Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS), DOM-based XSS (aka client side XSS).

learn more… | top users | synonyms

0
votes
1answer
29 views

Flash Objects SWF security (ExternalInterface.call)

I am performing a penetration test against a website that uses Flash. I found this piece of code: url = ExternalInterface.call("window.document.location.href.toString") as String; How it can be ...
1
vote
1answer
78 views

XSS in HOST header

I'm able to inject JavaScript payload in HOST header, a request will look like: Host: <script>alert(document.cookie)</script> User-Agent: Mozilla/5.0 Gecko/20100101 Firefox/29.0 Cookie ...
5
votes
3answers
101 views

What can we do with non persistent XSS vulnerabilities?

Sorry for this stupid question but i'm thinking about what an attacker can do with a non persistent XSS attack on a website? An attacker can try to phish me with a malicious url, steal my cookies or ...
2
votes
2answers
67 views

Content sniffing XSS attack?

As a part of work, I've come across content sniffing, and i understand web apps can be vulnerable to xss because of it. There is another post, regarding content sniffing and xss, but didnt quite ...
0
votes
1answer
77 views

Can running a script while logged in compromise my facebook password?

In websites related to facebook malware analysis and information, we often see messages to the effect of if you have run this facebook app then your account has been compromised, or if you went to ...
0
votes
1answer
51 views

OWASP Zap proxy Fuzz XSS pentest against REST API

I am looking to PEN test my application against XSS attacks. The application is a REST API... As such when you POST some JSON to /cart/add to see the result of that attack you would need to GET ...
0
votes
1answer
51 views

An XSS attack is working on Firefox but not on Chrome..Suggest changes to make it work on Chrome

I am able to inject this: http://domain.com/search/songs/<img src='alert(document.cookie)' onerror='alert(document.cookie)'> to the page HTML. The onerror event is giving me the cookie on my ...
2
votes
1answer
63 views

can Veracode be taught to accept mitigations that it does not yet recognize

Veracode (http://www.veracode.com/) has certain parameter encoding libraries that it trusts. Others are labeled as flaws. If I'm satisfied with another method of parameter encoding that is meant to ...
1
vote
1answer
48 views

Is it safe to call an untrusted service with jquery.ajax and dataType 'jsonp'

From what I understand, the JSON-P technique generates a script tag into the DOM of an HTML page to get across the single-origin restrictions imposed on the XMLHttpRequest JavaScript API for AJAX ...
2
votes
1answer
1k views

javascript:alert(“test”); command does not work

Hello! As I have done before and also have read in many web sites, that just simply writing: javascript:alert(document.cookie); should work on any web page. But now, I was not able to execute it. I ...
-1
votes
4answers
111 views

Software for web hacking? [closed]

I want to learn sql injection, xss and other web attacks. I am new to all this, just a beginner. I want to know which software to use. Can I use Windows for these attacks ...
6
votes
2answers
549 views

PHP: if charset mismatches (htmlentities UTF-8) viewed by client as ISO-8859-1 (or vice versa)

Short Question: Question: Could any security vulnerabilities arise if a server runs htmlentities as UTF-8 but the client views the results as ISO-8859-1? Assumption: No vulnerabilities exist when ...
1
vote
2answers
58 views

XSS with input in onclick attribute

If I have... <table onclick="texttexttexttextUSERINPUTHERE"></table> Would XSS be possible? I mean with > and " filtered out. I know if there wasn't text behind the user input, you could ...
0
votes
2answers
83 views

trying to xss a site [closed]

http://XXX/?subscribe_message=%3Cscript%3Ealert(/zzz/);%3C/script%3E Why doesn't that popup with a /zzz/ alert? When I do javascript:alert(/zzz/); in the address bar it does so why not when I do it ...
1
vote
3answers
60 views

Perform XSS on a link where image path is passed in querystring

I have a page on my website like this : domain.com?img=test.jpeg And on the page, the javascript written is: var imgPath = getQuerystring('img'); $("#img").attr('src','/Images/' + imgPath); I was ...
2
votes
1answer
71 views

XSS - history stealing

I am little confused about this matter. By simply writing a JavaScript code we can go through our browser history and identify visited links. It is fine. But how an attacker use this to identify a ...
4
votes
2answers
221 views

Learning XSS: Why is my javascript ignored?

