Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

learn more… | top users | synonyms

1
vote
0answers
14 views

url-encoded original URL in error page via og:url meta tag - Risk assessment?

I'm asked to advise on a scenario where meta tags in a 404 error page include the Open Graph og:url, which is (I'm told) being populated by React libraries. The full url as presented to the server ...
2
votes
1answer
57 views

How secure is HTML5 web storage (sessionStorage and localStorage)?

As part of a Google Chrome extension that I'm building at the moment, I'm thinking of using either sessionStorage or localStorage to store some important user data. The extension's functionality ...
5
votes
2answers
742 views

XSS in HTML title tag without forward slash

I am trying to find out whether this is vulnerable against XSS: I can control the content of the title tag through the URL. This would make the site vulnerable if it wasn't for the fact that the site ...
3
votes
2answers
81 views

Does displaying images on profiles by URL have security implications?

I am Developing a Web Application Currently, in which users can Make a Profile and Fill out the User's information, In this i have also kept a Section for Profile Picture, in that i have used a logic ...
7
votes
2answers
596 views

Did XSS reach its end-of-life with the introduction of the HTTP X-XSS-Protection header?

With the introduction of the HTTP X-XSS-Protection header it seems to me that the vulnerability impact (read: amount of possibly affected users with modern browsers) is drastically reduced. Firstly, ...
0
votes
0answers
59 views

XSS attack without special chars [duplicate]

I found a website vulnerable to XSS, but it disallows these characters: ( ) / \ Can I do an XSS attack without these characters?
18
votes
3answers
7k views

Cross Site Scripting without special chars

I'm testing a web application and I found a XSS vulnerability. I can break a tag and inject some code to the application but nothing potentialy dangerous for the client. The application has a filter ...
7
votes
2answers
3k views
+50

What is a good XSS vector without forward slashes and spaces?

I need an XSS vector that doesn't use forward slashes nor spaces. I've gone through lists of hundreds of vectors, but they usually have one of those two. The space gets URL encoded, and anything after ...
1
vote
1answer
57 views

Does removing user interaction create a secure sandbox that nullifies XSS?

Say there is a service online that takes as input a DOM string, loads that DOM in a browser on their server, and returns a screenshot. Would it be possible for the online service to completely ...
1
vote
1answer
83 views

DOM based XSS: jQuery(“#HiddenReferral”).val(jQuery(location).attr('href'));

DOM based XSS has been reported by Burp Suite and showed this query as vulnerable: The application may be vulnerable to DOM-based cross-site scripting. Data is read from location and passed to ...
7
votes
2answers
980 views

Modern, security-conscious, PHP book?

After creating a simple login system and trying to protect it against things like SQL injection, Session Hijacking, XSS, etc, I've found that I really enjoy doing this type of thing. I'd like to pick ...
0
votes
0answers
12 views

How do I perform output encoding on text boxes having limited sizes? [closed]

How do I apply output encoding for a text box which only allows a limited size? I cannot perform input validation for that text box because it expects '<' and '>' symbols. While I was trying to ...
-1
votes
1answer
555 views

Can someone break my anti DOM-based XSS javascript function? [closed]

Can someone break my anti DOM-based XSS javascript function using window.location? function parseparameters() { var href = window.location.href; var id = href.indexOf('#'); ...
17
votes
8answers
5k views

Is XSS a server-side or client-side vulnerability?

My colleagues claim that XSS is a vulnerability on the server side. I always thought that this is a client side vulnerability. Which one of us is correct, and why?
-1
votes
2answers
64 views

Under which conditions wouldn't a script tag run [duplicate]

I'm trying to understand how XSS works, and I bumped into Google's XSS games (https://xss-game.appspot.com/). Level 1 is easily solvable with the most common XSS (<script>alert(0)</script&...
-3
votes
1answer
58 views

Google xss games level 6, source code not showing up [closed]

I'm trying to understand how are Google's XSS games implemented (url: https://xss-game.appspot.com/level6, you have to have the cookies of the previous levels to access it). On level 6, when i look at ...
7
votes
1answer
1k views

How to make Firefox ignore the X-XSS-Protection response header?

