Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS), DOM-based XSS (aka client side XSS).

learn more… | top users | synonyms

1
vote
1answer
76 views

Benefits of Content Security Policy

I would like to know how really good is the content security policy header for preventing XSS considering the following : Many sites have inline JS / CSS. The request/ response headers can be ...
3
votes
1answer
149 views

What are good tools for CRLF discovery? [closed]

What are good tools for finding CRLF injection vulnerabilities?
7
votes
3answers
2k views

Is there a way to bypass Django's XSS escaping with “unicode”?

Django (the Python web framework) escapes output to prevent XSS (Cross Site Scripting) attacks. It replaces ', ", <, >, & with their HTML safe versions. However this presentation on slide ...
1
vote
1answer
282 views

XSS MySQL Database Accessible?

I'd like to know if there is any danger of someone being able to access the database via XSS vulnerabilities on this page. I have the following link. When you go to this link, the text I've enclosed ...
1
vote
1answer
965 views

bypass a regex filtration to perform an xss attack

Does the regex [\w/$!.*-]+$ stop the injection of payloads like : "><script>alert(4)</script> " onload="alert(4)" ...
-1
votes
1answer
287 views

can someone break my anti dom based xss from the window location? [closed]

can someone break my anti dom based xss from the window location ? function parseparameters() { var href = window.location.href; var id = href.indexOf('#'); if (id ...
-1
votes
1answer
232 views

some questions about DOM based XSS [closed]

Is it possible to do a DOM based xss attack with window.location.protocol? How can we use dom based xss with document.title? How can we bypass the escape javascript function if it is used? thank ...
0
votes
1answer
571 views

Sanitizing JavaScript to prevent XSS

I'm going through a vulnerability remediation exercise for a client and am trying to figure out how to best mitigate this particular hole. There's a script on our site that calls up content into a new ...
2
votes
1answer
124 views

Does prepending “http://” to a user-provided string yield a safe-to-use URL?

Is it safe (in terms of XSS vulnerability) to get a parameter X from the user, escape its double-quotations and insert it as href? Pseudo-code: Y = escape_double_quotes(X); print '<a ...
2
votes
1answer
209 views

Is appending a double quote at the end of an input query a valid XSS prevention method?

I was wondering if appending a double quote at the end of a query is considered a valid XSS filter. Let's say we have a search function and I entered: "><script>alert('hi')</script> ...
3
votes
1answer
322 views

How can one recover from the Yahoo! XSS attack?

Many Yahoo!/SBC Global email accounts have been hijacked via an infamous XSS attack. The accounts are often used to send spam to random members of the user's personal address book. The spam often ...
0
votes
1answer
232 views

Automating tests for XSS in bash?

The book:"Web Security Testing Cookbook By Paco Hope, Ben Walther" is the only source I could find which covers the topic. They use cURL. I just want to write some scripts to automate testing for ...
2
votes
1answer
273 views

How to do security configuration for ibm http server?

We are using IBM HTTP Server Version 7.0 Need help related to Cross Site Scripting Prevention in IBM http server. Cross Site Scripting Prevention in Sun Java System Web Server 7.0 mentioned in ...
3
votes
2answers
3k views

HTML encoding to protect against XSS

While going through some references about protection against XSS i found that it is a good practice to encode data (entered by users) before using it to generate a dynamic page. I was not able to find ...
1
vote
2answers
156 views

Guarding against XSS when setting Cookies based on URI?

I have a web-site written in nginx.conf — http://mdoc.su/ — which essentially accepts two parameters, an operating system and a manual page name, and does a redirect to a different site based on the ...
1
vote
2answers
869 views

Can XSS vulnerabilities present in 3rd party js libraries be used to attack the app that uses the lib?

I am using various 3rd party libs like cordova.js, jquery, jquery mobile, mobilizer and so on, in a an android mobile app.. These libs are found to have various XSS vectors through insecure use of ...
2
votes
4answers
866 views

Simple solution to XSS

I've got an idea as to how to defeat XSS so simple that it may work and was wondering if anybody had already done something similar. The goal here is not efficiency but security. In other words I ...
4
votes
2answers
6k views

DOM Based XSS attacks: what is the most dangerous example?

