Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS), DOM-based XSS (aka client side XSS).

learn more… | top users | synonyms

3
votes
3answers
2k views

XSS : Content-type: application/json

Background information - Application responds to request to a particular URL with content-type: application/json JSON response contains a parameter from the request Escapes the quote with a slash ...
5
votes
4answers
12k views

Security issues using iframes

We are looking to move to iframes due to technical challenges. By moving to iframes it will be easier to manage the technical issues. But we are not totally sure of security implications of iframes. ...
6
votes
2answers
2k views

Is e-mail a direct vector for XSS

I'm curious if there is a way to execute XSS via email. I am not talking about using e-mail as a way to deliver a link that has reflected XSS in it. I'm talking about sending an email from ...
11
votes
2answers
1k views

Interpolique: transparently preventing SQL Injection and XSS with base64 encoding, what happened?

For the keynote at The Next HOPE a couple of years ago, Dan Kaminsky unveiled Interpolique (the talk is really fun btw). The problem he raised was how to defend against injection attacks, including ...
2
votes
2answers
165 views

For untrusted user upload sites: what should the contents of crossdomain.xml and clientaccesspolicy.xml be?

Flash has a long history of ignoring MIME types of files and reading the file directly for executable content or for cross domain execution permissions. That means a malicious user can take advantage ...
1
vote
1answer
4k views

Will JavaScript be executed which is in an HREF?

I located an issue with a site where I can insert a script tag into the href of an anchor tag: <a href="<script>alert(8007)</script>">Click Me</a> What I am trying to ...
3
votes
1answer
533 views

Notable XSS attacks in 2011

I am wondering what notable events in XSS attacks we saw in 2011. What big events hit the infosec community in regards of XSS? I am thinking of specific events like for example the Samy worm in 2007 ...
2
votes
2answers
1k views

How do I figure out how malware infected my server, and the subsequent sites on the server?

I recently was in charge of fixing our server at work, and cleaning the sites on it. We were infected with some malware that injected some code into some of our clients websites. Apparently, there was ...
2
votes
2answers
946 views

Removing Google Analytics cookie string from URL - security hole?

On our site, we use google analytics and we have to put the GA cookie in the URL since we have a two letter domain and IE imposes some cookie limitations on those. This means that when going between ...
0
votes
2answers
164 views

How much security should I use for my web application?

My question is, for a "normal" site, what do you think is enough to secure against methods used by "script kiddies"? For example, SQL injection, XSS, and stuff like that. Same question for password ...
2
votes
2answers
3k views

Is this JSON encoding vulnerable to CDATA injection?

I ran across an odd notation in the jsfiddle.net generated pages <script type='text/javascript'>//<![CDATA[ $(window).load(function(){ $('form, table').animate({ opacity: 1 }); ...
1
vote
2answers
10k views

Bypassing XSS filters [duplicate]

Possible Duplicate: New XSS cheatsheet? Can anyone give me list of ways to encode XSS payload , or to be precise what are the ways to encode XSS payload to bypass encoding of <> or (). I ...
5
votes
1answer
4k views

Is this jQuery ajax call vulnerable to XSS?

If somebody can edit $("#field").val(), can they change the url property here to point to another location? $.ajax({ url: "http://mywebsite/script?param=" + $("#field").val(), dataType: "jsonp", ...
6
votes
3answers
278 views

Is XSS dangerous on web without login/sensitive user's data?

Is XSS dangerous when the web application doesn't have a login/register function, the user isn't logged in or when the website doesn't store any sensitive user information?
10
votes
2answers
4k views

Is strip_tags() horribly unsafe?

I always use strip_tags to prevent XSS attacks, but today I saw a post which was telling it's horribly unsafe. As the manual says, it doesn't check for malformed HTML! Is it true? What can I do to ...
8
votes
3answers
2k views

How bad is a Self Contained XSS attack?

