Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS), DOM-based XSS (aka client side XSS).
3
votes
6answers
111 views
Is cookie-based XSS exploitable?
Today I've found interesting site that output your cookie value directly to the page, so if I modify the cookie value I can XSS myself.
e.g <span id=statistics>Last visit: ...
2
votes
2answers
60 views
Is it safer to store the XSRF value inside your JavaScript?
To protect yourself against XSRF, you need to have a separate token on a page.
See: Coding Horror: Preventing CSRF and XSRF Attacks, by Jeff Atwood
As the posting suggests, its best to have those ...
10
votes
5answers
389 views
CSRF protection with Session Id
To protect against CSRF, couldn't my page javascript just dynamically insert the session id from the cookie into the body of each HTTP request right before it's sent?
The server would then just ...
-3
votes
0answers
23 views
How to use FCKeditor safely ? [duplicate]
How can I implement FCKeditor in my website keeping it secure from Cross Site Scripting. I am using ASP.NET and C#.
4
votes
2answers
115 views
Type 2 XSS vs CSRF
Trying to create a thorough understanding of XSS and CSRF, i'm clear that a type 2 xss involves an exploit that is persistent on the server.
e.g.
<SCRIPT type="text/javascript">
new ...
3
votes
2answers
95 views
XSS: Parsing Javascript
Reading about DOM based XSS from http://www.webappsec.org/projects/articles/071105.shtml
It illustrates some examples like:
...
2
votes
1answer
84 views
XSS via Unicode
Reading about XSS and its countermeasures from http://www.xssed.com/xssinfo#Avoiding_XSS_vulnerabilities , it says (in the 2nd last paragraph of the link) that:
[…] support for Unicode character ...
0
votes
1answer
140 views
Security Testing AngularJS Web Application
An angularjs application stores user input to local/sessionStorage and retrieves it later to fill the form fields or display that content later. If a javascript is submitted as user input, it gets ...
10
votes
3answers
381 views
Is stripping out < and > characters an effective way of preventing XSS?
I'm guessing that HTML encoding the input would probably be a better solution, but I'm curious if just stripping out any < and > characters would be an effective defense against XSS attacks.
...
2
votes
6answers
878 views
Efficient way for finding XSS vulnerabilities?
Manual (reliable) way: Put string containing characters that have special meaning in HTML into some parameter of HTTP request, look for this string in HTTP response (and possibly) in other places ...
0
votes
1answer
79 views
Dom xss posibility question?
I have this snippet of code :
<script type="text/javascript">
$.extend({
getUrlVars : function() {
var vars = [], hash;
...
3
votes
4answers
279 views
how can you inject malicious code into an innocent-looking URL?
I am learning about XSS attacks. Wikipedia says that in a non-persistent attack an attacker may provide an innocent-looking URL that "points to a trusted site but actually has an XSS vector." What ...
3
votes
1answer
79 views
What are good tools for CRLF discovery? [closed]
What are good tools for finding CRLF injection vulnerabilities?
6
votes
3answers
225 views
Is there a way to bypass Django's XSS escaping with “unicode”?
Django (the Python web framework) escapes output to prevent XSS (Cross Site Scripting) attacks. It replaces ', ", <, >, & with their HTML safe versions.
However this presentation on slide ...
1
vote
1answer
84 views
XSS MySQL Database Accessible?
I'd like to know if there is any danger of someone being able to access the database via XSS vulnerabilities on this page.
I have the following link. When you go to this link, the text I've enclosed ...
2
votes
1answer
92 views
Does prepending “http://” to a user-provided string yield a safe-to-use URL?
Is it safe (in terms of XSS vulnerability) to get a parameter X from the user, escape its double-quotations and insert it as href?
Pseudo-code:
Y = escape_double_quotes(X);
print '<a ...
1
vote
1answer
173 views
bypass a regex filtration to perform an xss attack
Does the regex [\w/$!.*-]+$ stop the injection of payloads like :
"><script>alert(4)</script>
" onload="alert(4)"
...
