Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS), DOM-based XSS (aka client side XSS).

learn more… | top users | synonyms

4
votes
1answer
814 views

XSS JavaScript Double Quoted String with HTML Escaped Possible?

Is it possible to inject XSS in a JavaScript variable if a website inserts HTML encoded, user input in a double quoted string? var userString = "perfectly "safe" input from user?";
5
votes
2answers
2k views

Why some sites are not shown when embedding them in an iframe?

Exploiting the DVWA's stored XSS option, I'm using the following payload: <iframe src="url">. I'd like to know why do some sites work but others don't when using this payload. For example: ...
4
votes
2answers
325 views

XSS prevention through Content Security Policy

How can Content Security Policy (CSP) significantly reduce the risk and impact of XSS attacks in modern browsers? Is it possible to circumvent CSP in order to execute XSS?
2
votes
1answer
290 views

Are GET, POST and windows.location vulnerable to XSS in a Wordpress theme?

I created a Wordpress theme for my client. He told me that he scanned my theme with a vulnerability scanner, and that it has security issues with the GET and windows.location methods. Is this really ...
-3
votes
1answer
530 views

Cross-site request forgery attack. How can we stopped this? [closed]

On one of our websites, we are seeing this code is adding itself. I tried to figured out but no success. One thing I have noticed when I removed the html, head and body starting tags, it's gone. Our ...
-3
votes
1answer
118 views

How easy is to track someone exploting a XSS vulnerability? [closed]

If one of the common uses of XSS is to steal cookies which will be sent to the attacker's server, isn't it so easy to identify the attacker? This is not like a SQLi for example which you can exploit ...
4
votes
1answer
127 views

If you want to implement a XSS scanner, is it absolutely necessary to use a JS interpreter? Why?

In a recent discussion about a security vulnerability scanner that returns false positives for XSS detection, I noticed that the scanner just inject a string like "this_is_my_string_" (without the ...
3
votes
3answers
1k views

Why is the Samy Worm considered XSS?

Last night I was browsing notable computer attacks and came across the Samy worm, which apparently affected a huge portion of the MySpace network -- over one million users in under 24 hours, according ...
2
votes
1answer
69 views

Should I escape numbers in Django?

Should I escape numbers in django to prevent XSS attacks ? The numbers are stored in db and of "decimal,float,..." type. Should I escape these values or is it useless to prevent XSS attacks ?
9
votes
2answers
882 views

Why does this XSS vector work in svg but not in HTML?

Why does this vector : <svg><script>alert&#40/1/.source&#41</script> works in http://jsfiddle.net/ZgPY4/2/ and this one ...
14
votes
3answers
3k views

Cross Site Scripting without special chars

I'm testing a web application and I found a XSS vulnerability. I can break a tag and inject some code to the application but nothing potentialy dangerous for the client. The application has a filter ...
7
votes
2answers
409 views

Best practices for integrating external javascript?

I'm looking for some standard pieces of advice on how to integrate external JavaScript into a website. For example, on mywebsite.com: <script ...
25
votes
5answers
2k views

IMG tag vulnerability

Is it safe to display images from arbitrary domains? I.e. let's say I have an image on my page: <img src="http://badguy.com/image.gif" /> What if image.gif will return some js attack vector, ...
3
votes
6answers
2k views

Is cookie-based XSS exploitable?

Today I've found interesting site that output your cookie value directly to the page, so if I modify the cookie value I can XSS myself. e.g <span id=statistics>Last visit: ...
2
votes
2answers
141 views

Is it safer to store the XSRF value inside your JavaScript?

