Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

learn more… | top users | synonyms

2
votes
1answer
66 views

Understanding cross origing requests from a web page

Reading up the XSS attacks on wiki I see that it says an injected script could send data/cookies to the attackers site. How is this achieved? Are there no checks/restrictions on cross origin requests ...
-1
votes
1answer
168 views

“<” and “>” is filtered, is there any way bypass it? [closed]

I found that the characters; < and > are filtered (shown as: &lt; and &gt;), when I pen test for a website. Is there any methods to bypass < and >?
5
votes
1answer
510 views

What are the risks of accepting URL param for automatic redirection?

Can anybody name all the risks of the following scenario: User visits a page, but his session is expired, so he is auto-redirected to login page with his previous page and params added as a single ...
3
votes
1answer
1k views

encodeURIComponent in a unquoted HTML attribute

My gut feeling is that the following should be attackable: $("<td><a href=somefile.php?url="+encodeURIComponent(somevar)+">Download Here</a></td>"); In contrast to $("<...
7
votes
2answers
1k views

Does CSRF prevention also prevent reflected XSS attack?

What I understand about reflected XSS is ... When a web application is vulnerable to this type of attack, it will pass unvalidated input sent through requests back to the client... [1] ...
6
votes
2answers
1k views

How can document.referrer be used for XSS?

A very simple example... <div id="cat"></div> <script> document.getElementById("cat").innerHTML = document.referrer; </script> or <script src="' + document.referrer + '"...
-1
votes
1answer
134 views

Interesting security demos for beginners [closed]

I am thinking about a creating short security demo to get people interested in the security topic. I've had a couple of ideas just want to see if anyone has anything else interesting. Edit: I was ...
0
votes
0answers
108 views

Securing my API: concept of access tokens

First of all I want to excuse for the bad spelling and grammar. English is not my mother tongue. I have built a JSON communication between a front-end (website) and my Node.js web server. I want to ...
1
vote
2answers
843 views

Testing XSS - how to validate manually?

I have Burp and Appscan telling me that Reflected XSS is possible due to a particular variable on a particular page. The following example is given of what Appscan injected '%252fmypage.aspx%...
7
votes
4answers
5k views

What is a good browser for web application pen testing? [closed]

I am getting started in testing web applications, and I am having trouble verifying vulnerabilities. It seems all modern browsers have protections against things like XSS. When something like Burp ...
2
votes
1answer
171 views

Basic Website Protection (XSS,SQL-inject,hashing)

I have a very simple app that does allow unauthenticated users to leave comments (maybe later I will incorporate a capatcha). The app then stores the comments in a mysql db. I do my best to filter out ...
0
votes
1answer
369 views

Is PHP FILTER_VALIDATE_IP secure enough to $_GET an IP address?

I need to pass an IP to a PHP page, and it would be convenient to be able to use GET, but I know that's sort of asking for trouble, so I want to triple-check that I'm handling it securely. if(!...
0
votes
1answer
511 views

XSS echoed in pages html code but no pop up window

So i have a https login page with standard username and password inputs. I put in simple xss test such as, alert(‘XSS attack’) the page displays a "credentials you have supplied are incorrect" ...
1
vote
1answer
791 views

Can location.pathname lead to XSS?

<div id="cat"></div> <script> $("#cat").html(location.pathname); </script> I think that example would work, but anyway, if location.pathname has to be a valid page, can this ...
2
votes
3answers
5k views

How can I bypass double quotes in a attribute based xss attack

The code that I have is: <input type="text" name="some_name" value="<?php echo CHtml::encode($str); ?>" /> $str is the input data. 'CHtml::encode()' is Yii's way of encoding special ...
2
votes
3answers
303 views

Flash cookie and man-in-the-middle

I am using the Scala Play web framework. In it, there is a PLAY_FLASH cookie used to flash messages to the user (it's a cookie so it will still work after several redirects). I put HTML in the cookie ...
-1
votes
1answer
80 views

<,>,/ etc symbols are getting escaped while trying for xss,anyother alternatives for these symbols to carry out the attack successfully?