<a href='mailto:</a><script>/*'></a><script>/*</a>: <br> <hr> <a href='mailto:*/location.href=/*'>*/location.href=/*</a>: <br> ...
2
votes
3answers
147 views

Why are scripts injected through innerHTML not executed whilst onerror and other on<event> attributes on elements are? - Google XSS Challenge 2

SPOILER ALERT : Do not continue if you do not want to be spoiled I am currently doing the Google XSS Challenge Level 2 . I am injecting XSS code that is inserted into the document using ...
2
votes
2answers
180 views

Bypass cookie validation

I have discovered that a web application allows the setting of certain cookie values through request parameters. Each request param results in a separate Set-Cookie header. i.e. a request like this: ...
6
votes
2answers
971 views

Is this an XSS vulnerability?

My company recently had a security assessment done on our website and we had a XSS vulnerability reported. Below are the details of the reported vulnerability: If a user hits a URL like the one ...
0
votes
1answer
52 views

Understanding Same origin policy

I am trying to understand same origin policy better. From what I understand same origin policy restricts code from one "origin" not access data from another "origin". What I am trying to understand is ...
1
vote
0answers
61 views

How did the Tweetdeck XSS Vulnerability work

How exactly did the recent TweetDeck vulnerability work? It says here that it had something to do with the HTML heart character but I don't fully understand what the explanation means. From the link : ...
1
vote
0answers
109 views

How should I mitigate the XSS vulnerabilities in KnockoutJS described at mustache-security?

The site Mustache-Security describes XSS vulnerabilities in KnockoutJS... The vulnerabilities come from the use of eval (or some equivalent) to convert text in the data-bind attribute to executable ...
8
votes
3answers
1k views

Allowing users to input a safe subset of HTML

I recently posted this question on Code Review and it was recommended that I ask you guys about it. Basically, this will be used to allow users to generate formatted content. It gets put inside of ...
23
votes
2answers
3k views

JavaScript written only with brackets?

I once saw JavaScript code which was only written as multiple brackets (). Does anybody remember this kind of code? There was also an online converter to convert "normal" JS into this style of code. I ...
1
vote
0answers
56 views

XSS Vectors for new Image()

What are possible XSS vectors to this JavaScript code new Image().src = encodeURI('[user url here]'); Let's assume two cases: [user url here] is some string provided by user (with no validation) ...
0
votes
2answers
106 views

Way to decode an encoded payload [closed]

I am facing an XSS vulnerability in my ASP.Net Web application where the malicious code may be encrypted and html encoded Bottomline: I am trying to prevent XSS via code obfuscation. Question: I ...
0
votes
2answers
56 views

Javascript injection via document.cookie possible?

Let's say someone rooted a site, is it possible for the attacker to do XSS via document.cookie? Instead of giving the user a name=value, the attacker does something like this ...
2
votes
2answers
92 views

Is XSS through style attribute possible in modern browsers?

Let's say users can define content of the style attribute, but in a constrained way. They can't break out of its value, as white-listing parser will remove any unsafe attributes/tags produced this ...
3
votes
4answers
286 views

How is this XSS attack working?

SPOILER ALERT: This question contains an answer to one of the problems from the Google's XSS Challenge! Please stop reading further if you're not interested in knowing the answer right now. I'm ...
1
vote
1answer
64 views

XSS vulnerabilities: how much are they dangerous?

Lot of articles underline that XSS vulnerabilities can be very dangerous for the website on which they exist. I wonder how much is this true when we find these XSS vulnerabilities on the frontend of a ...
3
votes
5answers
1k views

referrer checking as a defence for XSS attack

After reading the question about referrer and the answer of @D.W., I did not understand the following part: XSS defense. Strict referer checking can make reflective XSS attacks harder, because ...
7
votes
1answer
5k views

Does Google Chrome protect against cross site scripting (XSS)?