To protect yourself against XSRF, you need to have a separate token on a page. See: Coding Horror: Preventing CSRF and XSRF Attacks, by Jeff Atwood As the posting suggests, its best to have those ...
10
votes
5answers
1k views

CSRF protection with Session Id

To protect against CSRF, couldn't my page javascript just dynamically insert the session id from the cookie into the body of each HTTP request right before it's sent? The server would then just ...
8
votes
2answers
954 views

Type 2 XSS vs CSRF

Trying to create a thorough understanding of XSS and CSRF, i'm clear that a type 2 xss involves an exploit that is persistent on the server. e.g. <SCRIPT type="text/javascript"> new ...
4
votes
2answers
663 views

XSS: Parsing Javascript

Reading about DOM based XSS from http://www.webappsec.org/projects/articles/071105.shtml It illustrates some examples like: ...
3
votes
1answer
694 views

XSS via Unicode

Reading about XSS and its countermeasures from http://www.xssed.com/xssinfo#Avoiding_XSS_vulnerabilities , it says (in the 2nd last paragraph of the link) that: […] support for Unicode character ...
0
votes
1answer
2k views

Security Testing AngularJS Web Application

An angularjs application stores user input to local/sessionStorage and retrieves it later to fill the form fields or display that content later. If a javascript is submitted as user input, it gets ...
11
votes
3answers
565 views

Is stripping out < and > characters an effective way of preventing XSS?

I'm guessing that HTML encoding the input would probably be a better solution, but I'm curious if just stripping out any < and > characters would be an effective defense against XSS attacks. ...
0
votes
1answer
155 views

Dom xss posibility question?

I have this snippet of code : <script type="text/javascript"> $.extend({ getUrlVars : function() { var vars = [], hash; ...
3
votes
4answers
2k views

how can you inject malicious code into an innocent-looking URL?

I am learning about XSS attacks. Wikipedia says that in a non-persistent attack an attacker may provide an innocent-looking URL that "points to a trusted site but actually has an XSS vector." What ...
1
vote
1answer
82 views

Benefits of Content Security Policy

I would like to know how really good is the content security policy header for preventing XSS considering the following : Many sites have inline JS / CSS. The request/ response headers can be ...
3
votes
1answer
152 views

What are good tools for CRLF discovery? [closed]

What are good tools for finding CRLF injection vulnerabilities?
7
votes
3answers
2k views

Is there a way to bypass Django's XSS escaping with “unicode”?

Django (the Python web framework) escapes output to prevent XSS (Cross Site Scripting) attacks. It replaces ', ", <, >, & with their HTML safe versions. However this presentation on slide ...
1
vote
1answer
302 views

XSS MySQL Database Accessible?

I'd like to know if there is any danger of someone being able to access the database via XSS vulnerabilities on this page. I have the following link. When you go to this link, the text I've enclosed ...
1
vote
1answer
1k views

bypass a regex filtration to perform an xss attack

Does the regex [\w/$!.*-]+$ stop the injection of payloads like : "><script>alert(4)</script> " onload="alert(4)" ...
-1
votes
1answer
307 views

can someone break my anti dom based xss from the window location? [closed]

can someone break my anti dom based xss from the window location ? function parseparameters() { var href = window.location.href; var id = href.indexOf('#'); if (id ...
0
votes
1answer
246 views

some questions about DOM based XSS [closed]

Is it possible to do a DOM based xss attack with window.location.protocol? How can we use dom based xss with document.title? How can we bypass the escape javascript function if it is used? thank ...
0
votes
1answer
586 views

Sanitizing JavaScript to prevent XSS

I'm going through a vulnerability remediation exercise for a client and am trying to figure out how to best mitigate this particular hole. There's a script on our site that calls up content into a new ...
2
votes
1answer
127 views

Does prepending “http://” to a user-provided string yield a safe-to-use URL?

Is it safe (in terms of XSS vulnerability) to get a parameter X from the user, escape its double-quotations and insert it as href? Pseudo-code: Y = escape_double_quotes(X); print '<a ...
2
votes
1answer
213 views

Is appending a double quote at the end of an input query a valid XSS prevention method?

I was wondering if appending a double quote at the end of a query is considered a valid XSS filter. Let's say we have a search function and I entered: "><script>alert('hi')</script> ...
3
votes
1answer
327 views

How can one recover from the Yahoo! XSS attack?

Many Yahoo!/SBC Global email accounts have been hijacked via an infamous XSS attack. The accounts are often used to send spam to random members of the user's personal address book. The spam often ...
0
votes
1answer
256 views

Automating tests for XSS in bash?

