Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS), DOM-based XSS (aka client side XSS).

learn more… | top users | synonyms

1
vote
2answers
137 views

Using “Dynamic Hash Technique” to protect cookies from XSS?

This paper appears to describe a solution in which XSS attacks stealing cookies are made pointless by having the server send clients a cookie with a hashed name. Whenever the user sends the cookie ...
6
votes
1answer
346 views

Would using Google reCAPTCHA allow Google to cheat?

Wanting to go a step further into reducing the attacking surface from my "register new user" form I think on using reCAPTCHA (the one Google offers). Having bots sorted out from being able to ...
1
vote
1answer
86 views

Digitally signed scripts as a way to thwart XSS

As a blanket approach to dealing with XSS attacks, rather than having to remember to escape user-generated code, is there a way to instruct the browser not to execute any script or script-function ...
2
votes
2answers
564 views

DOM XSS attack failing in Firefox

I am trying to perform DOM XSS attack to exploit a vulnerability of localhost webpage. I am able to perform the attack successfully on IE-11 and Chrome. But Firefox is preventing me to perform the ...
1
vote
0answers
106 views

Hacking attempts:in.js

A client of mine keeps getting hacked by seemingly SQL injection where a script tag containing a link to an "in.js" file is added. Sometimes from a domain called sportserve.co.uk, other times from ...
2
votes
1answer
234 views

.NET provides 8+ ways to encode data to prevent XSS attacks. Which one should I use when? [closed]

I'm looking at ways to use .NET to prevent XSS attacks and have come across the following methods to encode data: string asdf = WebUtility.UrlEncode(code); string asdf1 = ...
0
votes
1answer
272 views

False Positives- Server side protection against XSS

I read about XSS attacks and its prevention mechanism on server-side. It seems only protection is to sanitize the input by escaping special characters on server side (Using some PHP functions such as ...
0
votes
1answer
708 views

exploit document.write with unsanitized user input

I'm trying to inject javascript into a js scriptfile but it's not working. I have the following setup: html file with javascript-file include (all inline js is blocked!) Welcome, <script ...
0
votes
1answer
233 views

Is it html escape enough for mitigating all xss, if html is going to be generated only in client side?

If all html in a site is generated in client side (attributes, urls, styles everything will be concatenated in javascript and set as innerHTML), is it doing only html escape enough for mitigating all ...
1
vote
2answers
2k views

Is jQuery.val() enough to prevent XSS

Is obtaining the value of a textarea/input with the jQuery function .val() XSS-proof? <html> <textarea id="t1"></textarea> <script> var toBeDisplayed = ...
7
votes
2answers
1k views

PHP: if charset mismatches (htmlentities UTF-8) viewed by client as ISO-8859-1 (or vice versa)

Short Question: Question: Could any security vulnerabilities arise if a server runs htmlentities as UTF-8 but the client views the results as ISO-8859-1? Assumption: No vulnerabilities exist when ...
0
votes
2answers
793 views

Is SSL a mitigating factor for HTTPonly not set on cookies?

I have a few sites that are using HTTPS (no mixed mode HTTPS/HTTP). The cookies do not have a HTTPOnly flag set. They do pass along session IDs. Also some of the sites do not have a "Secure"flag set ...
0
votes
1answer
310 views

XSS attack vector without forward slash?

is there an XSS attack vector that allows the inclusion of a external .js file without having to use forward slashes? let's say the path of the file is somewebsite.com/js/xss.js Is there a way to ...
1
vote
2answers
778 views

What is the difference between ordinary XSS and Dom XSS vulnerabilities? [duplicate]

I'm not a computer guy, but just out of curiosity I've recently started to learn PHP for programming my own website and I've read about some most common vulnerabilities that exist in web applications. ...
2
votes
2answers
354 views

Bypass cookie validation

I have discovered that a web application allows the setting of certain cookie values through request parameters. Each request param results in a separate Set-Cookie header. i.e. a request like this: ...
0
votes
1answer
168 views

Preventing body onload xss that is injected as a request parameter

I have a rails 4.0.1 app that allows locale as a request parameter. Here is what i saw when i tested my app on firefox; ...
1
vote
1answer
122 views

Code injection in files with 0644 permissions

My subject says it all - I am clueless as to how a file with permissions 0644 can keep getting iframe injections. None of the posts on this site that I saw quite described what I am experiencing. ...
1
vote
2answers
147 views

Is Temporary XSS a Problem?