Some of you might be familiar with this attack called Self Contained XSS. I recently stumbled upon this article about it. So how bad this kind of attack can be, even though this doesn't have access to ...
6
votes
2answers
251 views

Presentation on Web App Security (ACM Student Chapter)

I am a member of the local ACM student chapter in my university and as part of our activities I am scheduled to give a talk on current issues on Web Application Security (and possibly secure coding ...
7
votes
1answer
1k views

Is Request.getHeader(“host”) vulnerable?

If the following is the code snippet, what would be your suggestions? <script type="text/javascript" src="<%=request.getHeader("Host")%>/XXX/xxx.js"></script> Is this a clear ...
3
votes
1answer
1k views

XSS in SWF file

I have the following code in an SWF file that a vulnerability scanner marks as XSS: // Action0 { var __callResult_6 = getURL(_root.thankYou, "_self"); var __callResult_7 = stop(); ...
7
votes
6answers
1k views

Filter user input before the database or upon display?

Given a web application where user data must be properly escaped to avoid XSS, is it better to try to remove the "bad stuff" before it enters the database, or is it best to allow it in the database ...
3
votes
2answers
3k views

Is there a way to bypass escape function in javascript?

Is there a way to bypass escape function in javascript for exploiting a XSS vulnerability ?
0
votes
3answers
528 views

DOM XSS : Need Help

I was trying my hands at DOM based XSS. I came across a scenario where user controlled string from the URL is included in javascript as below var userControlled=substring of URL; ...
10
votes
1answer
1k views

Closing an HTML element without using literal slashes?

I'm investigating a vulnerability in an application that echoes a user-supplied filename without sanitizing the filename. E.g. a file named test-<script>alert("evil");.txt will result in that ...
5
votes
4answers
1k views

Server wide javascript injection

UPDATE: The server was rooted, php.ini was replaced that cause the injection to appear. Still haven't figured out which directive is injecting the javascript. I'm troubleshooting a hacked website ...
4
votes
1answer
6k views

URLEncode vs HTMLEncode for XSS prevention

I have one project (in Java) that the programmer used URLEncode to output content as part of HTML instead of HTMLEncode. What is the risk that it is XSS vulnerable? (Let’s forget that it’s different ...
8
votes
3answers
8k views

PHP functions for preventing XSS

Is there a proven library with functions for preventing XSS attacks? Many people don't realise that htmlspecialchars is not enough to prevent XSS attacks. There are various contexts that need their ...
7
votes
3answers
1k views

How serious are XSS attacks

A website I visit allows this kind of attack, to be implemented with GET in the URL <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT> Along with many others on this page: ...
23
votes
2answers
4k views

JavaScript written only with brackets?

I once saw JavaScript code which was only written as multiple brackets (). Does anybody remember this kind of code? There was also an online converter to convert "normal" JS into this style of code. I ...
3
votes
1answer
348 views

Has The IE8 XSS Filter XSS Flaw Been Fixed?

You may remember: X-XSS-Protection: 0 http://hackademix.net/2009/11/21/ies-xss-filter-creates-xss-vulnerabilities/ Has this been fixed in IE8? IE9? IE10? Is it implemented in IE7?
17
votes
1answer
3k views

Does the practice of blocking an off-site “Referer:” HTTP requests improve website security?

Is there any benefit for a security-paranoid website to disallow HTTP requests that have a Referer: from 3rd party sites? The pitch is that if such a HTTP request were to come in, then certain XSS ...
3
votes
5answers
466 views

Is it possible to see if a script on a website steals session cookies?

I'm looking as some web analytics solutions, I know it sounds paranoid. but cookie-based web analytics need for you to paste their JavaScript code on your web-site. I don't like the idea too much of ...
4
votes
2answers
2k views

Are PHP Sessions based on cookies or a cookie-IP pair?

I have a PHP website and my question is: If someone manages to steal my users' cookies via an XSS attack, is it enough for him to be identified as the user? Or does his IP also have to be the same as ...
4
votes
2answers
593 views

Is this an example of XSS attack?

A scripter sees on certain web pages it's technically possible to include markup like HTML and CSS/JS. It's technically possible to submit a javascript or iframe and have it display to the visitor ...
6
votes
4answers
673 views

Is XSS dangerous in application without database?

