Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

learn more… | top users | synonyms

5
votes
3answers
874 views

CSRF Protection on static pages

I have a static site which has forms. The forms submit to a Rails endpoint which captures the submitted data. The static site and the Rails endpoint are on the same domain, on different subdomains and ...
0
votes
0answers
17 views

BeEF public IP address vs local IP address

I just set up BeFF XSS framwork on my remote Ubuntu server and I hooked JS.code to my public website (I developed deliberately vulnerable persistent XSS website for education purpose). So I simulated ...
4
votes
3answers
510 views

XSS - How serious can it be? [duplicate]

I am just wondering about XSS attacks. Lets say I have a normal website, but it displays a few things based on $_GET variables. The website has no login system, all users can do is browse different ...
-3
votes
0answers
12 views

How to create a simple chrome extension with ax XSS vulnerability? [migrated]

Could anyone point me to any tutorials or just offer some tips on how to create a basic web extension with an XSS vulnerability? I was thinking of something really basic, like an extension that tells ...
1
vote
1answer
73 views

Tweaks related to javascript execution in browser

Suppose, a filter validates the url, but not the protocol. In that case I can XSS that field with the following payload javascript://%0D%0Aalert(document.domain);//validurl.com You can paste above ...
4
votes
1answer
148 views

How make Firefox ignore X-XSS-Protection header from server?

I have two questions: 1)How can I make Firefox ignore X-XSS-Protection header? I have a website which sends X-XSS-Protection: 1 header and I want my Firefox to ignore that header, because it destroys ...
5
votes
1answer
276 views

Safe to render data directly to DOM from localStorage? XSS attack possible?

I read that localstorage is susceptible to XSS attacks. I currently store JSON Web Token (JWT) in localstorage, and I access and display data about the user through localstorage: var localstore = ...
-3
votes
0answers
18 views

XSS - Can we made changes in cart items, delivery address etc [closed]

Suppose we found a XSS on shopping site. can we add the item in cart or change the billing address and payment method by sending a sequence of AJAX requests?
0
votes
3answers
60 views

XSS - Can we steal cookies from another website on another tab?

Suppose I found a XSS bug in a eCommerce website. Can we steal the victim's cookies from their bank website (if that is opened in another tab)?
1
vote
0answers
32 views

Should I worry about NoScripts anti-XSS warning when making a 3DSecure payment?

When I make an online payment using 3DSecure (Verified by Visa or Mastercard Securecode), NoScript informs me that it has stopped a potentially insecure script where site A (the bank or the credit ...
-1
votes
1answer
29 views

XSS Vector without < or > symbols or equal sign?

Just wondering if anyone could help me out with some XSS Vectors that work without having the < or > symbols. Basically the the input is stripped from < and > symbols and any equal signs such ...
2
votes
1answer
35 views

Break out of JavaScript data context to perform XSS when backslash and quotes are replaced?

Suppose I have a this on my site: <script> var x = "<? echo unsafe_data; ?>"; </script> This is obviously vulnerable to XSS. Now suppose I "clean" the unsafe data by replacing \ ...
3
votes
3answers
251 views

Flash cookie and man-in-the-middle

I am using the Scala Play web framework. In it, there is a PLAY_FLASH cookie used to flash messages to the user (it's a cookie so it will still work after several redirects). I put HTML in the cookie ...
4
votes
7answers
144 views

Any non alert() based non malicious XSS payloads?

I have been trying to find non malicious, non alert based, single command reflective XSS payloads, and have so far seen none. Anybody know of any good ones for pentesting purposes? What I mean by ...
67
votes
5answers
4k views

Strange Payment Gateway

I have a freelance client that wants me to integrate a payment gateway into their Woocommerce site but I am being increasingly concerned about their choice of provider and the project as a whole. The ...
3
votes
1answer
68 views

Could somebody explain how the ASDA site is vulnerable?

