Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS), DOM-based XSS (aka client side XSS).

learn more… | top users | synonyms

-1
votes
0answers
17 views

DOM based XSS manual testing

How can firebug be used to inspect DOM of web application and find the vulerable location for DOM xss?
-5
votes
0answers
27 views

BARCODES modern web injection payloads [on hold]

I was searching for advance XSS attack payloads and I found that we can use barcodes for xss and sql injection payloads... may have some information from this link ...
0
votes
1answer
27 views

Is PHP FILTER_VALIDATE_IP secure enough to $_GET an IP address?

I need to pass an IP to a PHP page, and it would be convenient to be able to use GET, but I know that's sort of asking for trouble, so I want to triple-check that I'm handling it securely. ...
0
votes
1answer
52 views

XSS echoed in pages html code but no pop up window

So i have a https login page with standard username and password inputs. I put in simple xss test such as, alert(‘XSS attack’) the page displays a "credentials you have supplied are incorrect" ...
1
vote
1answer
33 views

Basic Website Protection (XSS,SQL-inject,hashing)

I have a very simple app that does allow unauthenticated users to leave comments (maybe later I will incorporate a capatcha). The app then stores the comments in a mysql db. I do my best to filter out ...
2
votes
0answers
93 views
+50

Is there a need to have XSS filters when I'm saving data as XML?

My web-app takes some configs from the user and saves into an XML file (it was not done to stop XSS). The input is XML encoded so that the ",& ... and such characters don't break the XML ...
0
votes
1answer
84 views

Can running a script while logged in compromise my facebook password?

In websites related to facebook malware analysis and information, we often see messages to the effect of if you have run this facebook app then your account has been compromised, or if you went to ...
1
vote
1answer
36 views

Can location.pathname lead to XSS?

<div id="cat"></div> <script> $("#cat").html(location.pathname); </script> I think that example would work, but anyway, if location.pathname has to be a valid page, can this ...
1
vote
2answers
50 views

How can I bypass double quotes in a attribute based xss attack

The code that I have is: <input type="text" name="some_name" value="<?php echo CHtml::encode($str); ?>" /> $str is the input data. 'CHtml::encode()' is Yii's way of encoding special ...
-1
votes
0answers
28 views

bypassing same origin policy for xss [on hold]

while looking for a vulnerability in website i found a webapp poorly coded with unfiltered user input but while creating a POC i found that any thing mentioned between angle bracket "<>" is ...
0
votes
1answer
96 views

OWASP Zap proxy Fuzz XSS pentest against REST API

I am looking to PEN test my application against XSS attacks. The application is a REST API... As such when you POST some JSON to /cart/add to see the result of that attack you would need to GET ...
2
votes
3answers
56 views

Flash cookie and man-in-the-middle

I am using the Scala Play web framework. In it, there is a PLAY_FLASH cookie used to flash messages to the user (it's a cookie so it will still work after several redirects). I put HTML in the cookie ...
-1
votes
1answer
42 views

<,>,/ etc symbols are getting escaped while trying for xss,anyother alternatives for these symbols to carry out the attack successfully?

Symbols like >, <, / etc are getting escaped any alternative to carry out the xss attack ? most of the websites are having xss filters
1
vote
3answers
106 views

What is Reflected XSS?

Fed up with the following definition. Reflected attacks are those where the injected script is reflected off the web server, such as in an error message, search result, or any other response that ...
3
votes
1answer
81 views

can Veracode be taught to accept mitigations that it does not yet recognize

Veracode (http://www.veracode.com/) has certain parameter encoding libraries that it trusts. Others are labeled as flaws. If I'm satisfied with another method of parameter encoding that is meant to ...
0
votes
2answers
76 views

Security issues in “Remember Me” function code example

I'm a beginner, and these may be very obvious for you, but I'm trying to understand if there are security issues with this example. Today on Stack Overflow, I saw the following post: PHP Sessions ...
0
votes
2answers
52 views

How the address bar manage the XSS?