The book:"Web Security Testing Cookbook By Paco Hope, Ben Walther" is the only source I could find which covers the topic. They use cURL. I just want to write some scripts to automate testing for ...
2
votes
1answer
307 views

How to do security configuration for ibm http server?

We are using IBM HTTP Server Version 7.0 Need help related to Cross Site Scripting Prevention in IBM http server. Cross Site Scripting Prevention in Sun Java System Web Server 7.0 mentioned in ...
3
votes
2answers
4k views

HTML encoding to protect against XSS

While going through some references about protection against XSS i found that it is a good practice to encode data (entered by users) before using it to generate a dynamic page. I was not able to find ...
1
vote
2answers
162 views

Guarding against XSS when setting Cookies based on URI?

I have a web-site written in nginx.conf — http://mdoc.su/ — which essentially accepts two parameters, an operating system and a manual page name, and does a redirect to a different site based on the ...
1
vote
2answers
989 views

Can XSS vulnerabilities present in 3rd party js libraries be used to attack the app that uses the lib?

I am using various 3rd party libs like cordova.js, jquery, jquery mobile, mobilizer and so on, in a an android mobile app.. These libs are found to have various XSS vectors through insecure use of ...
2
votes
4answers
911 views

Simple solution to XSS

I've got an idea as to how to defeat XSS so simple that it may work and was wondering if anybody had already done something similar. The goal here is not efficiency but security. In other words I ...
5
votes
2answers
6k views

DOM Based XSS attacks: what is the most dangerous example?

I knew that XSS attacks (“non-persistent” and “persistent”) can hijack user session, deface websites, conduct phishing attack, etc. However, I can't understand what is dangerous of DOM Based XSS if ...
2
votes
1answer
413 views

Newline XSS vulnerability

So I was experimenting with XSS using new line (%0A) character. So I got to the usual vector: '%0Aalert(/xss/)// and one thing came to my mind. What if you can't insert a quote? A new line will break ...
3
votes
1answer
1k views

Is it possible to exploit XSS inside User-Agent header? [duplicate]

I've found an xss bug inside user-agent header on one popular buy/sell site , and after reporting it to them , they answered that it is not dangerous as it can not be exploited without user ...
4
votes
1answer
684 views

CodeIgniter CSRF confusion

I have been working with CodeIgniter for about 3 weeks and am very well on the way to loving this framework. However I have been looking at the core code of the framework and I was reading over the ...
6
votes
3answers
320 views

How and where can I best announce an XSS vulnerability in a relatively well-known website?

I'd like advice on how and where to announce an XSS vulnerability (persistent XSS to be exact). My greatest fear is the announcement getting snowed under, thus rendering the disclosure ineffective in ...
2
votes
2answers
421 views

HTTPOnly Cookies: Security Depends on Client Cooperation?

I've been implementing HTTPOnly cookie-based session handling and have some questions about what HTTPOnly means. I realise it's a flag that gets passed around in the HTTP header when setting cookies. ...
2
votes
2answers
1k views

Minimum size of input text box required for XSS attacks

I have below code to accept User login ID as input from User. <input name="userName" type="text" id="userID" maxlength="8"/></td> Maximum number of characters that a end user can input ...
3
votes
2answers
2k views

Is XSS possible here? Challenge

Is possible to bypass my regex and execute any javascript? <script> function json(a){ if (/^\s*$/.test(a) ? 0 : /^[\],:{}\s\u2028\u2029]*$/.test(a.replace(/\\["\\\/bfnrtu]/g, ...
5
votes
1answer
804 views

Do javascript: URLs starting with // allow XSS?

I found a markup processor that allows users to include arbitrary links, as long as they contain a "netloc" (// after the first :). Due to the myriad of exploitable protocol handlers, this is ...
1
vote
0answers
47 views

How can I explain Cross Site Scripting in a non-technical way? [duplicate]

Possible Duplicate: Can anybody explain XSS to an idiot? I can reasonably explain Cross Site Scripting (XSS) in technical terms to other technically minded people or people familiar with ...