I'm sure many of you will have seen the CSRF exploit highlighted by Paul Moore that ASDA have known about for two years (Paul's blog) I am trying to find an explanation as to WHY the website is ...
1
vote
1answer
44 views

Security concerns of HTML echo endpoint

Consider a website with an endpoint that, when a payload of an HTML string (full document or partial segment) is POST to it, the server will transform the payload (and sometimes no transform is ...
2
votes
1answer
138 views

Tools for finding stored XSS vulnerabilities, given DB write access?

I'm aware that there are various tools for testing for XSS vulnerabilities. However, all the ones that I'm aware of (Vega, possibly BeEF, etc.) operate purely client-side. When testing for stored XSS ...
9
votes
3answers
1k views

Can I simply search-replace < and >?

I'm running a comment system, and I want to accept regular, un-formatted text. I don't want anything too complicated, so I thought of just searching and replacing all < to space (through regex or ...
4
votes
1answer
43 views

Style attribute XSS without quotes

If there is a page that allows user input into the following... .page { background: #userinput; } can it be exploited if <>'" are all filtered? I've seen width: expression(alert(0));, but ...
4
votes
0answers
41 views

Wordpress.org pages refresh when logging out of Gmail

I've noticed that when I change my Gmail account by logging out of one account and then logging into another, all open Wordpress.org pages refresh. Additionally, when I recently changed a password on ...
0
votes
0answers
28 views

Help with XSS Evasion [migrated]

I have a form which performs a strange kind of XSS Filtering. <script>alert(1);</script> is converted into <script>alert%281%29%3B<%2Fscript>. How do I bypass this kind of ...
0
votes
2answers
59 views

Is it possible to execute xss when response is of content type:application/json in latest IE? [duplicate]

Question is when response type of request is coming as application/json and also there is not any kind of escaping/encoding implemented then is it possible to execute xss there? Changing file ...
1
vote
0answers
26 views

From xss to rce in client side [closed]

I found a desktop application in Linux w/c getsvand that displays items from site xyz. xyz is vulnerable to XSS and code injected there is also executed on client side's desktop app.similar to this ...
1
vote
1answer
44 views

Executing XSS payload when “http” is added to payload

I have a context where every special characters are escaped properly except ':' &'/'. The output is reflected inside <a href="payload" tag. 1 )When I set payload to javascript:alert()(which ...
6
votes
1answer
58 views

Proper way to protect against XSS, when output is directly into JS not HTML?

I'm seeing plenty of examples when the output is going into HTML directly, but I'm seeing more conflicting information when the output is going straight into JS. For example if the code was: var ...
0
votes
0answers
32 views

Client Side Attacks - XSS and CSRF [duplicate]

It is against the law injecting JavaScript scripts (simple pop out alert) or capturing and modifying with Burp/Fiddler HTTP request for identifying web application vulnerabilities (CSRF) without the ...
1
vote
0answers
172 views

XSS Vectors for new Image()

What are possible XSS vectors to this JavaScript code new Image().src = encodeURI('[user url here]'); Let's assume two cases: [user url here] is some string provided by user (with no validation) ...
1
vote
2answers
1k views

How do hackers deploy keyloggers?

I know the use of keyloggers. What I wish to know is how a hacker can install the keylogger onto the victim's system? If it can be done by XSS then to where this keylogger is actually installed (I ...
3
votes
3answers
2k views

Why is the Samy Worm considered XSS?

Last night I was browsing notable computer attacks and came across the Samy worm, which apparently affected a huge portion of the MySpace network -- over one million users in under 24 hours, according ...
0
votes
2answers
63 views

Reflective XSS in script codes with Content Type “text/javascript”

I have a webpage that returns raw script code with the headerContent-Type: text/javascript. However I found that there is a reflective xss in one of the parameters passed to the url which is copied ...
9
votes
4answers
10k views

PHP functions for preventing XSS

Is there a proven library with functions for preventing XSS attacks? Many people don't realise that htmlspecialchars is not enough to prevent XSS attacks. There are various contexts that need their ...
3
votes
1answer
101 views

Is this vulnerable to XSS exploit?

