Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS), DOM-based XSS (aka client side XSS).

learn more… | top users | synonyms

-8
votes
0answers
90 views

XSS Filter Bypass [on hold]

Please list out the XSS scripts that bypasses parsing. Parsing: Parses following characters: ",\,\',<,>,&,=,'. Escape character is used when sensitive character is found as part of input.
9
votes
1answer
2k views

Cross site scripting and the use of http-only cookies?

I have been a developer and now I am trying to look at XSS from the point of view of a developer. I was thinking of a particular case of reflected XSS . Let us say we have a vulnerable website and if ...
5
votes
2answers
65 views

How to break out of URL context

The OWASP XSS Prevention Worksheet recommends "URL escape before inserting untrusted data into HTML URL parameter values". I don't understand how someone could break out of a URL context or inject a ...
1
vote
2answers
98 views

XSS outside of the DOM

I have the following JS (using jQuery for brevity's sake but it isn't necessary for the question): $("<i></i>").html(userInput); Is it possible for someone to input some string, ...
1
vote
1answer
27 views

Limiting latter dom-based XSS when setting document.title

Given some JavaScript which modifies the page's title by taking in variable data document.title = someVariable I am looking to address dom based XSS while keeping the title fairly readable. ...
0
votes
2answers
38 views

Is there standard guideline on how the sanitized input should appear in the error message?

Let us say your web app is sanitizing bad input and displaying the user what the bad input was. Before XSS measure was put in place web app is spitting out malicious script as is. For example Bad ...
1
vote
4answers
100 views

Vulnerable XSS Test [closed]

I have to do a presentation about XSS. I want to give a demo but I can't find test platforms. I found http://zero.webappsecurity.com/index.html but this site always shows a FireHost-block when I try ...
2
votes
3answers
170 views

Stored Cross-Site Scripting Without Parentheses or Spaces

I'm testing a commenting application that takes a link of the form http://google.com and puts it in an href tag as so: <a rel="nofollow" href="http://google.com"> The resulting comment is ...
9
votes
2answers
616 views

Cross site scripting when the greater than and less than signs are escaped?

If a website encodes < to &lt; and > becomes &gt;, is it still possible to perform cross site scripting? What would you enclose the script tags in? For example, on one of my sites I can ...
3
votes
2answers
250 views

Is there a need to have XSS filters when I'm saving data as XML?

My web-app takes some configs from the user and saves into an XML file (it was not done to stop XSS). The input is XML encoded so that the ",& ... and such characters don't break the XML ...
2
votes
2answers
106 views

Stealing document.cookie from Google domain, is this a privacy breach?

When I am logged into the Google and prints document.cookie I could see following cookies. My doubt is what all an attacker can do if attacker could steal these cookies of the victim using exploiting ...
2
votes
1answer
98 views

How does this wordpress XSS work?

There is a new Wordpress exploit in wp-includes/formatting.php $textarr = preg_split('/(<.*>|\[.*\])/Us', $text, -1, PREG_SPLIT_DELIM_CAPTURE); General problem here is that they try to parse ...
-1
votes
0answers
44 views

How can I get a big site to fix security-errors? [duplicate]

On an online-shop of a giant multinational cooperation (building cars) I found some security-errors (XSS and Javascript-Injections) by just playing around. I emailed them to the manufacturer and ...
0
votes
0answers
62 views

Securing my API: concept of access tokens

First of all I want to excuse for the bad spelling and grammar. English is not my mother tongue. I have built a JSON communication between a front-end (website) and my Node.js web server. I want to ...
-1
votes
1answer
32 views

Shortened links and social media [closed]

I've been into IT-sec for a few years now and I have recently gotten in to the whole reddit/r/netsec, twitter, security.stackexchange thing, to get more involved with the community. What surprises me ...
2
votes
1answer
378 views

How to do security configuration for ibm http server?

We are using IBM HTTP Server Version 7.0 Need help related to Cross Site Scripting Prevention in IBM http server. Cross Site Scripting Prevention in Sun Java System Web Server 7.0 mentioned in ...
1
vote
2answers
94 views

Should CSRF token without session cookie work?

