes
2answers
433 views

Javascript injection via document.cookie possible?

Let's say someone rooted a site, is it possible for the attacker to do XSS via document.cookie? Instead of giving the user a name=value, the attacker does something like this ...
2
votes
2answers
264 views

Is XSS through style attribute possible in modern browsers?

Let's say users can define content of the style attribute, but in a constrained way. They can't break out of its value, as white-listing parser will remove any unsafe attributes/tags produced this ...
3
votes
4answers
694 views

How is this XSS attack working?

SPOILER ALERT: This question contains an answer to one of the problems from the Google's XSS Challenge! Please stop reading further if you're not interested in knowing the answer right now. I'm ...
0
votes
1answer
89 views

XSS vulnerabilities: how much are they dangerous?

Lot of articles underline that XSS vulnerabilities can be very dangerous for the website on which they exist. I wonder how much is this true when we find these XSS vulnerabilities on the frontend of a ...
0
votes
2answers
276 views

Way to decode an encoded payload [closed]

I am facing an XSS vulnerability in my ASP.Net Web application where the malicious code may be encrypted and html encoded Bottomline: I am trying to prevent XSS via code obfuscation. Question: I ...
1
vote
1answer
384 views

CSRF Token Stealing

I came across this link that dicusses how an attacker could exploit access control allow origin to get an anti-CSRF token: ...
2
votes
3answers
211 views

XSS prevention by black-listing

I have a reflected XSS vulnerability in my Web application. I have decided to take the black-list approach instead of the popular white-list approach. My question is can there exist a malicious ...
1
vote
1answer
266 views

How to prevent XSS when transferring web page content within XML

I have an ASP.NET web application which uses HTTPS and XML based request-response. It seems a user's session cookie can be retrieved via XSS, if the request/response is intercepted and malicious ...
2
votes
2answers
866 views

XSS in HTML meta tag

There is a web application which contains a search function. When I search for aaaaaaaaxss I get this: <meta property="the:property" content="100 Results for aaaaaaaaxss (Page 1)" /> It strips ...
2
votes
0answers
367 views

XSS in HTML title tag without forward slash

I am trying to find out whether this is vulnerable against XSS: I can control the content of the title tag through the URL. This would make the site vulnerable if it wasn't for the fact that the site ...
3
votes
3answers
1k views

Content-Security-Policy hash of script

<?php header("Content-Security-Policy: default-src 'sha256-".base64_encode(hash('sha256', 'console.log("Hello world");', true))."'"); ?> <script>console.log("Hello world");</script> ...
-1
votes
3answers
167 views

Find and solve XSS in this code

I need to find a XSS and propose a solution in the following code: <form action="#" method="post"> <input type="hidden" name="id" value="<?=$id?>"><br> <textarea ...
0
votes
3answers
281 views

How to leverage a stored XSS to perform a file inclusion?

I have identified a stored XSS and I'm wondering, how could I leverage that vulnerability to upload a shell.
3
votes
2answers
148 views

Webapp vulnerability scanner that understands continuations

I'm researching XSS vulnerabilities in a web application which uses continuations. That means that for a given form, the URI the form data is posted to is unique and different every time. A first GET ...
5
votes
4answers
1k views

Suggestions to avoid cookie-hijacking in a web application

I've been developing web-apps for quite some time now. While making websites, the "remember me" feature is one of the most trivial(read as must-have-for-clients) feature to be implemented. Until ...
1
vote
1answer
425 views

Content sniffing XSS vulnerable browsers

In order to prevent Cross-site scripting (XSS) in a private web application that supports image upload, I intend to reject browsers that are vulnerable to content sniffing. Which browsers are ...
0
votes
2answers
174 views

Can running a script while logged in compromise my facebook password?

In websites related to facebook malware analysis and information, we often see messages to the effect of if you have run this facebook app then your account has been compromised, or if you went to ...
1
vote
2answers
1k views

Is cross site scripting possible with the img alt attribute?

My question is, if any characters are allowed in the alt attribute of an img tag (except for double quotes), is XSS possible? Valid image or not.
0
votes
3answers
166 views

XSS in the context of a CDN

Say there is a website example.com. It hosts static content from a CDN, example.net. This site allows uploading an image, which will then be served from the CDN. This images can be SVGs and they are ...
1
vote
0answers
370 views

How safe is Apache's Commons StringEscapeUtils.escapeXml function to prevent XSS

I am using escapeXML StringEscapeUtils.escapeXml to prevent XSS in my Java application. But I am wondering if it resolves XSS to the fullest. I have tried some XSS attack vectors, and escapeXml seems ...
0
votes
2answers
728 views

How does the anchor tag (<a>) lets you do an Reflected XSS?

I was going through the OWASP XSS Filter Evasion Cheat Sheet and and I came across this section where there is an anchor tag used to do an XSS in the following forms: <A ...
4
votes
1answer
257 views

XSS via PDF when Content-Disposition: Inline?