I knew that XSS attacks (“non-persistent” and “persistent”) can hijack user session, deface websites, conduct phishing attack, etc. However, I can't understand what is dangerous of DOM Based XSS if ...
2
votes
1answer
383 views

Newline XSS vulnerability

So I was experimenting with XSS using new line (%0A) character. So I got to the usual vector: '%0Aalert(/xss/)// and one thing came to my mind. What if you can't insert a quote? A new line will break ...
3
votes
1answer
1k views

Is it possible to exploit XSS inside User-Agent header? [duplicate]

I've found an xss bug inside user-agent header on one popular buy/sell site , and after reporting it to them , they answered that it is not dangerous as it can not be exploited without user ...
4
votes
1answer
604 views

CodeIgniter CSRF confusion

I have been working with CodeIgniter for about 3 weeks and am very well on the way to loving this framework. However I have been looking at the core code of the framework and I was reading over the ...
6
votes
3answers
310 views

How and where can I best announce an XSS vulnerability in a relatively well-known website?

I'd like advice on how and where to announce an XSS vulnerability (persistent XSS to be exact). My greatest fear is the announcement getting snowed under, thus rendering the disclosure ineffective in ...
2
votes
2answers
398 views

HTTPOnly Cookies: Security Depends on Client Cooperation?

I've been implementing HTTPOnly cookie-based session handling and have some questions about what HTTPOnly means. I realise it's a flag that gets passed around in the HTTP header when setting cookies. ...
2
votes
2answers
1k views

Minimum size of input text box required for XSS attacks

I have below code to accept User login ID as input from User. <input name="userName" type="text" id="userID" maxlength="8"/></td> Maximum number of characters that a end user can input ...
3
votes
2answers
2k views

Is XSS possible here? Challenge

Is possible to bypass my regex and execute any javascript? <script> function json(a){ if (/^\s*$/.test(a) ? 0 : /^[\],:{}\s\u2028\u2029]*$/.test(a.replace(/\\["\\\/bfnrtu]/g, ...
4
votes
1answer
743 views

Do javascript: URLs starting with // allow XSS?

I found a markup processor that allows users to include arbitrary links, as long as they contain a "netloc" (// after the first :). Due to the myriad of exploitable protocol handlers, this is ...
1
vote
0answers
46 views

How can I explain Cross Site Scripting in a non-technical way? [duplicate]

Possible Duplicate: Can anybody explain XSS to an idiot? I can reasonably explain Cross Site Scripting (XSS) in technical terms to other technically minded people or people familiar with ...
1
vote
2answers
875 views

What vulnerabilities in the OWASP Top 10 are relevant to WordPress?

I have been looking at the OWASP Top 10, and am wondering which of the top 10 security risks are relevant to a WordPress installation with various plugins installed? I know injections and XSS are ...
4
votes
3answers
428 views

XSS risk for an application which can be accessed from localhost only

I have an web app which can used via an browser. The web app can be accessed on localhost only. No remote access is possible. A security tool discovered an XSS issue. Now if this web app is works only ...
1
vote
2answers
432 views

Breaking out of attribute in double quotes

I have a piece of code that allows for [url]someurl[/url] BB-Code and replaces it with <a href="someurl">someurl</a> It takes two precautions to prevent XSS. It replaces ...
23
votes
1answer
4k views

Is Django's built-in security enough?

I have learned that Django provides built-in protection against the three main types of web app attacks (SQL injection, XSS and CSRF), which is really awesome. Yet I have spoken to a few Django ...
2
votes
1answer
268 views

Email Compromised due to Yahoo Mail Exploit

On Monday due to XSS vulnerability present in the Yahoo mail my email has been compromised. I have immediately changed my password but i am not sure is this enough i.e. do i need to delete my cookies ...
5
votes
1answer
212 views

Question about XSS example

A friend of mine received an email from someone (a reputable sender), and I noticed that the following was tagged onto the end of the subject: ...
4
votes
2answers
392 views

Closing an HTML tag without using the actual character

I'm currently learning how to perform XSS on websites, but there is a constant problem that keeps recurring that I'm sure must be easy to bypass. Quite often, the website will filter out quotation ...
12
votes
3answers
559 views

What does a HTML filter need to do, to protect against SVG attacks?