-1
votes
1answer
144 views
can someone break my anti dom based xss from the window location? [closed]
can someone break my anti dom based xss from the window location ?
function parseparameters()
{
var href = window.location.href;
var id = href.indexOf('#');
if (id ...
4
votes
4answers
5k views
Security issues using iframes
We are looking to move to iframes due to technical challenges. By moving to iframes it will be easier to manage the technical issues. But we are not totally sure of security implications of iframes.
...
-1
votes
1answer
101 views
some questions about DOM based XSS [closed]
Is it possible to do a DOM based xss attack with window.location.protocol?
How can we use dom based xss with document.title?
How can we bypass the escape javascript function if it is used?
thank ...
0
votes
1answer
201 views
Sanitizing JavaScript to prevent XSS
I'm going through a vulnerability remediation exercise for a client and am trying to figure out how to best mitigate this particular hole. There's a script on our site that calls up content into a new ...
2
votes
1answer
109 views
Is appending a double quote at the end of an input query a valid XSS prevention method?
I was wondering if appending a double quote at the end of a query is considered a valid XSS filter. Let's say we have a search function and I entered:
"><script>alert('hi')</script>
...
3
votes
1answer
162 views
How can one recover from the Yahoo! XSS attack?
Many Yahoo!/SBC Global email accounts have been hijacked via an infamous XSS attack. The accounts are often used to send spam to random members of the user's personal address book. The spam often ...
0
votes
1answer
94 views
Automating tests for XSS in bash?
The book:"Web Security Testing Cookbook
By Paco Hope, Ben Walther" is the only source I could find which covers the topic. They use cURL. I just want to write some scripts to automate testing for ...
2
votes
1answer
66 views
How to do security configuration for ibm http server?
We are using IBM HTTP Server Version 7.0
Need help related to Cross Site Scripting Prevention in IBM http server.
Cross Site Scripting Prevention in Sun Java System Web Server 7.0 mentioned in ...
3
votes
2answers
406 views
Is this an example of XSS attack?
A scripter sees on certain web pages it's technically possible to include markup like HTML and CSS/JS. It's technically possible to submit a javascript or iframe and have it display to the visitor ...
1
vote
2answers
456 views
HTML encoding to protect against XSS
While going through some references about protection against XSS i found that it is a good practice to encode data (entered by users) before using it to generate a dynamic page. I was not able to find ...
3
votes
5answers
266 views
Does setting the cookie-path protect me from XSS from another context?
Lets say I am using a reverse proxy with URL rewriting that provides access to 2 different applications
http://www.example.com/app1/ and http://www.example.com/app2/.
I don't want those ...
1
vote
2answers
94 views
Guarding against XSS when setting Cookies based on URI?
I have a web-site written in nginx.conf — http://mdoc.su/ — which essentially accepts two parameters, an operating system and a manual page name, and does a redirect to a different site based on the ...
1
vote
2answers
175 views
Can XSS vulnerabilities present in 3rd party js libraries be used to attack the app that uses the lib?
I am using various 3rd party libs like cordova.js, jquery, jquery mobile, mobilizer and so on, in a an android mobile app.. These libs are found to have various XSS vectors through insecure use of ...
1
vote
4answers
322 views
Simple solution to XSS
I've got an idea as to how to defeat XSS so simple that it may work and was wondering if anybody had already done something similar.
The goal here is not efficiency but security. In other words I ...
3
votes
1answer
986 views
DOM Based XSS attacks: what is the most dangerous example?
I knew that XSS attacks (“non-persistent” and “persistent”) can hijack user session, deface websites, conduct phishing attack, etc.
However, I can't understand what is dangerous of DOM Based XSS if ...
2
votes
1answer
109 views
Newline XSS vulnerability
So I was experimenting with XSS using new line (%0A) character.
So I got to the usual vector: '%0Aalert(/xss/)//
and one thing came to my mind. What if you can't insert a quote?
A new line will break ...
3
votes
1answer
200 views
Is it possible to exploit XSS inside User-Agent header? [duplicate]
I've found an xss bug inside user-agent header on one popular buy/sell site , and after reporting it to them , they answered that it is not dangerous as it can not be exploited without user ...