I use a site on a regular basis so I wanted to make sure it was secure. One of the things I checked was that when I changed my first name to <img src="http://blah.blah/blah/blah.notanextension" ...
0
votes
2answers
59 views

Prevention from cross site scripting in different scenerio?

I could not validate malicious characters like ' .< > etc because these characters are required in my application. Also I could not encode characters because user supposed to enter HTML tags in my ...
4
votes
1answer
251 views

Why would a user agent string be executed?

I'm having trouble understanding how a particular XSS vulnerability might arise in the real world. Guides for two of the exercises on hackthissite.org: ...
1
vote
1answer
108 views

HTTP security headers on non HTML (images, JavaScript, etc)

Let's say, the HTTP security headers below are applied to all HTML pages of a site: HTTP Strict Transport Security (HSTS) X-Frame-Options (XFO) X-XSS-Protection X-Content-Type-Options Is it OK to ...
5
votes
2answers
622 views

Is it safe to use createHTMLDocument to sanitize HTML?

i'm wondering how safe it is to use createHTMLDocument to do HTML sanitization. I've tried to implement it like this: function sanitize(string) { var elm = ...
2
votes
3answers
296 views

OWASP escaping recommendation - why /?

In OWASP recommendations regarding escaping untrusted input for HTML element content, they list the following: & --> &amp; < --> &lt; > --> &gt; " --> &quot; ' ...
1
vote
1answer
87 views

Base Programming for vulnerabilities

Hello, I am a beginner looking for some information. My question is the following: In order to understand certain security concepts is it essential that I understand the underlying languages? For ...
1
vote
1answer
179 views

Can a Java servlet filter be used to pull out scripts that aren't whitelisted?

I might be asking a similar question to this: Whitelisting DOM elements to defeat XSS But I think my proposed solution is different and I was wondering if I could get the community to comment on ...
5
votes
3answers
524 views

Escaping rich text editor output

When having a rich text editor on a web application, what is the best way to escape HTML entities and prevent XSS attacks but keep the formatting (<b>, <i>, <u>, ...etc.) ?
2
votes
2answers
8k views

XSS cookie stealing without redirecting to another page

I'm practicing in VM following the OWASP guide. I know that is possible to steal the cookie by redirecting to "False" page etc. but I would like to steal the cookie without redirecting on another ...
0
votes
1answer
103 views

How to find malicious images in server?

Recently my Drupal site on a Linux server has been targeted by session hijacking attacks. I guess the attacks were originated from images containing malicious code which where uploaded to the web root ...
10
votes
1answer
282 views

Should Content in <noscript> Blocks Be Escaped

The title pretty much says it all. It seems counter-intuitive to escape inside a <noscript> block because any js that an attacker is able to inject there shouldn't be executed. But, I'm still ...
0
votes
3answers
148 views

Regarding Cross-Site Scripting attacks

My application has an Upload Management Module and accepts Excel and text files to our server. I detected invalid data inside some uploaded files (the uploader put ...
6
votes
1answer
3k views

Host Header Attacks

So reading this blog post, I know how the password reset works and how it's exploitable, but in a real case scenario, how would XSS be possible? Is there a way to send a victim to a page with the host ...
2
votes
1answer
777 views

Cross site Scripting in HTTP Method?

Lately, I've noticed that many web server configurations reflect the method of an HTTP request sent with a non implemented method in the body of the server's response. For example, A request sent ...
4
votes
2answers
1k views

XSS Vector Without Forward Slashes or Spaces

I need an XSS vector that doesn't use forward slashes or spaces. I've gone through lists of hundreds of vectors, but they usually have one of those two. The space gets URL encoded, and anything after ...
2
votes
2answers
439 views

What hacking risks a site has if it has no input boxes?

