Questions tagged [xss]
Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).
1,528
questions
0
votes
1
answer
7k
views
Is it possible to bypass httponly?
I read some articles about XSS and how to mitigate the flaws in a web application. I've seen the HttpOnly on Set-Cookie. Can this flag be bypassed? Or is there another way to access a session cookie?
...
0
votes
1
answer
117
views
Is there a good place to find WAF rules tested? [closed]
I am searching evaluated WAF rules that check OWASP Top 10 and even more to have decent protection of a web infrastructure.
3
votes
1
answer
195
views
Escaping angle brackets if entry point is between tags?
So I'm trying to evade a filter that escapes < and >.
I read that it's possible if the XSS gets injected inside a tag, but in my case, it gets injected between <span></span>.
Are ...
1
vote
1
answer
129
views
CVE-2019-14748 but the file is downloaded and open locally - can it be used for XSS?
I'm testing CVE-2019-14748 on an example.com with osTicket. I've uploaded a test.html with the basic <script> and <img> XSS payloads which run when a user opens test.html. However, in ...
0
votes
2
answers
202
views
can i execute javascript in href when i have text before my input?
This is where I took this example from:
<a href="<?php echo $_GET['e'];?>">Back</a>
In this code, I can do http://my_url?e=javascript:alert()
But what can I do if my code ...
1
vote
0
answers
118
views
Bypassing Comment by XSS
I'm learning Web Security currently, and my tutor left this practice for us. Is there any solution to bypass this js statements and as a result, for example, to display alert(1)? Thanks!
input = input....
1
vote
0
answers
339
views
Safely render HTML template with inline CSS from trusted domain (it forces the use of "style-src: unsafe-inline" in CSP)
I am working with a form that a user can fill out to send an e-mail. As part of the form, there is a preview button that shows the user a preview of how the mail will look in a new tab in the browser. ...
1
vote
1
answer
226
views
XSS injection in the name of a file to be sent
I found a reflected XSS in a POST request that sends a file to the web server.
The HTTP POST Request
The HTTP 200 OK Response
When I want to try to insert document.cookie in the payload, the web ...
1
vote
0
answers
163
views
XSS on marketing websites like craigslist. How does this work on a technical level? [closed]
I was wondering how this works.
We have a marketing site in Holland where people can sell second hand goods.
Rumor goes that there is a lot of phishing going on there and XSS code is used in the ...
1
vote
0
answers
2k
views
XSS with Template Literals
I suspect I have a potential XSS vulnerability at a client-side level, however, I'm not able to exploit it successfully.
The URL I'm using consists of three parameters that reflect back to the user ...
0
votes
0
answers
440
views
prevent dom based - xss from js file in mvc
I'm using a free template as a front end in my application and the main javascript file came out as a high risk as it's vulnerable to a dom based cross site scripting.Is there a way to sanitize the ...
1
vote
0
answers
337
views
Decoding burp XSS DNS resolution payload
I'm testing burp against a vulnerable application as part of work for my client. There was one successful xss payload related to DNS lookup which worked on form data at point of file-upload. Here is ...
13
votes
1
answer
17k
views
How is it possible that a <script> tag was injected, but not executed?
I've recently tested a web application and found out that it was vulnerable to Stored XSS attacks. However, a peculiar behavior left me a bit puzzled. When I inserted John <script>alert(1)</...
6
votes
2
answers
2k
views
What is the point of having a refresh token if it can be as easily stolen as an access token on client-side/JavaScript applications (SPA/PWA)?
From my understanding, the point of having a refresh token and short lived access tokens is to mitigate the consequences of having the access token stolen. This way, if this happens, the attacker will ...
1
vote
1
answer
455
views
Is it possible to bypass malformed Content Security Policy missing quotes?
I found a website that has a very strict but malformed Content Security Policy of the form:
Content-Security-Policy: script-src none
which should actually be
Content-Security-Policy: script-src 'none'...
0
votes
2
answers
832
views
Bypassing htmlentities() for XSS attack
I'm only a beginner so if any more info is needed just request and i'll update the question.
For one of my modules we are covering cross-site scripting and I have been given a series of PHP files that ...