I was playing with OWASP Mutillidae II and in one page I've found one vulnerability. In the address bar I've wrote something like : ...
3
votes
2answers
116 views

Exploiting XSS with window.name without iFrame

I know XSS is possible if the window.name is echoed onto the page, but from my understanding, this requires you to use an iFrame, but what if the page has clickjacking protection, stopping the page ...
1
vote
1answer
55 views

Could I XSS a page that filters &,",< and > characters and has Content-Type set to UTF-8?

I am trying to pentest a dummy website that has a form with a TEXTAREA input on one page. When the form is submitted, the contents of the form are displayed on a second page. However, the second page ...
9
votes
1answer
455 views

XSS Technique - & JavaScript Include

I was looking through the OWASP XSS Filter Evasion Cheat Sheet, and there was one technique that was completely new to me: & JavaScript includes <BR SIZE="&{alert('XSS')}"> I ...
4
votes
2answers
6k views

DOM Based XSS attacks: what is the most dangerous example?

I knew that XSS attacks (“non-persistent” and “persistent”) can hijack user session, deface websites, conduct phishing attack, etc. However, I can't understand what is dangerous of DOM Based XSS if ...
1
vote
3answers
53 views

Session Fixation - Setting path to root without /

I have found an XSS vulnerability on the subdomain of a site I am testing, and using it I can set cookies for both the main site and all it's subdomains. My url currently looks like this: ...
1
vote
1answer
31 views

XSS attack remediation in older technologies

My application is vulnerable to XSS attack. Technology used in the application are Servlet 2.2, JSP 1.1, Jdk 1.3, WAS 4.0. I wanted to remediate XSS vulnerability with migration of technology or ...
0
votes
1answer
43 views

Flash Objects SWF security (ExternalInterface.call)

I am performing a penetration test against a website that uses Flash. I found this piece of code: url = ExternalInterface.call("window.document.location.href.toString") as String; How it can be ...
1
vote
1answer
91 views

XSS in HOST header

I'm able to inject JavaScript payload in HOST header, a request will look like: Host: <script>alert(document.cookie)</script> User-Agent: Mozilla/5.0 Gecko/20100101 Firefox/29.0 Cookie ...
4
votes
3answers
108 views

What can we do with non persistent XSS vulnerabilities?

Sorry for this stupid question but i'm thinking about what an attacker can do with a non persistent XSS attack on a website? An attacker can try to phish me with a malicious url, steal my cookies or ...
-1
votes
2answers
82 views

Content sniffing XSS attack?

As a part of work, I've come across content sniffing, and i understand web apps can be vulnerable to xss because of it. There is another post, regarding content sniffing and xss, but didnt quite ...
0
votes
1answer
62 views

An XSS attack is working on Firefox but not on Chrome..Suggest changes to make it work on Chrome

I am able to inject this: http://domain.com/search/songs/<img src='alert(document.cookie)' onerror='alert(document.cookie)'> to the page HTML. The onerror event is giving me the cookie on my ...
1
vote
1answer
49 views

Is it safe to call an untrusted service with jquery.ajax and dataType 'jsonp'

From what I understand, the JSON-P technique generates a script tag into the DOM of an HTML page to get across the single-origin restrictions imposed on the XMLHttpRequest JavaScript API for AJAX ...
2
votes
1answer
1k views

javascript:alert(“test”); command does not work

Hello! As I have done before and also have read in many web sites, that just simply writing: javascript:alert(document.cookie); should work on any web page. But now, I was not able to execute it. I ...
-1
votes
4answers
126 views

Software for web hacking? [closed]

I want to learn sql injection, xss and other web attacks. I am new to all this, just a beginner. I want to know which software to use. Can I use Windows for these attacks ...
6
votes
2answers
604 views

PHP: if charset mismatches (htmlentities UTF-8) viewed by client as ISO-8859-1 (or vice versa)

Short Question: Question: Could any security vulnerabilities arise if a server runs htmlentities as UTF-8 but the client views the results as ISO-8859-1? Assumption: No vulnerabilities exist when ...
1
vote
2answers
72 views