I recently learned that SVG (Scalable Vector Graphics) images introduce a number of opportunities for subtle attacks on the web. (See paper below.) While SVG images may look like an image, the file ...
0
votes
3answers
604 views

How can this xss challenge be solved? [closed]

I found this : http://research.insecurelabs.org/xssmas/ And so far my solutions were: 1.http://research.insecurelabs.org/xssmas/search.php?query=<script>alert(0)</script> 2. ...
3
votes
4answers
3k views

What does scorecardsresearch.com/beacon.js - added by Disqus.com - do?

I recently added Disqus to my site. Looking at the "scripts" tab on Firebug, I noticed a script called, http://scorecardresearch.com/beacon.js (here is a prettified version - the script is not ...
3
votes
1answer
239 views

How did the Tumblr worm spread?

Recently Tumblr was hit by a fast-spreading worm. How did the worm work? What was the vulnerability in Tumblr that it exploired? Did it exploit a XSS vulnerability in Tumblr? A CSRF vulnerability ...
1
vote
1answer
271 views

Need an explanation of Cross-Site Flashing?

I found this - can anyone provide me examples of how these issues are exploited?
2
votes
1answer
213 views

Possible to execute a non-persistent XSS attack without using the url/query string?

I've been reading up on non-persistent XSS and all of the examples I have found use the situation where a webpage takes something from the url/query string and places it on the page. Is there any ...
4
votes
4answers
589 views

Is it possible to make an xss with only html tags

I'm not aware of all the xss tricks.. While programming in Ruby on Rails, using a sanitize method to allow only certain tags and it makes its best to clear all the other tags and scripts the ...
1
vote
2answers
279 views

I need explanation on how serious these vulnerabilities are?

I have found two vulnerabilities on my college site and I want to report them but don't know if these are "really" vulnerabilities : RFI inside SWF file. Example: ...
3
votes
5answers
1k views

referrer checking as a defence for XSS attack

After reading the question about referrer and the answer of @D.W., I did not understand the following part: XSS defense. Strict referer checking can make reflective XSS attacks harder, because ...
3
votes
4answers
1k views

What XSS attacks doesn't “Reflective XSS Protection” defeat?

Its been quite a while since I have played with cross site scripting vulnerabilities but today I came across a website today that was crying out to be tested for a basic XSS vulnerability. So ...
7
votes
2answers
760 views

Drupal filters XSS with regexes. What could bypass it?

Drupal filters HTML strings against XSS attacks using regexes: http://api.drupal.org/api/drupal/includes%21common.inc/function/filter_xss/7 However, as a lot of people know, HTML can't be parsed with ...
0
votes
1answer
1k views

How to escape user input in a value of javascript object?

How to properly escape user-controlled input when it's inserted as a value in JSON object? <script> $(document).ready(function() { new MyObject({ key1: "user_input", key2: ...
0
votes
1answer
555 views

How to show xss alert box when you are inside function in <script> tag?

For example we have this: <script type="text/javascript" charset="utf-8"> $(function () { var stranica = "#aXSSinjection point"; var stranicaContainers = $('div.stabs > ...
4
votes
2answers
203 views

filtering content in Content disposition header

I was reading "The Tangled Web"(A book that I'm enjoying very much) and I have a doubt in the following excerpt taken from it :- When Handling User-Controlled Filenames in Content-Disposition Headers ...
4
votes
2answers
498 views

CSRF Protection on static pages

I have a static site which has forms. The forms submit to a Rails endpoint which captures the submitted data. The static site and the Rails endpoint are on the same domain, on different subdomains and ...
8
votes
3answers
337 views

E-mail read receipt through XSS

I recently stumbled upon a really silly/unsafe but an interesting way to get a read receipt of an e-mail. I'm not 100% sure if the method in use works, which is why I'm asking it here. G-mail does ...