I recently posted a question about recovery of website from XSS attacks, http://stackoverflow.com/questions/20759081/how-to-recover-a-site-after-an-xss-attack... Doing a bit more digging online, i ...
6
votes
2answers
492 views

How is DOM XSS possible here?

I was looking at this website and trying to understand how this XSS is possible, but I just can't figure it out. Here's the URL: http://www.domxss.com/domxss/01_Basics/05_jquery_html.html?681973661 ...
4
votes
2answers
1k views

UTF-7 XSS attacks in modern browsers

I've recently read about utf-7 XSS-attacks (i.e. Ned Batchelders article at http://nedbatchelder.com/blog/200704/xss_with_utf7.html) but could not get any UTF-7 attack to work in modern browsers. (I ...
5
votes
2answers
174 views

Any eventhandlers that apply to hidden elements?

Im trying to XSS a search field and my attack vector is getting reflected like this: <input type="text" id="txtRpHiddenKeyword" style="display: none;" value="ATTACK VECTOR HERE" /> Only ...
3
votes
1answer
1k views

ASP.NET Web API and potential XSS

I'm wondering if my ASP.NET Web API had an XSS vulnerability as my controller didn't have a method to handle the default GET call. Without the GET method being handled in the code a call to ...
9
votes
2answers
1k views

Is Django's built-in CSRF protection enough?

Django sets a CSRF protection token on the user's machine via a cookie. It then asks for the token on POST requests. If these two don't match, it returns a 403. If I change manually both the cookie ...
0
votes
1answer
636 views

How can attacker bypass this dom xss filter? [closed]

I'm trying to solve an dom xss challenge where filter used is : var anchor = window.location.hash.substring(1); if (window.location.href.match(/(script|javascript|src|onerror|%|<|>)/g)) { ...
2
votes
2answers
778 views

PHP on IIS 7.5 Hacked - How do I find and fix the XSS Injection?

I discovered that someone had gained access via FileZilla server software to my Windows 2012 Server. It seems like they had created extra accounts and were trying brute force attempts to get in nearly ...
1
vote
1answer
151 views

handle user-session-cookie and csrf token correctly for javascript app

I have a django web app serving restful api endpoints and a javascript web app communicating with those endpoints through ajax. They are under the same domain but in different ports. server api ...
5
votes
1answer
842 views

What is mutation XSS (mXSS)?

I was unable to find any good documentation or anything on mXSS. Can anyone give some info or give a link? I found a video and a PDF of the video's presentation: ...
4
votes
2answers
273 views

XSS when <, > and " are escaped

I'm pentesting a website that has a reflected XSS, or at least a vector for a reflection, but the issue is the following : It escapes <, >, " to their URL entities (not &, ) or () You are ...
0
votes
3answers
3k views

How can I control the content of the HTTP HOST header in requests issued from my website?

Is anyone familiar with a way in which I can post a link on my website, that when accessed will cause users to issue an HTTP request to a 3rd party site with custom content in the HOST header ...
4
votes
1answer
99 views

can Veracode be taught to accept mitigations that it does not yet recognize

Veracode (http://www.veracode.com/) has certain parameter encoding libraries that it trusts. Others are labeled as flaws. If I'm satisfied with another method of parameter encoding that is meant to ...
1
vote
2answers
2k views

How to do server side validations in Java to prevent XSS? [closed]

When i use method Get and intercept the request with any proxy tool. then Cross site scripting because of absence of server side validations. But in case of post method, as we know data flows in the ...
0
votes
1answer
96 views

Verifying one specific attack vector of Cross Site Scripting

Burp suggests that there is a reflection.. It changes a value of a cookie named as x as x=<script src=abc.js> and in response this value gets injected to a javascript function.. <script ...
2
votes
1answer
515 views

Using Selenium tool for xss scripts

Ok, so i need to know can Selenium webdriver tool be used for testing xss vulnerabilities and exploits. If its possible, then pleasee provide me with some example or tutorial. Apologizes, if am wrong ...