0
votes
2
answers
494
views
Does CSP mitigate against client prototype pollution XSS and DOM XSS?
DOM XSS and client prototype pollution-based XSS have one thing in common, we are modifying the pre-existing JavaScript code to popup an alert(1). Will CSP mitigate XSS in this case? Theoretically, ...
0
votes
0
answers
671
views
How to evade Angular HTML sanitizer for XSS
I'm trying to evade the HTML sanitizer in a field I found more vulnerable in my application to test some XSS injection.
The field that I'm trying to exploit is a dropdown with the following code. The ...
1
vote
1
answer
143
views
Getting an abnormal amount of firewall warnings on web server
I just had a look at the firewall status and saw it had blocked over 300 requests from TOR, Python Urllib, and some script called aabbccdd.xss.ht/pigeonburger.xyz (pigeonburger.xyz being my website).
...
1
vote
1
answer
2k
views
XSS without angle brackets
I would like to run the following script inside an input tag when the page loads.
I know how this can be fixed by using onfocus and autofocus.
But how do I get the expression document.cookie in there?
...
29
votes
6
answers
7k
views
Is splitting a REST API server from a Web server considered a security threat?
I am participating in a project that involves a JavaScript SPA that provides a service and is intended to interact via REST APIs with one of our servers. Initially, I proposed to work on the two ...
0
votes
0
answers
115
views
Should you even bother trying to hide authentication from XSS?
I read a comment on here that goes something like "trying to hide user authentication from an XSS attack is like reinforcing your fridge against a nuclear bomb; at that point, you've got much ...
1
vote
2
answers
616
views
Can “c:set” cause Cross Site Scripting (XSS) vulnerability?
Can this be exploited as XSS vulnerability using urls like localhost/?myVar=<script>alert(document.cookie)</script> or though any other possibility?
<c:set var="myVar" value=&...
0
votes
2
answers
475
views
What parts of the javascript code can an XSS attack access? [duplicate]
I understand that XSS attacks can access all globals (like cookies, storage, etc) within the context of the running javascript code, but I would like to understand if they could also have access to ...
3
votes
0
answers
1k
views
How can I implement CSRF Tokens without server-side rendering/templating?
I am attempting to build an application that submits numerous fetch/XHR requests to a NodeJS backend. I'd like to implement CSRF token protection, but would like to avoid implementing server-side ...
0
votes
0
answers
987
views
Sanitising data for a flutter application
I am having trouble with some user input security. I have a Flutter app where users can submit comments that can contain text e.g. a-z characters, numbers, symbols and emojis. These are stored in a ...
0
votes
1
answer
1k
views
It's possible to trigger a XSS in url context without this following caracter ' : '?
I try to bypass a XSS filter to trigger a XSS in url context.
But the problem this following char is blacklist ' :'
The site allow the user to use some basic html balise like h1, h2, h3, p, a, u, etc ...
1
vote
1
answer
2k
views
XSS in a variable assignment when <>" are escaped
SCENARIO:
user input is reflected inside a variable.
For example
url.com/?a=hello
is reflected as shown below
var test="hello";
I tried to evade from the variable with payload like hello&...
1
vote
0
answers
974
views
Do object-src and base-uri bypasses still work on Content-Security-Policies?
I'm assessing the security level of a webapp and one of the test cases is the CSP header. I always use the Google CSP evaluator to assess the header. Let's consider the following CSP header:
Content-...
0
votes
0
answers
202
views
XSS on port other than 80 not working
I am currently doing a boot2root VulnHub machine and I have found an XSS entry point to steal admin cookies.
The strange thing is that if I run my SimpleHTTPServer on port 80 then the following ...
0
votes
2
answers
1k
views
ASP.Net XSS - How does this vulnerability work
I have been tasked with fixing a XSS issue in an ASP.Net application, but I have never seen this kind of attack before so first it would be great if I could understand how this is working and then I ...
2
votes
2
answers
2k
views
Self-XSS From File Upload Name
I encountered this type of vulnerability a couple of times but was not able to fully exploit it.
This vulnerability is a self-xss which is triggered from file names. E.g. If I were to upload a file ...
1
vote
2
answers
957
views
Open Backdoor in web browser using xss?