I have two questions: How can I make Firefox ignore the X-XSS-Protection header? I have a website which sends an X-XSS-Protection: 1 header and I want my Firefox to ignore that header, because it ...
2
votes
2answers
925 views

Breaking out of attribute in double quotes

I have a piece of code that allows for [url]someurl[/url] BB-Code and replaces it with <a href="someurl">someurl</a> It takes two precautions to prevent XSS. It replaces <, &...
10
votes
3answers
11k views

Is it possible to inject HTML into image to provoke XSS?

Some answers mention that it's possible to inject attacker-controlled HTML into images and therefore provoke XSS. I guess that this HTML will be processed by browser only if hole exists in browser. ...
1
vote
1answer
207 views

Using htmlentities() in a BBCode-supporting textarea to stop XSS

I want to have a text area to post stuff to the database with BBCode. So, I downloaded a JavaScript code (to write in the specific BBCode when the image is clicked) but it didn't transform the text. ...
2
votes
2answers
75 views

XSS payload with ten character length restriction

There is an input field which is not getting encoded at the server side. But if you give a whole script say <img src=a onerror=alert(1)>, it shows an error like: <img src=a....' is not a ...
2
votes
1answer
127 views

XSS not exploitable when POST data is sent in JSON?

There is a reflected XSS flaw in an application I am testing. Initially, the payload is sent in POST request as value of a JSON key and the response is also a JSON object. The returned value in the ...
0
votes
2answers
50 views

Can we consider injection of HTML tags without event attributes as XSS?

I'm wondering if we can consider the injection of HTML tags like a, image, img, video, audio, marquee or iframe without an event attribute as XSS? Since no JavaScript is involved and therefor no ...
4
votes
1answer
140 views

JS snippets on my live project do not appear in my code residing on my production server

I have a Django website project that is live (let's call it example.com). It's a forum where users can submit comments and reply to them. It has a Postgresql database, and gunicorn + nginx reverse ...
2
votes
2answers
65 views

Why shouldn't I put user input in HTML comments?

The OWASP XSS Prevention Cheat Sheet has a list of locations where untrusted data should never be put: <script>...NEVER PUT UNTRUSTED DATA HERE...</script> directly in a script <!...
-4
votes
1answer
97 views

Is this script vulnerable to XSS? If yes, how can I exploit it? [closed]

Is this script is vulnerable to XSS? If yes then how can I exploit it? <script> //<![CDATA[ var _gaq=[['_setAccount','UA-34064858-1'],['_trackPageview']]; (function(d,t){var ...
3
votes
0answers
261 views

Problem in underscore.js with “new Function()” when CSP header is set

In underscore.js, template rendering causes violation of the 'unsafe-eval' property, with CSP error at following line: render = new Function(settings.variable || 'obj', '_', source); The solution ...
3
votes
1answer
251 views

How did the Tweetdeck XSS vulnerability work?

How exactly did the recent TweetDeck vulnerability work? It says here that it had something to do with the HTML heart character but I don't fully understand what the explanation means. From the link: ...
5
votes
1answer
53 views

Why don't web templating frameworks HTML escape all data by default?

I recently discovered an XSS vulnerability in an application that uses JSP to render pages. The vulnerable code in the JSP was something like this: <td>${customer.notes}</td> It was ...
-1
votes
0answers
35 views

How does this XSS “filter bypass based polyglot” from OWASP work?

I tried some XSS on a practice site and copied random codes from the OWASP cheat sheet to see what happens and I found this code: '">><marquee><img src=x onerror=confirm(1)></...
0
votes
0answers
14 views

Does CKEditor for ASP.NET do auto sanitation?

I don't see anywhere to enable a sanitizer in the CKEditor ASP.NET implementation. How are we supposed to do sanitation?
1
vote
0answers
116 views

XSS encode / decode strange char interpretation

Can anyone tell me why I can't get this XSS to reflect? Or why is this Filtered or not rendering? The Post sent is: ... Content-Length: 91 add=1&reference=A</><img src=a onalert=alert(...
10
votes
2answers
154 views

Using Single Domain Name to Identify Multiple Servers Improves Security? (Google's use of 1e100.net)

Since 2009, Google has been using a single domain name to identify its servers across multiple products: Following standard industry practice, we make sure each IP address has a corresponding ...
4
votes
1answer
57 views

Is displaying a non-encoded HTTP Referer header vulnerable to XSS?

