Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

learn more… | top users | synonyms

1
vote
3answers
67 views

What is more secure practice? Hosting from CDN or Main website

There has been a long Debate on CSP modelling, I have a Web application and I use JQuery in it, For that i use JQuery main site http://code.jquery.com/jquery-x.yy.z.min.js to Host it on my Site to ...
1
vote
2answers
435 views

Is this sanitizer vulnerable to XSS?

To have a simple and secure editor for text fields of a django app, I have this snippet to sanitize input HTML into django code: from bs4 import BeautifulSoup def sanitize_html(value): ...
4
votes
2answers
2k views

DOM XSS attack failing in Firefox

I am trying to perform DOM XSS attack to exploit a vulnerability of localhost webpage. I am able to perform the attack successfully on IE-11 and Chrome. But Firefox is preventing me to perform the ...
4
votes
1answer
58 views

Does using creating a seprate firefox profile cause a seprate security context protect against XSS and DNS Re-binding?

I read here that I should use separate security profiles for different sorts of things; accessing sensitive information, doing system administration vs. opening links from emails. I know that ...
2
votes
1answer
54 views

Cross domain iframe security

How exploitable is a site listening to browser messages from anyone? I am working on a site where I have found some iframe issues. The case is that site A has an iframe of site B, and site A listens ...
-3
votes
1answer
42 views

Which WYSIWYG editor has the best security reputation? [on hold]

I would like to use a pre-built WYSIWYG editor such as TinyMCE or CKEditor in a website that I'm building. Since I expect my users to be entering confidential information into the editor it is ...
0
votes
1answer
68 views

XSS payload without using < and >

I am performing testing on a site that takes input from the user and places it between <span> and </span>. However, < and > from the user are encoded as &lt and &gt. Is ...
3
votes
1answer
41 views

Bottleneck while creating XSS scanner for a website which returns API response instead of HTML

I am trying to build an XSS scanner using Python for a website. The website has widget creation feature. The source code for the website has templates for each widget type. The website returns an API ...
4
votes
1answer
145 views

JS snippets on my live project do not appear in my code residing on my production server

I have a Django website project that is live (let's call it example.com). It's a forum where users can submit comments and reply to them. It has a Postgresql database, and gunicorn + nginx reverse ...
0
votes
0answers
45 views

Stored XSS confirmed both by Netsparker and Acunetix

Both Acunetix and Netsparker are warning me about stored XSS. Acunetix URL encoded POST input langSelected was set to 1' onmouseover=prompt(973181) bad=' The input is reflected in www....../home....
4
votes
1answer
276 views

How did the Tweetdeck XSS vulnerability work?

How exactly did the recent TweetDeck vulnerability work? It says here that it had something to do with the HTML heart character but I don't fully understand what the explanation means. From the link: ...
1
vote
4answers
79 views

How to use XSS vulnerability to read file on server?

Can I use an XSS vulnerability to read files on the server by injecting PHP code to the page? Ex: Use document.write to inject PHP code that read the file.
2
votes
0answers
52 views

How can I protect my PHP app against XSS?

I am upgrading the security of an existing site (so can't redo everything with a framework that has xss functions built in), so I am looking for a way to protect against XSS attacks such as the ones ...
2
votes
2answers
140 views

JavaScript variable evasion when quote is escaped, but not newline

I'm searching a way to properly evade from a JavaScript variable to perform XSS. A normal user input will give var a='<b>user input</b>'. a isn't eval anywhere and is not usable. Howewer,...
0
votes
1answer
33 views

Is there a way to calculate the complexity of an XSS-vector?

Is there a way to calculate/estimate the complexity of an XSS vector? I would like to consider a "XSS-vector complexity score" in the risk = likelihood * impact formula1. In my opinion the likelihood ...
0
votes
0answers
39 views

Can modifying the /etc/hosts file create holes for XSS counter-measures?

I normally modify the /etc/hosts file so I can map mock urls to my development server. Whenever I do this, the ajax requests being sent has for its origin header the mock url I used in mapping to the ...
0
votes
1answer
36 views

CSRF token generation and validation

I am trying to implement XSS best practices on a site I’m making. I am currently generating a secure token on my server and sending it back to the user as a form hidden field, then validating that ...
9
votes
7answers
5k views

Why does XSS affect so many websites?