Let's say that website example.com has CSRF protection. They send CSRF token in custom header and in hidden input fields. For example to add new folder, your http request need to contain CSRF token. ...
-1
votes
1answer
94 views

Hack to change the webpage of a website? [closed]

Recently, there is a website by Malaysia Airline got hacked and their main page has been defaced, below is a link to that article ...
0
votes
2answers
1k views

Effectively Pentest a Wordpress Site

When it comes to blackbox pentesting of a Wordpress site, the first thing to come to mind is WPScan [http://wpscan.org/]. While pentesting some sites, I faced a common issue i.e it shows that ...
6
votes
2answers
490 views

How is DOM XSS possible here?

I was looking at this website and trying to understand how this XSS is possible, but I just can't figure it out. Here's the URL: http://www.domxss.com/domxss/01_Basics/05_jquery_html.html?681973661 ...
2
votes
2answers
66 views

How does xss work with web applications that take payload not through url

Most of the examples of XSS, I have seen examples of websites that get its parameter tampered through url query parameter. For example: ...
0
votes
1answer
41 views

From a security perspective, why not a screenshot api for browser? [closed]

I mean a javascript api for capturing a renderered html page, or current viewport, and dump content onto an image. While there are obvious attacks, such as taking screenshot of sensitive information, ...
3
votes
3answers
751 views

Content-Security-Policy hash of script

<?php header("Content-Security-Policy: default-src 'sha256-".base64_encode(hash('sha256', 'console.log("Hello world");', true))."'"); ?> <script>console.log("Hello world");</script> ...
9
votes
2answers
2k views

How do the Stack Exchange sites protect themselves from XSS? [duplicate]

It seems to me that because Users can post questions and comments in them with HTML markup (possibly <script> tags), Stack Exchange sites would be very exposed to XSS attacks. How do they ...
0
votes
0answers
50 views

XSS encode / decode strange char interpretation

Can anyone tell me why i cant get this XSS to reflect ? or why is this Filtered or not rendering ? The Post sent is : ... Content-Length: 91 add=1&reference=A</><img src=a ...
0
votes
1answer
39 views

XSS in options tag without forward slash

I am trying work on an XSS scenario. Would appreciate if anyone can help. URL: www.example.com/mydata "mydata" is landing in html as follows: 200 OK ... Content-Type: text/html; charset=utf-8 ... ...
1
vote
1answer
176 views

Can a Java servlet filter be used to pull out scripts that aren't whitelisted?

I might be asking a similar question to this: Whitelisting DOM elements to defeat XSS But I think my proposed solution is different and I was wondering if I could get the community to comment on ...
28
votes
5answers
3k views

IMG tag vulnerability

Is it safe to display images from arbitrary domains? I.e. let's say I have an image on my page: <img src="http://badguy.com/image.gif" /> What if image.gif will return some js attack vector, ...
4
votes
2answers
158 views

How to bypass .Net 4.5 request validation, for an XSS attack?

.Net has a feature called request validation which detects malicious inputs and blocks the request. By its nature, request validation is not a precise science. OWASP clearly recommend to only rely on ...
2
votes
1answer
34 views

Sanitise specific HTML attribute values against XSS

We want to implement a "safe mode" in a Markdown parser called Parsedown. We have a MarkupEscaped option that disables HTML input, but this is not enough. In order to be safe, the parser needs to ...
2
votes
4answers
78 views

Allowing users to upload & download XML safely

We have a requirement to allow users to upload an XML document into our system. We don't process it, we just allow them to download it again. Given various browser XSS vulnerabilities such as this: ...
0
votes
2answers
196 views

Testing XSS - how to validate manually?

I have Burp and Appscan telling me that Reflected XSS is possible due to a particular variable on a particular page. The following example is given of what Appscan injected ...
1
vote
0answers
25 views

Can't mail stolen session ID [closed]

I'm working on this platform: http://testfire.net/ With this script I can see the cookie: "><script>alert(document.cookie)</script> So now I'm trying to mail this cookie to me. ...
2
votes
1answer
46 views

Is there a strong protection against CSRF executed from the sames server via stored XSS?