XSS with input in onclick attribute

If I have... <table onclick="texttexttexttextUSERINPUTHERE"></table> Would XSS be possible? I mean with > and " filtered out. I know if there wasn't text behind the user input, you could ...
0
votes
2answers
84 views

trying to xss a site [closed]

http://XXX/?subscribe_message=%3Cscript%3Ealert(/zzz/);%3C/script%3E Why doesn't that popup with a /zzz/ alert? When I do javascript:alert(/zzz/); in the address bar it does so why not when I do it ...
1
vote
3answers
66 views

Perform XSS on a link where image path is passed in querystring

I have a page on my website like this : domain.com?img=test.jpeg And on the page, the javascript written is: var imgPath = getQuerystring('img'); $("#img").attr('src','/Images/' + imgPath); I was ...
2
votes
1answer
81 views

XSS - history stealing

I am little confused about this matter. By simply writing a JavaScript code we can go through our browser history and identify visited links. It is fine. But how an attacker use this to identify a ...
3
votes
2answers
230 views

Learning XSS: Why is my javascript ignored?

<a href='mailto:</a><script>/*'></a><script>/*</a>: <br> <hr> <a href='mailto:*/location.href=/*'>*/location.href=/*</a>: <br> ...
2
votes
3answers
184 views

Why are scripts injected through innerHTML not executed whilst onerror and other on<event> attributes on elements are? - Google XSS Challenge 2

SPOILER ALERT : Do not continue if you do not want to be spoiled I am currently doing the Google XSS Challenge Level 2 . I am injecting XSS code that is inserted into the document using ...
2
votes
2answers
186 views

Bypass cookie validation

I have discovered that a web application allows the setting of certain cookie values through request parameters. Each request param results in a separate Set-Cookie header. i.e. a request like this: ...
6
votes
2answers
985 views

Is this an XSS vulnerability?

My company recently had a security assessment done on our website and we had a XSS vulnerability reported. Below are the details of the reported vulnerability: If a user hits a URL like the one ...
0
votes
1answer
54 views

Understanding Same origin policy

I am trying to understand same origin policy better. From what I understand same origin policy restricts code from one "origin" not access data from another "origin". What I am trying to understand is ...
1
vote
0answers
72 views

How did the Tweetdeck XSS Vulnerability work

How exactly did the recent TweetDeck vulnerability work? It says here that it had something to do with the HTML heart character but I don't fully understand what the explanation means. From the link : ...
1
vote
0answers
156 views

How should I mitigate the XSS vulnerabilities in KnockoutJS described at mustache-security?

The site Mustache-Security describes XSS vulnerabilities in KnockoutJS... The vulnerabilities come from the use of eval (or some equivalent) to convert text in the data-bind attribute to executable ...
8
votes
3answers
1k views

Allowing users to input a safe subset of HTML

I recently posted this question on Code Review and it was recommended that I ask you guys about it. Basically, this will be used to allow users to generate formatted content. It gets put inside of ...
23
votes
2answers
3k views

JavaScript written only with brackets?

I once saw JavaScript code which was only written as multiple brackets (). Does anybody remember this kind of code? There was also an online converter to convert "normal" JS into this style of code. I ...
1
vote
0answers
64 views

XSS Vectors for new Image()

What are possible XSS vectors to this JavaScript code new Image().src = encodeURI('[user url here]'); Let's assume two cases: [user url here] is some string provided by user (with no validation) ...
0
votes
2answers
116 views

Way to decode an encoded payload [closed]

I am facing an XSS vulnerability in my ASP.Net Web application where the malicious code may be encrypted and html encoded Bottomline: I am trying to prevent XSS via code obfuscation. Question: I ...
0
votes
2answers
66 views

Javascript injection via document.cookie possible?

Let's say someone rooted a site, is it possible for the attacker to do XSS via document.cookie? Instead of giving the user a name=value, the attacker does something like this ...
2
votes
2answers
101 views

Is XSS through style attribute possible in modern browsers?

Let's say users can define content of the style attribute, but in a constrained way. They can't break out of its value, as white-listing parser will remove any unsafe attributes/tags produced this ...
3
votes
4answers
330 views

How is this XSS attack working?

SPOILER ALERT: This question contains an answer to one of the problems from the Google's XSS Challenge! Please stop reading further if you're not interested in knowing the answer right now. I'm ...