According to an article I read 65% of all websites globally suffer from XSS. Why can't developers find and fix it? Please help me understand. I'm not from a security or tech background.
1
vote
3answers
197 views

Reflective XSS in script codes with Content Type “text/javascript”

I have a webpage that returns raw script code with the headerContent-Type: text/javascript. However I found that there is a reflective xss in one of the parameters passed to the url which is copied ...
0
votes
2answers
93 views

Need help understanding OWASP Vulnerabilities [closed]

I am doing a whitepaper on simplifying OWASP 10 vulnerabilities based on an article our teachers suggested. Can you guys help or provide more resources here? What are your views? Will like to ...
7
votes
2answers
83 views

Ending a javascript block without slash character

Very frustrating situation on a pentest I am currently doing - I have found a place where I can inject almost all characters into a piece of javascript from a parameter. But the web developers seem ...
3
votes
1answer
75 views

XSS filter bypass to hook BeEF

I found a vulnerability on a website which allows me to trigger XSS. It's a very specific vulnerability, which is caused by a design-flaw. I want to write a PoC for them but I'm stuck at this step. ...
-2
votes
1answer
20 views

How do I perform output encoding on text boxes having fixed size?

I have a fixed size text box which expects '<' and '>' symbols as input. It is a requirement for that text box to expect '<' and '>' in its input so I can't perform input validation for that ...
3
votes
2answers
3k views

How to show XSS popup without using alert and script keywords?

I have come across a field that is vulnerable to XSS. It accepts and tags however keywords script,alert, msgbox, prompt are blocked. I have tried every encoded version of these keywords but its not ...
0
votes
1answer
32 views

Access to raw html source code after angular client side processing

I need help to check if parameters are sensible to XSS injections in a webpage generated by angularjs. Today, many websites are using angularjs in order to deport client page construction at the ...
4
votes
2answers
785 views

Why can't persistence XSS be detected by a Web Application Firewall?

This OWASP article mentioned that "Using data validation, only reflected XSS can be detected and prevented, persistent XSS cannot be detected, DOM-based XSS only to be limited degree if part of the ...
3
votes
2answers
234 views

Disclosure of end user files / Installation of Trojan horses via XSS

I've stumbled upon following examples of XSS attacks on OWASP: "Other damaging attacks include the disclosure of end user files, installation of Trojan horse programs..." Link to the example: https://...
2
votes
2answers
702 views

Security issues on allowing Special characters in input field

I am building a web application, in which I am required to let user enter any character(even special characters - ~!@#$%^&*()_-+=|\{}[];:'"<,.>) in an input field. To mitigate the problems ...
1
vote
2answers
3k views

How to prevent XSS from url

I found an XSS vulnerability which is exploited by appending attack in the URL parameters. For eg. the original URL site.com/?s=login&m=forgotten And the attack URL site.com/?s=login&m=...
0
votes
1answer
27 views

Reflecting user input within a JavaScript variable

I am struggling to understand whether the following would be considered as a DOM-based XSS or reflected XSS and was hoping that someone could help me distinguish the the difference. Imagine the ...
1
vote
3answers
363 views

Is this code javascript vulnerable to DOM based XSS?

Code : <script> document.theform.reference.onchange = function(){ var id = document.theform.reference.selectedIndex; var url = document.theform.reference[id].value; ...
1
vote
0answers
29 views

url-encoded original URL in error page via og:url meta tag - Risk assessment?

I'm asked to advise on a scenario where meta tags in a 404 error page include the Open Graph og:url, which is (I'm told) being populated by React libraries. The full url as presented to the server ...
3
votes
1answer
96 views

How secure is HTML5 web storage (sessionStorage and localStorage)?

As part of a Google Chrome extension that I'm building at the moment, I'm thinking of using either sessionStorage or localStorage to store some important user data. The extension's functionality ...
5
votes
2answers
771 views

XSS in HTML title tag without forward slash

I am trying to find out whether this is vulnerable against XSS: I can control the content of the title tag through the URL. This would make the site vulnerable if it wasn't for the fact that the site ...
3
votes
2answers
92 views

Does displaying images on profiles by URL have security implications?