Symbols like >, <, / etc are getting escaped any alternative to carry out the xss attack ? most of the websites are having xss filters
9
votes
4answers
12k views

What is Reflected XSS?

Fed up with the following definition. Reflected attacks are those where the injected script is reflected off the web server, such as in an error message, search result, or any other response that ...
1
vote
2answers
634 views

Security issues in “Remember Me” function code example

I'm a beginner, and these may be very obvious for you, but I'm trying to understand if there are security issues with this example. Today on Stack Overflow, I saw the following post: PHP Sessions ...
0
votes
2answers
316 views

How the address bar manage the XSS?

I was playing with OWASP Mutillidae II and in one page I've found one vulnerability. In the address bar I've wrote something like : 127.0.0.1/.../?page=text-file-viewer.php/"><script>alert("...
4
votes
2answers
729 views

Exploiting XSS with window.name without iFrame

I know XSS is possible if the window.name is echoed onto the page, but from my understanding, this requires you to use an iFrame, but what if the page has clickjacking protection, stopping the page ...
9
votes
1answer
759 views

XSS Technique - & JavaScript Include

I was looking through the OWASP XSS Filter Evasion Cheat Sheet, and there was one technique that was completely new to me: & JavaScript includes <BR SIZE="&{alert('XSS')}"> I ...
1
vote
1answer
306 views

Could I XSS a page that filters &,",< and > characters and has Content-Type set to UTF-8?

I am trying to pentest a dummy website that has a form with a TEXTAREA input on one page. When the form is submitted, the contents of the form are displayed on a second page. However, the second page ...
1
vote
3answers
112 views

Session Fixation - Setting path to root without /

I have found an XSS vulnerability on the subdomain of a site I am testing, and using it I can set cookies for both the main site and all it's subdomains. My url currently looks like this: http://s1....
2
votes
2answers
301 views

Is there a need to have XSS filters when I'm saving data as XML?

My web-app takes some configs from the user and saves into an XML file (it was not done to stop XSS). The input is XML encoded so that the ",& ... and such characters don't break the XML structure....
0
votes
1answer
92 views

XSS attack remediation in older technologies

My application is vulnerable to XSS attack. Technology used in the application are Servlet 2.2, JSP 1.1, Jdk 1.3, WAS 4.0. I wanted to remediate XSS vulnerability with migration of technology or ...
2
votes
2answers
932 views

XSS in HOST header

I'm able to inject JavaScript payload in HOST header, a request will look like: Host: <script>alert(document.cookie)</script> User-Agent: Mozilla/5.0 Gecko/20100101 Firefox/29.0 Cookie ...
0
votes
1answer
306 views

Flash Objects SWF security (ExternalInterface.call)

I am performing a penetration test against a website that uses Flash. I found this piece of code: url = ExternalInterface.call("window.document.location.href.toString") as String; How it can be ...
0
votes
2answers
393 views

Content sniffing XSS attack?

As a part of work, I've come across content sniffing, and i understand web apps can be vulnerable to xss because of it. There is another post, regarding content sniffing and xss, but didnt quite ...
1
vote
1answer
3k views

OWASP Zap proxy Fuzz XSS pentest against REST API

I am looking to PEN test my application against XSS attacks. The application is a REST API... As such when you POST some JSON to /cart/add to see the result of that attack you would need to GET /...
0
votes
1answer
300 views

An XSS attack is working on Firefox but not on Chrome..Suggest changes to make it work on Chrome

I am able to inject this: http://domain.com/search/songs/<img src='alert(document.cookie)' onerror='alert(document.cookie)'> to the page HTML. The onerror event is giving me the cookie on my ...
3
votes
3answers
799 views

What can we do with non persistent XSS vulnerabilities?

