Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS), DOM-based XSS (aka client side XSS).

learn more… | top users | synonyms

2
votes
1answer
287 views

Newline XSS vulnerability

So I was experimenting with XSS using new line (%0A) character. So I got to the usual vector: '%0Aalert(/xss/)// and one thing came to my mind. What if you can't insert a quote? A new line will break ...
3
votes
1answer
1k views

Is it possible to exploit XSS inside User-Agent header? [duplicate]

I've found an xss bug inside user-agent header on one popular buy/sell site , and after reporting it to them , they answered that it is not dangerous as it can not be exploited without user ...
4
votes
1answer
483 views

CodeIgniter CSRF confusion

I have been working with CodeIgniter for about 3 weeks and am very well on the way to loving this framework. However I have been looking at the core code of the framework and I was reading over the ...
6
votes
3answers
283 views

How and where can I best announce an XSS vulnerability in a relatively well-known website?

I'd like advice on how and where to announce an XSS vulnerability (persistent XSS to be exact). My greatest fear is the announcement getting snowed under, thus rendering the disclosure ineffective in ...
2
votes
2answers
323 views

HTTPOnly Cookies: Security Depends on Client Cooperation?

I've been implementing HTTPOnly cookie-based session handling and have some questions about what HTTPOnly means. I realise it's a flag that gets passed around in the HTTP header when setting cookies. ...
2
votes
2answers
909 views

Minimum size of input text box required for XSS attacks

I have below code to accept User login ID as input from User. <input name="userName" type="text" id="userID" maxlength="8"/></td> Maximum number of characters that a end user can input ...
3
votes
2answers
1k views

Is XSS possible here? Challenge

Is possible to bypass my regex and execute any javascript? <script> function json(a){ if (/^\s*$/.test(a) ? 0 : /^[\],:{}\s\u2028\u2029]*$/.test(a.replace(/\\["\\\/bfnrtu]/g, ...
4
votes
1answer
624 views

Do javascript: URLs starting with // allow XSS?

I found a markup processor that allows users to include arbitrary links, as long as they contain a "netloc" (// after the first :). Due to the myriad of exploitable protocol handlers, this is ...
1
vote
0answers
44 views

How can I explain Cross Site Scripting in a non-technical way? [duplicate]

Possible Duplicate: Can anybody explain XSS to an idiot? I can reasonably explain Cross Site Scripting (XSS) in technical terms to other technically minded people or people familiar with ...
1
vote
2answers
743 views

What vulnerabilities in the OWASP Top 10 are relevant to WordPress?

I have been looking at the OWASP Top 10, and am wondering which of the top 10 security risks are relevant to a WordPress installation with various plugins installed? I know injections and XSS are ...
4
votes
3answers
395 views

XSS risk for an application which can be accessed from localhost only

I have an web app which can used via an browser. The web app can be accessed on localhost only. No remote access is possible. A security tool discovered an XSS issue. Now if this web app is works only ...
1
vote
2answers
315 views

Breaking out of attribute in double quotes

I have a piece of code that allows for [url]someurl[/url] BB-Code and replaces it with <a href="someurl">someurl</a> It takes two precautions to prevent XSS. It replaces ...
19
votes
1answer
3k views

Is Django's built-in security enough?

I have learned that Django provides built-in protection against the three main types of web app attacks (SQL injection, XSS and CSRF), which is really awesome. Yet I have spoken to a few Django ...
2
votes
1answer
256 views

Email Compromised due to Yahoo Mail Exploit

On Monday due to XSS vulnerability present in the Yahoo mail my email has been compromised. I have immediately changed my password but i am not sure is this enough i.e. do i need to delete my cookies ...
5
votes
1answer
203 views

Question about XSS example

A friend of mine received an email from someone (a reputable sender), and I noticed that the following was tagged onto the end of the subject: ...
4
votes
2answers
297 views

Closing an HTML tag without using the actual character

I'm currently learning how to perform XSS on websites, but there is a constant problem that keeps recurring that I'm sure must be easy to bypass. Quite often, the website will filter out quotation ...
12
votes
3answers
451 views

What does a HTML filter need to do, to protect against SVG attacks?