I am Developing a Web Application Currently, in which users can Make a Profile and Fill out the User's information, In this i have also kept a Section for Profile Picture, in that i have used a logic ...
7
votes
2answers
628 views

Did XSS reach its end-of-life with the introduction of the HTTP X-XSS-Protection header?

With the introduction of the HTTP X-XSS-Protection header it seems to me that the vulnerability impact (read: amount of possibly affected users with modern browsers) is drastically reduced. Firstly, ...
0
votes
0answers
65 views

XSS attack without special chars [duplicate]

I found a website vulnerable to XSS, but it disallows these characters: ( ) / \ Can I do an XSS attack without these characters?
18
votes
3answers
7k views

Cross Site Scripting without special chars

I'm testing a web application and I found a XSS vulnerability. I can break a tag and inject some code to the application but nothing potentialy dangerous for the client. The application has a filter ...
7
votes
2answers
3k views

What is a good XSS vector without forward slashes and spaces?

I need an XSS vector that doesn't use forward slashes nor spaces. I've gone through lists of hundreds of vectors, but they usually have one of those two. The space gets URL encoded, and anything after ...
1
vote
1answer
58 views

Does removing user interaction create a secure sandbox that nullifies XSS?

Say there is a service online that takes as input a DOM string, loads that DOM in a browser on their server, and returns a screenshot. Would it be possible for the online service to completely ...
1
vote
1answer
98 views

DOM based XSS: jQuery(“#HiddenReferral”).val(jQuery(location).attr('href'));

DOM based XSS has been reported by Burp Suite and showed this query as vulnerable: The application may be vulnerable to DOM-based cross-site scripting. Data is read from location and passed to ...
7
votes
2answers
991 views

Modern, security-conscious, PHP book?

After creating a simple login system and trying to protect it against things like SQL injection, Session Hijacking, XSS, etc, I've found that I really enjoy doing this type of thing. I'd like to pick ...
-1
votes
1answer
558 views

Can someone break my anti DOM-based XSS javascript function? [closed]

Can someone break my anti DOM-based XSS javascript function using window.location? function parseparameters() { var href = window.location.href; var id = href.indexOf('#'); ...
18
votes
8answers
5k views

Is XSS a server-side or client-side vulnerability?

My colleagues claim that XSS is a vulnerability on the server side. I always thought that this is a client side vulnerability. Which one of us is correct, and why?
-1
votes
2answers
70 views

Under which conditions wouldn't a script tag run [duplicate]

I'm trying to understand how XSS works, and I bumped into Google's XSS games (https://xss-game.appspot.com/). Level 1 is easily solvable with the most common XSS (<script>alert(0)</script&...
7
votes
1answer
2k views

How to make Firefox ignore the X-XSS-Protection response header?

I have two questions: How can I make Firefox ignore the X-XSS-Protection header? I have a website which sends an X-XSS-Protection: 1 header and I want my Firefox to ignore that header, because it ...
2
votes
2answers
936 views

Breaking out of attribute in double quotes

I have a piece of code that allows for [url]someurl[/url] BB-Code and replaces it with <a href="someurl">someurl</a> It takes two precautions to prevent XSS. It replaces <, &...
10
votes
3answers
11k views

Is it possible to inject HTML into image to provoke XSS?

Some answers mention that it's possible to inject attacker-controlled HTML into images and therefore provoke XSS. I guess that this HTML will be processed by browser only if hole exists in browser. ...
1
vote
1answer
446 views

Using htmlentities() in a BBCode-supporting textarea to stop XSS

I want to have a text area to post stuff to the database with BBCode. So, I downloaded a JavaScript code (to write in the specific BBCode when the image is clicked) but it didn't transform the text. ...
2
votes
2answers
106 views

XSS payload with ten character length restriction

There is an input field which is not getting encoded at the server side. But if you give a whole script say <img src=a onerror=alert(1)>, it shows an error like: <img src=a....' is not a ...