Sorry for this stupid question but i'm thinking about what an attacker can do with a non persistent XSS attack on a website? An attacker can try to phish me with a malicious url, steal my cookies or ...
1
vote
1answer
220 views

Is it safe to call an untrusted service with jquery.ajax and dataType 'jsonp'

From what I understand, the JSON-P technique generates a script tag into the DOM of an HTML page to get across the single-origin restrictions imposed on the XMLHttpRequest JavaScript API for AJAX ...
0
votes
4answers
302 views

Software for web hacking? [closed]

I want to learn sql injection, xss and other web attacks. I am new to all this, just a beginner. I want to know which software to use. Can I use Windows for these attacks ...
1
vote
2answers
2k views

XSS with input in onclick attribute

If I have... <table onclick="texttexttexttextUSERINPUTHERE"></table> Would XSS be possible? I mean with > and " filtered out. I know if there wasn't text behind the user input, you could ...
0
votes
2answers
110 views

trying to xss a site [closed]

http://XXX/?subscribe_message=%3Cscript%3Ealert(/zzz/);%3C/script%3E Why doesn't that popup with a /zzz/ alert? When I do javascript:alert(/zzz/); in the address bar it does so why not when I do it ...
1
vote
3answers
244 views

Perform XSS on a link where image path is passed in querystring

I have a page on my website like this : domain.com?img=test.jpeg And on the page, the javascript written is: var imgPath = getQuerystring('img'); $("#img").attr('src','/Images/' + imgPath); I was ...
3
votes
1answer
747 views

XSS - history stealing

I am little confused about this matter. By simply writing a JavaScript code we can go through our browser history and identify visited links. It is fine. But how an attacker use this to identify a ...
7
votes
2answers
2k views

Is this an XSS vulnerability?

My company recently had a security assessment done on our website and we had a XSS vulnerability reported. Below are the details of the reported vulnerability: If a user hits a URL like the one ...
3
votes
2answers
445 views

Learning XSS: Why is my javascript ignored?

<a href='mailto:</a><script>/*'></a><script>/*</a>: <br> <hr> <a href='mailto:*/location.href=/*'>*/location.href=/*</a>: <br> &...
1
vote
1answer
665 views

Understanding Same origin policy

I am trying to understand same origin policy better. From what I understand same origin policy restricts code from one "origin" not access data from another "origin". What I am trying to understand is ...
4
votes
1answer
276 views

How did the Tweetdeck XSS vulnerability work?

How exactly did the recent TweetDeck vulnerability work? It says here that it had something to do with the HTML heart character but I don't fully understand what the explanation means. From the link: ...
6
votes
1answer
2k views

How should I mitigate the XSS vulnerabilities in KnockoutJS described at mustache-security?

The site Mustache-Security describes XSS vulnerabilities in KnockoutJS... The vulnerabilities come from the use of eval (or some equivalent) to convert text in the data-bind attribute to executable ...
10
votes
3answers
3k views

Allowing users to input a safe subset of HTML

I recently posted this question on Code Review and it was recommended that I ask you guys about it. Basically, this will be used to allow users to generate formatted content. It gets put inside of ...
1
vote
0answers
191 views

XSS Vectors for new Image()

What are possible XSS vectors to this JavaScript code new Image().src = encodeURI('[user url here]'); Let's assume two cases: [user url here] is some string provided by user (with no validation) [...
4
votes
2answers
6k views

Why are scripts injected through innerHTML not executed whilst onerror and other on<event> attributes on elements are? - Google XSS Challenge 2

SPOILER ALERT : Do not continue if you do not want to be spoiled I am currently doing the Google XSS Challenge Level 2 . I am injecting XSS code that is inserted into the document using element....
0
votes
2answers
1k views

Javascript injection via document.cookie possible?

Let's say someone rooted a site, is it possible for the attacker to do XSS via document.cookie? Instead of giving the user a name=value, the attacker does something like this name=<script>...
2
votes
2answers
874 views

Is XSS through style attribute possible in modern browsers?

Let's say users can define content of the style attribute, but in a constrained way. They can't break out of its value, as white-listing parser will remove any unsafe attributes/tags produced this way....
3
votes
4answers
1k views

How is this XSS attack working?

SPOILER ALERT: This question contains an answer to one of the problems from the Google's XSS Challenge! Please stop reading further if you're not interested in knowing the answer right now. I'm ...
0
votes
1answer
102 views

XSS vulnerabilities: how much are they dangerous?

Lot of articles underline that XSS vulnerabilities can be very dangerous for the website on which they exist. I wonder how much is this true when we find these XSS vulnerabilities on the frontend of a ...