I recently learned that SVG (Scalable Vector Graphics) images introduce a number of opportunities for subtle attacks on the web. (See paper below.) While SVG images may look like an image, the file ...
0
votes
3answers
501 views

How can this xss challenge be solved? [closed]

I found this : http://research.insecurelabs.org/xssmas/ And so far my solutions were: 1.http://research.insecurelabs.org/xssmas/search.php?query=<script>alert(0)</script> 2. ...
2
votes
4answers
3k views

What does scorecardsresearch.com/beacon.js - added by Disqus.com - do?

I recently added Disqus to my site. Looking at the "scripts" tab on Firebug, I noticed a script called, http://scorecardresearch.com/beacon.js (here is a prettified version - the script is not ...
3
votes
1answer
233 views

How did the Tumblr worm spread?

Recently Tumblr was hit by a fast-spreading worm. How did the worm work? What was the vulnerability in Tumblr that it exploired? Did it exploit a XSS vulnerability in Tumblr? A CSRF vulnerability ...
1
vote
1answer
234 views

Need an explanation of Cross-Site Flashing?

I found this - can anyone provide me examples of how these issues are exploited?
2
votes
1answer
196 views

Possible to execute a non-persistent XSS attack without using the url/query string?

I've been reading up on non-persistent XSS and all of the examples I have found use the situation where a webpage takes something from the url/query string and places it on the page. Is there any ...
4
votes
4answers
454 views

Is it possible to make an xss with only html tags

I'm not aware of all the xss tricks.. While programming in Ruby on Rails, using a sanitize method to allow only certain tags and it makes its best to clear all the other tags and scripts the ...
1
vote
2answers
256 views

I need explanation on how serious these vulnerabilities are?

I have found two vulnerabilities on my college site and I want to report them but don't know if these are "really" vulnerabilities : RFI inside SWF file. Example: ...
2
votes
4answers
833 views

referrer checking as a defence for XSS attack

After reading the question about referrer and the answer of @D.W., I did not understand the following part: XSS defense. Strict referer checking can make reflective XSS attacks harder, because ...
2
votes
4answers
1k views

What XSS attacks doesn't “Reflective XSS Protection” defeat?

Its been quite a while since I have played with cross site scripting vulnerabilities but today I came across a website today that was crying out to be tested for a basic XSS vulnerability. So ...
7
votes
2answers
662 views

Drupal filters XSS with regexes. What could bypass it?

Drupal filters HTML strings against XSS attacks using regexes: http://api.drupal.org/api/drupal/includes%21common.inc/function/filter_xss/7 However, as a lot of people know, HTML can't be parsed with ...
0
votes
1answer
894 views

How to escape user input in a value of javascript object?

How to properly escape user-controlled input when it's inserted as a value in JSON object? <script> $(document).ready(function() { new MyObject({ key1: "user_input", key2: ...
0
votes
1answer
460 views

How to show xss alert box when you are inside function in <script> tag?

For example we have this: <script type="text/javascript" charset="utf-8"> $(function () { var stranica = "#aXSSinjection point"; var stranicaContainers = $('div.stabs > ...
4
votes
2answers
174 views

filtering content in Content disposition header

I was reading "The Tangled Web"(A book that I'm enjoying very much) and I have a doubt in the following excerpt taken from it :- When Handling User-Controlled Filenames in Content-Disposition Headers ...
4
votes
2answers
423 views

CSRF Protection on static pages

I have a static site which has forms. The forms submit to a Rails endpoint which captures the submitted data. The static site and the Rails endpoint are on the same domain, on different subdomains and ...
8
votes
3answers
317 views

E-mail read receipt through XSS

I recently stumbled upon a really silly/unsafe but an interesting way to get a read receipt of an e-mail. I'm not 100% sure if the method in use works, which is why I'm asking it here. G-mail does ...
2
votes
5answers
3k views

Efficient way for finding XSS vulnerabilities?

Manual (reliable) way: Put string containing characters that have special meaning in HTML into some parameter of HTTP request, look for this string in HTTP response (and possibly) in other places ...
5
votes
2answers
2k views

How can I prevent reflected XSS in my JSON web services?