I think it definitelly isn't, because XSS which isn't saved anywhere would damage ONLY attacker. Am I right or are there any cases where XSS could hurt non-db-application? (I mean datas are not saved ...
13
votes
5answers
2k views

Solution to allow JavaScript input but prevent XSS

We have a simple Blog system that allows users to input html and JavaScript to build a blog page. I'm aware that allowing javascript open up the door to xss attacks. We do however need to allow users ...
9
votes
2answers
778 views

Cross site scripting verification on a field which does not accept more than 20 characters

While performing penetration testing, I got stuck to a point. There is a text field which does not accept more than 20 characters(server side validation). I inserted following piece of code to check ...
4
votes
2answers
2k views

How to protect from new Javascript Injection technique that doesn't use eval()?

There is a new Javascript injection technique that is generating chatter on the forums mentioned here Here is the code sample: String.prototype.code = function(){ return (new Function('with(this) { ...
8
votes
2answers
608 views

Recent Facebook XSS exploit details

There was a recent XSS exploit on Facebook that posted a vulgar message and got users to click on a link to spread the payload. What vulnerability was exploited, and what can other sites do to avoid a ...
7
votes
4answers
3k views

Does default ModSecurity protect enough against XSS?

It's been a few years since I mucked around with modsecurity... Will simply installing the package with the default rules provide enough validation to prevent any (okay, let's be honest - best we ...
15
votes
4answers
1k views

Web Security Cheatsheet / ToDo list

Can anyone suggest a cheatsheet or ToDo list of web site and application security? A local small business owner prompted a question about web security, basically her company website just got XSS ...
5
votes
3answers
396 views

Is Content Security Policy an approach that is worth to support?

Mozilla Firefox 4.0 supports something called Content Security Policy that disables the interpretation of embedded Java Script. Only external Java Script files that are referenced using a script tag ...
0
votes
2answers
463 views

AntiXSS for ASP.NET 1.1

Unfortunately, a client of mine still has an application based on ASP.NET 1.1. Yes yes, I know - horribly insecure, support ending, and on and on... I've already been through that with them. ...
0
votes
4answers
149 views

Safely changing text links to HTML anchors

I'm trying to change text links to real anchors. So for example I want to change http://example.com to <a href="http://example.com">http://example.com</a>. Since this is a user given ...
5
votes
3answers
8k views

Testing PHP form injection

I'm writing a very small PHP app that takes input via a form. As could be expected for a first revision, the code does no escaping or sanitisation of input: if( $_POST["var"] != "" ) { print ...
1
vote
1answer
347 views

Is this enough to tackle script / malicious code insertion in GET, POST requests?

I've got legacy PHP code which attempts to prevent script / SQL injection with the following: if (!empty($_POST)) { reset($_POST); while (list($k,$v)=each($_POST)) { ...
3
votes
3answers
1k views

Altering a $_SESSION variable in PHP via XSS?

Not sure if what I'm saying makes sense... but is it possible for me to alter a $_SESSION variable from outside the target PHP script? One of our scripts uses a $_SESSION variable and I'm not sure if ...
1
vote
1answer
194 views

Replicating javascript actions from different website (XSS?)

I've got html / javascript code on my site like this: <a ...
3
votes
2answers
343 views

Protecting websites from outdated browsers and plugins via a whitelist/blacklist combination?

Aside from using browser headers, I want to blacklist/whitelist browser and plugins from my site so that I can prevent these older unpatched systems from (1) being a general user of my site (2) ...
10
votes
2answers
4k views

How to address XSS security issues in FCKeditor / CKeditor?

A security report we conducted through an outside company reported XSS vulnerabilities in FCKeditor which we're using in our PHP application. They pointed out that accessing URLs such as: ...
64
votes
4answers
8k views

Can anybody explain XSS? [closed]

I work programming Enterprise Java applications and do very little web development in 2002. I'm interested in security and like to read articles about it. However, I never fully understand how XSS ...