A typical ajax call: $.ajax({ url: "http://mywebsite/script?param=" + $("#field").val(), dataType: "jsonp", success: function(response) { $("#id").html(response); }, }); sends a ...
9
votes
2answers
743 views

How does CORS prevent XSS?

I recently learned about CORS and got the impression that its purpose is to prevent XSS. With CORS, the browser blocks requests to different domains, unless particular headers are in place. But if a ...
6
votes
2answers
128 views

XSS via JSON: Why does a web application not sanitize either its incoming params hash or its outgoing JSON values of malicious tags like Script?

Recently working on a Rails-based web application for a company, I had to look into XSS vulnerability. It turns out that the application, in some places, could take an HTML tag (e.g., jscodehere ...
9
votes
2answers
58 views

Personal stylesheets

In reference to this question, I was researching whether or not there would be any security risks in letting users add their own stylesheets. He brings up a scenario in which a dev might use ...
1
vote
2answers
184 views

XSS in JavaScript

I was recently figuring out thing in a web application and found that the URL is reflected among the source of the page, which make it bit obvious for XSS, but the input from URL which is reflected on ...
0
votes
1answer
28 views

Javascript Valuable Webpage Data

When malicious users and attackers seek to steal data using XSS, they can send attributes like document.cookie to a malicious server, correct? Does this attribute have all of a users cookies for a ...
4
votes
1answer
76 views

How can I exploit a web application if content sniffing is not disabled?

I just come across one of the customer's website for penetration testing having JSON callback reflecting the user input in the response body. like this: ...
6
votes
3answers
247 views

How to convince team mate about using a whitelist?

Context In our development team, we have to build a component. This component is a full client side one written in Javascript. A client web application wishing to embed this component will call it ...
0
votes
1answer
149 views

Can someone tell me whether this is Cross-site scripting attack or normal log entry?

Can someone shed light on this logs . ****GET /list25/ADMN/Eligibility/EligibilityResponse.aspx ...
2
votes
1answer
59 views

XSS via -confirm()-

I was reading this article here, in the middle I saw the author used -confirm()- as the payload. I'd like to know what is this payload? I mean what's the difference between -confirm()- and ...
0
votes
0answers
22 views

Different chanels for BeEF UI and Communication Server

I am working with BeEF tool and I want to access the UI interface using https (I don't want to communicate via VPN to access the control panel), while at the same time, I need to serve the http hooks ...
2
votes
0answers
36 views

How to validate Excel data to protect against XSS?

My application is dynamically constructing a source URL and then writing the resource file (Excel) directly to the response. The URL is read from a properties file, based on the application ...
4
votes
1answer
41 views

Does using creating a seprate firefox profile cause a seprate security context to protect against XSS and DNS Re-binding?

I read here that I should use separate security profiles for different sorts of things; accessing sensitive information, doing system administration vs. opening links from emails. I know that ...
4
votes
4answers
8k views

how can you inject malicious code into an innocent-looking URL?

I am learning about XSS attacks. Wikipedia says that in a non-persistent attack an attacker may provide an innocent-looking URL that "points to a trusted site but actually has an XSS vector." What ...
6
votes
2answers
317 views

How does BeEF work and how can it be persistent

BeEF - the browser exploitation framework. I think (thought) I had a basic working understanding of how it works. Recently, though, I was watching, this DEFCON talk, where a hacker used a ...
0
votes
0answers
35 views

Is Primefaces vulnerable to host header attack?

Is the Primefaces JSF framework vulnerable, or secured against host header attack?
1
vote
1answer
58 views

XSS - Using firebug to inject Scripts

Recently I did a bit of digging around XSS and found that to prevent XSS the best way is to encode user input/output. Being a newbie in this field I am unable to get my head around this and have a ...
-1
votes
1answer
64 views

How do a basic tests for webapp - online tool made with PHP (forms, shell access, session) [closed]

I created a webapp in PHP (MySQL, jQuery) and now I want to take necessary security measures in order to keep it up and running and harmless for my VPS. App has several public forms ($_POST, $_GET, ...