Consider the following PHP script (it could be any other language; I chose PHP for simplicity): <?php echo $_SERVER['HTTP_REFERER']; ?> Is it vulnerable to XSS? Of course I can send a ...
2
votes
1answer
85 views

Is this a secure method for dynamically setting X-Frame-Options? (multiple domains)

X-Frame-Options header will prevent your site from being iFramed by other domains. On browsers that accept the ALLOW-FROM directive you are limited to specifying only a single origin. You could use a ...
1
vote
0answers
59 views

JavaScript variable evasion when quote is escaped, but not newline

I'm searching a way to properly evade from a JavaScript variable to perform XSS. A normal user input will give var a='<b>user input</b>'. a isn't eval anywhere and is not usable. Howewer,...
8
votes
2answers
177 views

Can XHR patching prevent XSS side-effects?

XSS & Single-Page Apps I'm researching on web security, and have seen that token based authentication is good for CSRF prevention, distributed system architectures and processing performance. ...
2
votes
1answer
113 views

Tweaks related to javascript execution in browser

Suppose, a filter validates the url, but not the protocol. In that case I can XSS that field with the following payload javascript://%0D%0Aalert(document.domain);//validurl.com You can paste above ...
7
votes
1answer
363 views

Safe to render data directly to DOM from localStorage? XSS attack possible?

I read that localstorage is susceptible to XSS attacks. I currently store JSON Web Token (JWT) in localstorage, and I access and display data about the user through localstorage: var localstore = //...
64
votes
1answer
5k views

Tell browser my site has no scripts

I have created a Tor hidden service site which has absolutely no JavaScript or other types of client side scripts. The page is HTML, CSS, images, and some JSP for handling user input. I encourage ...
0
votes
2answers
114 views

exploiting CSRF in ajax request via XSS flaw

In an application i am testing, there is a stored XSS flaw. Now, I was testing for CSRF and I constructed an HTML page with a javascript that sends the ajax request (XHR). It caused a pre-flight ...
1
vote
2answers
101 views

XSS vectors in img src and background-image url

I'm a little confused about XSS vulnerabilities when serving img.src and background url. From what I understand, the only way to execute javascript in this case, is to use javascript protocol. Let's ...
3
votes
1answer
118 views

Can a simple comment on WordPress harm my system (CVE-2016-4567)?

What risks are associated with the WordPress vulnerability CVE-2016-4567? Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in ...
2
votes
1answer
73 views

Differences between Burp request and Browser - Has different responses

So I was put on an engagement over the last week and I found a potential XSS when using Burp's intruder/repeater. However, the strange thing that I noticed was that the response in Burp is different ...
1
vote
0answers
29 views

DOM XSS: Find the function that sanitizes JSON responses [migrated]

I am testing a web application where the HTML is built by JavaScript/jQuery/AJAX using the JSON respones from REST calls. This being a very huge js file (require.js is also used), I'm finding it ...
-5
votes
1answer
51 views

Is possible to get password with stored XSS? [closed]

Is it possible to get password from a site with stored XSS? I have a forum where I can put JavaScript not directly but inside HTML (like <div onclick="alert()">CLICK</div>). Is it possible ...
1
vote
1answer
65 views

XSS Page Cannot be Displayed

When I try XSS on various websites, such as inserting " onmouseover="alert(1) in a search box, I either get a message saying You don't have permission to access this page or This page cannot be ...
4
votes
2answers
112 views

Is this codes usage of document.location.toString() a DOM based XSS vulnerability?

I have come across the following JS code in multiple web applications. I think the reason for the popularity of this code snippet is this accepted answer on SO. Developers seem to be using this code a ...
2
votes
1answer
49 views

Having malicious code stored in your DB

Let's say that there is a website which has an input field from which the input is saved to a database and then displayed somewhere else on the website. Is it safe to only sanitize/escape the output,...
0
votes
1answer
52 views

XSS to overcome HTML entities

In a search box (<input value=" *insert search term here* "...>), when I input " onmouseover="alert(1), the double quotes are converted to their entities, so it's not possible to break out of ...