I am trying to learn about of xss attack and so I far, I understood that a successful attack result in the attacker capable of injecting malicious js in the victim's browser. If my understanding is ...
0
votes
0
answers
94
views
Secure authentication for sites which allow user to modify js/html
We have a site builder, allows users to add/modify JS/HTML/CSS. Is it possible to provide a global authentication for it?
I mean users login once but can interact with all sites as their own names. ...
1
vote
1
answer
252
views
Is nonce useless when user input is reflected within an inline script?
I stumbled upon a web app which is accepting user input and putting it into a variable within script tag.
The script tag does have a nonce attribute.
As am working on bypassing the XSS filter, I had ...
6
votes
1
answer
1k
views
Split a JWT between payload and signature
Context: I'm looking at storage solutions for JWT tokens on a single page application.
Storing the JWT in the local storage is unsafe and prone to XSS attacks.
Storing the JWT in a secure / HTTP only ...
1
vote
1
answer
148
views
Reflected XSS monitoring
There is a lot of information on how to avoid or detect XSS, but I couldn't find much information on how to monitor for reflected XSS. Is there a way to automatically detect reflected XSS in my ...
1
vote
1
answer
2k
views
XSS - Setting Values and Attributes w/ jQuery
I was looking at the answer here and got curious if a function I use may be susceptible to XSS. Mostly because of this statement:
Some HTML attributes are inherently dangerous. This includes href,
...
0
votes
1
answer
333
views
Unrestricted file upload in chat
I am currently doing a bug bounty program and found a possible file upload vulnerability, but I am not so sure about it.
The vulnerability is on the chat function. In the chat function, users are ...
2
votes
2
answers
4k
views
XSS in script tags application/json - possible?
Is there way to execute alert box if " is not correctly escaped and can be injected in example below?
<script type="application/json">{"requests":{"postClicked"...
0
votes
1
answer
112
views
Shared Text Content - XSS Safe
I have a bulletin on my site that all valid users have access to (read and write). User input posted to this bulletin is stored in JSON. Because of these qualities there is definitely some concern for ...
2
votes
1
answer
528
views
Is there a potential XSS in this html action attribute?
I'm working on a website and I noticed that if I go to the following URL: website.com/page?alert() this message is reflected in the action form. I tried to close the action attribute using double ...
0
votes
1
answer
9k
views
How to prevent XSS attack on selected window.location in javascript
This is my code where i have a userId in a method SwitchUser_Click. I need to prevent or somehow encode the return value from the switchUser_Click as it includes the UserId of a user vulnerable to ...
1
vote
1
answer
127
views
XSS Prevention Code [closed]
I was just wondering if this code is enough to prevent XSS vulnerability in my web app?
/**
* Escape HTML string to prevent XSS.
*/
export const escapeHtml = (string: string): string => {
if (...
0
votes
0
answers
192
views
URL Encoding leading to invalid flag
I'm currently completing an XSS challenge in a CTF. I successfully redirect the admin cookie to my request bin, but the flag is said to be invalid.
I am told this is because the flag string gets ...
1
vote
1
answer
199
views
XSS in my Web App? [closed]
I have developed web app, and my customer is saying this piece of code is vulnerable:
<a href="#" onclick="count.it('count', 9); console.log(1);">Click
"9" is ...
1
vote
0
answers
239
views
Can input value escape a JSON object?
I am passing value from input filled directly into a script function inside a JSON object. I was thinking, is it possible that this input can escape this object and can lead to XSS or something.
<...
-1
votes
2
answers
126
views
What attack vectors does arbitrary JS on a user profile allow?
Consider a site for frontend devs/designers to host their portfolio apps - pages with arbitrary JS, each hosted on a user's separate profile.
What attack vectors would that enable against the site? ...
0
votes
1
answer
106
views
XSS possibility in user isolated app?
By user isolated, I mean that users interact with server and have some personalized data and they can read, update, delete their data but they will never see another user made data (like facebook, ...
7
votes
2
answers
2k
views
Why is the use of TAB (%09) characters in the middle a 'javascript:' URL valid?
Some context: I was assinged on a pentest and found an application that let me place my own links in an a tag's href attribute. As expected, all strange values like javascript: were correctly filtered ...