If we have a domain with stored-XSS vulnerability. I know it's already critical!.. But, I'm talking about limiting the damage. The hacker can't get the session cookie of the admin, because it's ...
2
votes
1answer
81 views

How is the QSS tag used as payload in an XSS attack?

I have received a report from a client that lists XSS vulnerabilities. The report shows reflected XSS vulnerabilities. In each vulnerability, the payload reflected is a single, unclosed <qss> ...
2
votes
1answer
118 views

Snort IDS for Amazon deployment

Is Snort a good choice for monitoring network and web application traffic on Amazon EC2? If not, why and what IDS would you suggest? Is Snort a good choice to monitor for XSS, Sql Injection, attempt ...
-1
votes
2answers
102 views

Is JavaScript console vulnerable to XSS

Assume the content of the name variable below is controlled by an attacker. Is this line of code vulnerable to XSS? console.log(name) When I send an injection in name variable I see its value ...
1
vote
3answers
154 views

Beyond SQL injections and XSS

I'm a programmer working on a web service (by myself). Given the fact that I am not a security expert, I came to this website to ask my question. I did all the major things to secure my website. I ...
0
votes
1answer
215 views

is HttpOnly and Secure cookie enough to prevent CSRF in rest api?

I created one RESTful API using spring. I am transmitting a secret key as HttpOnly & Secure cookie with login response. After login every rest request will check with that cookie and update it ...
3
votes
6answers
2k views

Is cookie-based XSS exploitable?

Today I've found interesting site that output your cookie value directly to the page, so if I modify the cookie value I can XSS myself. e.g <span id=statistics>Last visit: ...
2
votes
1answer
116 views

Basic Website Protection (XSS,SQL-inject,hashing)

I have a very simple app that does allow unauthenticated users to leave comments (maybe later I will incorporate a capatcha). The app then stores the comments in a mysql db. I do my best to filter out ...
23
votes
2answers
4k views

JavaScript written only with brackets?

I once saw JavaScript code which was only written as multiple brackets (). Does anybody remember this kind of code? There was also an online converter to convert "normal" JS into this style of code. I ...
49
votes
6answers
5k views

Does injecting querystring values directly into HTML pose a security risk?

Someone reported a bug on my site that I don't really consider an issue. My site has an URL akin to this: www.site.com/ajax/ads.asp?callback=[text injection] So filetype is application/json, and I ...
4
votes
2answers
90 views

How do honeypots remain secure to 0days and newer exploits?

If honeypots are designed for a specific set of exploits, such as SQL injection and XSS, how do they protect themselves against other exploits? For instance, if I created a honeypot a few months ago, ...
2
votes
2answers
8k views

XSS cookie stealing without redirecting to another page

I'm practicing in VM following the OWASP guide. I know that is possible to steal the cookie by redirecting to "False" page etc. but I would like to steal the cookie without redirecting on another ...
3
votes
2answers
233 views

Using classic ASP, is this the right way to do to protect against XSS?

Using classic ASP, is this the right way to do to protect against XSS? var1=untrusteduserinput Showing a text in the body <%=server.htmlencode(var1)%> Showing a link in the body <a ...
3
votes
3answers
177 views

Why doesn't XSS vulnerability from the site launching the CSRF attack make the Synchronizer Token Pattern insecure?

I was reading this question about using Synchronizer Token Pattern to protect against CSRF and the comments of the answer intrigued me. Of course, as the last comment says, if your site has an XSS ...
5
votes
3answers
104 views

XSS vulnerability in raw script response?

We recently had a security scan done on our production web applications and received a notification of a potential XSS vulnerability on a particular URL that is used to retrieve a combined response ...
2
votes
2answers
9k views

Best Approach for removing XSS Vulnerability

I have been developing a Webobjects application, and I found that my application is vulnerable to XSS through URL, but not when malicious input like <script>alert("hi")</script> is input ...
4
votes
3answers
1k views

Is this PHP code XSS proof?

Is the following PHP code XSS proof? <?php $site = $_GET["url"]; echo "<a href='".str_replace(array("\"", "'", "javascript:", "vbscript:"), array("%22", "%27", "", ""), ...