I have a web service that takes POST data (JSON) and returns part of the request object in the JSON response. This is open to XSS if the response is rendered as HTML by the browser since someone ...
5
votes
5answers
3k views

XSS : Blacklist characters vs. whitelist

I have been studying to prevent my web app against XSS. I read about it on OWASP and other security channels, they all say that use ESAPI and similar library, and also do input filtering through ...
2
votes
2answers
594 views

Is Drupal's filter_xss enough for filtering HTML?

Drupal has filter_xss function. Is it safe to use for filtering arbitrary user HTML input? If not, what should be used instead when using Drupal 7? This questuion is a duplicate of Drupal's built-in ...
4
votes
1answer
796 views

XSS inside CSS when " is encoded?

I'm trying to make XSS work on one site.It allows me to edit CSS which is then included inside web page source , but it won't allow me to use " , only ' . Source is like this: body { margin: 0; ...
5
votes
1answer
195 views

Where does the responsibility lie for a XSS vulnerability

I am an avid user of Workflowy (online outliner/note taking tool) and I installed the Chrome extension 'Workflowy for Coders', which formats the text within notes. I discovered that one of my notes ...
2
votes
4answers
2k views

Current best practices to prevent persistent XSS attacks

I have a text field that allows the user to type whatever he/she wants. After saving, the results are later displayed on the screen to potentially many people. XSS seems a bit like black magic to ...
2
votes
4answers
3k views

What is the danger of Reflected Cross Site Scripting?

What is the danger of Reflected Cross Site Scripting? I understand the Reflected XSS is dangerous, because it's possible. But what practical attacks can be performed using Reflected XSS?
0
votes
1answer
546 views

scanning my site for JavaScript/XSS vulnerabilities [closed]

It have had a report that my site may have a security issue and there is some JavaScript loading 10 times per second. www.ayrshireminis.com Is there anyway that I can "scan" my site to check if ...
1
vote
2answers
166 views

Why ban XSS instead of flagging it?

Consider a browser that allows an XMLHttpRequest downloaded from foo.net to make requests to bar.net, but attaches a XHR-Origin: http://foo.net (or possibly a more descriptive value like ...
1
vote
1answer
190 views

Web Application Firewall Rule Optimization

Following are the two Rules taken from ModSecurity CRS core Ruleset. These two rules are base Rules for XSS attacks. If we look at these two rules their variables and actions are same what they differ ...
2
votes
2answers
301 views

What is cross-site-scripting? [duplicate]

Possible Duplicate: Can anybody explain XSS to an idiot? First I ask is there an aboslute definition? I've done some Googleing and it seems like everyone says something different. On SO ...
4
votes
2answers
263 views

Can anybody recommend any gems for checking security vulnerabilities?

I want to check one of my RoR projects for security vulnerabilities. So can anybody recommend any gems for my needs?
1
vote
2answers
963 views

HTTP TRACE vulnerability discovered - what should I do

First, why is HTTP TRACE method allowed on a website Isn't it a bad thing for web server or its users' security? Second, when I run the following PHP script via my browser... <?php $service_port ...
3
votes
2answers
426 views

Risks of serving untrusted content under HTTP Content-Type: text/plain?

Am I gonna run into XSS attacks by doing this, or will a file download be prompted? Are there security problems that would rise in a modern browser?
4
votes
2answers
363 views

Are sandboxes overrated?

I've stumbled upon the following on the blog of the NoScript developer Giorgio Maone. First, he quotes the following ArsTechnica article about an XSS bug in Adobe Flash: As useful as sandboxes ...
6
votes
1answer
5k views

Does Google Chrome protect against cross site scripting (XSS)?

In Firefox I've been using the NoScript extension to protect myself from certain malware attacks. NoScript is well known as it's a very powerful extension for Firefox and introduced protection from ...
3
votes
3answers
2k views

Why doesn't the same origin policy block get requests what contain arguments?

From what I understand, the same origin policy prevents scripts in a web page from talking to servers outside of the present domain (using post, xmlhttprequest, etc). I assumed that get requests ...