There are kind of two questions here: Is it possible to have XSS in a PDF file when the Content-Disposition: is "inline"? If it is possible, does the pdf get access to the cookies for that domain ...
2
votes
0answers
386 views

Content-Security-Policy & Facebook login

This question seems to be related to http://stackoverflow.com/questions/15913200/facebook-js-sdk-not-executed-in-my-chrome-extension , but I am not developing a chrome extension. I am developing a ...
0
votes
1answer
84 views

Simpler idea for protection against reflected XSS on client side

I was going through some CLIENT side defenses against reflected XSS e.g. XSS auditor(chrome), IE8 XSS Filters, NoScript. They use regular expression and other sophisticated techniques. Why didn't they ...
1
vote
1answer
91 views

Simple protection against reflected XSS

I was going through some CLIENT side defenses against reflected XSS e.g. XSS auditor(chrome), IE8 XSS Filters, Noscript. They use regular expression and other sophisticated techniques. My question ...
1
vote
3answers
251 views

Does this reflected XSS vulnerability pose any real threat?

I have a web site where users can enter some text into a textbox and that text is immediately rendered in a div using javascript (strictly front end). If a user enders something like this: This is ...
-1
votes
1answer
59 views

Detect xss from httprequest and response

I scanned my site using a tool that detects xss vulnerabilities. As a result, the tool generates a report that contains httprequest and response of vulnerable pages. Now my question is how this ...
1
vote
2answers
966 views

How to prevent XSS from url

I found xss vulnerabity which is exploited by appending attack in the url parameters. For eg. the original url site.com/?s=login&m=forgotten And the attack url ...
4
votes
1answer
1k views

Do PHP frameworks such as Zend, symfony and CakePHP provide default protection against cross site scripting?

ASP.NET MVC provides default protection against cross site scripting. Just wondering, if PHP frameworks do the same?
0
votes
2answers
1k views

Effectively Pentest a Wordpress Site

When it comes to blackbox pentesting of a Wordpress site, the first thing to come to mind is WPScan [http://wpscan.org/]. While pentesting some sites, I faced a common issue i.e it shows that ...
1
vote
1answer
140 views

BeeF - How does it work?

I'm mainly server sided. I haven't worked with JS that much before. My coworker was talking about beef and how it basically controls the victims browser just by a simple xss attack I was wondering ...
1
vote
1answer
1k views

XSS with style attribute background-image

I've tried to verify some vectors from OWASP XSS CheatSheet which exploits style attributes STYLE tag using background-image ...
5
votes
4answers
2k views

Is chrome completely secure against Reflected XSS?

I notice that Chrome does not execute scrips that are part of the web request, http://vulnerable_site?pageTitle=<script>alert('xss')</script> With such links since the script is as part ...
4
votes
2answers
205 views

Does allowing the <cite> tag create any XSS vulnerabilities?

Backstory: Stack Exchange's markdown parser allows a couple of HTML tags (a,b,i,img) through, with some restrictions on the attributes to prevent XSS. We're thinking of requesting the <cite> tag ...
0
votes
2answers
885 views

Malicious query string removal ASP.Net MVC5

My web application is built with ASP.Net MVC5. One of the method accept query string params. Security testing has reported that it accepts malicious query string and displays in the body without any ...
0
votes
1answer
479 views

XSS - Quote Breaking

First of all i don't know if this question already mention here, believe me i search already. so i was trying to break string inside single and double quote of attr below; ...
1
vote
2answers
149 views

Using “Dynamic Hash Technique” to protect cookies from XSS?

This paper appears to describe a solution in which XSS attacks stealing cookies are made pointless by having the server send clients a cookie with a hashed name. Whenever the user sends the cookie ...
6
votes
1answer
417 views

Would using Google reCAPTCHA allow Google to cheat?

Wanting to go a step further into reducing the attacking surface from my "register new user" form I think on using reCAPTCHA (the one Google offers). Having bots sorted out from being able to ...
1
vote
1answer
95 views

Digitally signed scripts as a way to thwart XSS

As a blanket approach to dealing with XSS attacks, rather than having to remember to escape user-generated code, is there a way to instruct the browser not to execute any script or script-function ...
2
votes
2answers
794 views

DOM XSS attack failing in Firefox

I am trying to perform DOM XSS attack to exploit a vulnerability of localhost webpage. I am able to perform the attack successfully on IE-11 and Chrome. But Firefox is preventing me to perform the ...
1
vote
0answers
109 views

Hacking attempts:in.js

A client of mine keeps getting hacked by seemingly SQL injection where a script tag containing a link to an "in.js" file is added. Sometimes from a domain called sportserve.co.uk, other times from ...
2
votes
1answer
321 views

.NET provides 8+ ways to encode data to prevent XSS attacks. Which one should I use when? [closed]

I'm looking at ways to use .NET to prevent XSS attacks and have come across the following methods to encode data: string asdf = WebUtility.UrlEncode(code); string asdf1 = ...
0
votes
1answer
347 views

False Positives- Server side protection against XSS

I read about XSS attacks and its prevention mechanism on server-side. It seems only protection is to sanitize the input by escaping special characters on server side (Using some PHP functions such as ...
0
votes
1answer
1k views

exploit document.write with unsanitized user input

I'm trying to inject javascript into a js scriptfile but it's not working. I have the following setup: html file with javascript-file include (all inline js is blocked!) Welcome, <script ...
0
votes
1answer
349 views

Is it html escape enough for mitigating all xss, if html is going to be generated only in client side?

If all html in a site is generated in client side (attributes, urls, styles everything will be concatenated in javascript and set as innerHTML), is it doing only html escape enough for mitigating all ...
1
vote
2answers
2k views

Is jQuery.val() enough to prevent XSS

Is obtaining the value of a textarea/input with the jQuery function .val() XSS-proof? <html> <textarea id="t1"></textarea> <script> var toBeDisplayed = ...