3
votes
1answer
200 views
Do javascript: URLs starting with // allow XSS?
I found a markup processor that allows users to include arbitrary links, as long as they contain a "netloc" (// after the first :). Due to the myriad of exploitable protocol handlers, this is ...
5
votes
3answers
417 views
Is it a security risk to embed a commenting service (like Disqus) into our site?
Can commenting services like Disqus, IntenseDebate, etc. pose a security risk for corporations?
Edit:
What risks could arise when embedding such services into corporate websites?
6
votes
3answers
199 views
How and where can I best announce an XSS vulnerability in a relatively well-known website?
I'd like advice on how and where to announce an XSS vulnerability (persistent XSS to be exact). My greatest fear is the announcement getting snowed under, thus rendering the disclosure ineffective in ...
3
votes
1answer
175 views
CodeIgniter CSRF confusion
I have been working with CodeIgniter for about 3 weeks and am very well on the way to loving this framework. However I have been looking at the core code of the framework and I was reading over the ...
2
votes
2answers
152 views
HTTPOnly Cookies: Security Depends on Client Cooperation?
I've been implementing HTTPOnly cookie-based session handling and have some questions about what HTTPOnly means.
I realise it's a flag that gets passed around in the HTTP header when setting cookies. ...
43
votes
6answers
3k views
Can anybody explain XSS to an idiot?
That idiot being me, of course.
I work programming Enterprise Java applications and do very little web development in 2002. I'm interested in security and like to read articles about it. However, I ...
3
votes
5answers
1k views
How can I execute a XSS with these conditions?
I am trying to learn penetration testing and I have downloaded a vulnerable application called "Bodgeit Store". I have finished almost all the challenges except one which is to execute a Cross-Site ...
2
votes
2answers
248 views
Minimum size of input text box required for XSS attacks
I have below code to accept User login ID as input from User.
<input name="userName" type="text" id="userID" maxlength="8"/></td>
Maximum number of characters that a end user can input ...
2
votes
2answers
305 views
Is XSS possible here? Challenge
Is possible to bypass my regex and execute any javascript?
<script>
function json(a){
if (/^\s*$/.test(a) ? 0 : /^[\],:{}\s\u2028\u2029]*$/.test(a.replace(/\\["\\\/bfnrtu]/g, ...
11
votes
3answers
290 views
What does a HTML filter need to do, to protect against SVG attacks?
I recently learned that SVG (Scalable Vector Graphics) images introduce a number of opportunities for subtle attacks on the web. (See paper below.) While SVG images may look like an image, the file ...
1
vote
0answers
32 views
How can I explain Cross Site Scripting in a non-technical way? [duplicate]
Possible Duplicate:
Can anybody explain XSS to an idiot?
I can reasonably explain Cross Site Scripting (XSS) in technical terms to other technically minded people or people familiar with ...
1
vote
2answers
260 views
What vulnerabilities in the OWASP Top 10 are relevant to WordPress?
I have been looking at the OWASP Top 10, and am wondering which of the top 10 security risks are relevant to a WordPress installation with various plugins installed?
I know injections and XSS are ...
4
votes
3answers
272 views
XSS risk for an application which can be accessed from localhost only
I have an web app which can used via an browser. The web app can be accessed on localhost only. No remote access is possible. A security tool discovered an XSS issue. Now if this web app is works only ...
1
vote
2answers
152 views
Breaking out of attribute in double quotes
I have a piece of code that allows for
[url]someurl[/url]
BB-Code and replaces it with
<a href="someurl">someurl</a>
It takes two precautions to prevent XSS.
It replaces ...
4
votes
4answers
239 views
Is it possible to make an xss with only html tags
I'm not aware of all the xss tricks..
While programming in Ruby on Rails, using a sanitize method to allow only certain tags and it makes its best to clear all the other tags and scripts
the ...
12
votes
1answer
502 views
Is Django's built-in security enough?
I have learned that Django provides built-in protection against the three main types of web app attacks (SQL injection, XSS and CSRF), which is really awesome.
Yet I have spoken to a few Django ...