In Firefox I've been using the NoScript extension to protect myself from certain kinds of malware attacks. NoScript is well known as a very powerful extension for Firefox and introduced protection ...
1
vote
1answer
66 views

CSRF Token Stealing

I came across this link that dicusses how an attacker could exploit access control allow origin to get an anti-CSRF token: ...
2
votes
3answers
103 views

XSS prevention by black-listing

I have a reflected XSS vulnerability in my Web application. I have decided to take the black-list approach instead of the popular white-list approach. My question is can there exist a malicious ...
0
votes
3answers
91 views

XSS in the context of a CDN

Say there is a website example.com. It hosts static content from a CDN, example.net. This site allows uploading an image, which will then be served from the CDN. This images can be SVGs and they are ...
2
votes
2answers
130 views

XSS in HTML meta tag

There is a web application which contains a search function. When I search for aaaaaaaaxss I get this: <meta property="the:property" content="100 Results for aaaaaaaaxss (Page 1)" /> It strips ...
-1
votes
3answers
126 views

Find and solve XSS in this code

I need to find a XSS and propose a solution in the following code: <form action="#" method="post"> <input type="hidden" name="id" value="<?=$id?>"><br> <textarea ...
1
vote
1answer
109 views

How to prevent XSS when transferring web page content within XML

I have an ASP.NET web application which uses HTTPS and XML based request-response. It seems a user's session cookie can be retrieved via XSS, if the request/response is intercepted and malicious ...
2
votes
2answers
193 views

Content-Security-Policy hash of script

<?php header("Content-Security-Policy: default-src 'sha256-".base64_encode(hash('sha256', 'console.log("Hello world");', true))."'"); ?> <script>console.log("Hello world");</script> ...
1
vote
0answers
83 views

XSS in HTML title tag without forward slash

I am trying to find out whether this is vulnerable against XSS: I can control the content of the title tag through the URL. This would make the site vulnerable if it wasn't for the fact that the site ...
6
votes
2answers
484 views

Modern, security-conscious, PHP book?

I posted this on StackOverflow and they redirected me here. Sorry if this isn't the correct area! After creating a simple login system and trying to protect it against things like SQL injection, ...
2
votes
2answers
820 views

XSS cookie stealing without redirecting to another page

I'm practicing in VM following the OWASP guide. I know that is possible to steal the cookie by redirecting to "False" page etc. but I would like to steal the cookie without redirecting on another ...
0
votes
3answers
117 views

How to leverage a stored XSS to perform a file inclusion?

I have identified a stored XSS and I'm wondering, how could I leverage that vulnerability to upload a shell.
2
votes
4answers
813 views

Simple solution to XSS

I've got an idea as to how to defeat XSS so simple that it may work and was wondering if anybody had already done something similar. The goal here is not efficiency but security. In other words I ...
3
votes
2answers
102 views

Webapp vulnerability scanner that understands continuations

I'm researching XSS vulnerabilities in a web application which uses continuations. That means that for a given form, the URI the form data is posted to is unique and different every time. A first GET ...
5
votes
4answers
630 views

Suggestions to avoid cookie-hijacking in a web application

I've been developing web-apps for quite some time now. While making websites, the "remember me" feature is one of the most trivial(read as must-have-for-clients) feature to be implemented. Until ...
0
votes
1answer
101 views

Content sniffing XSS vulnerable browsers

In order to prevent Cross-site scripting (XSS) in a private web application that supports image upload, I intend to reject browsers that are vulnerable to content sniffing. Which browsers are ...
1
vote
2answers
682 views

Is cross site scripting possible with the img alt attribute?

My question is, if any characters are allowed in the alt attribute of an img tag (except for double quotes), is XSS possible? Valid image or not.
0
votes
0answers
117 views

How safe is Apache's Commons StringEscapeUtils.escapeXml function to prevent XSS

I am using escapeXML StringEscapeUtils.escapeXml to prevent XSS in my Java application. But I am wondering if it resolves XSS to the fullest. I have tried some XSS attack vectors, and escapeXml seems ...