Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

learn more… | top users | synonyms

6
votes
1answer
346 views

Safe to render data directly to DOM from localStorage? XSS attack possible?

I read that localstorage is susceptible to XSS attacks. I currently store JSON Web Token (JWT) in localstorage, and I access and display data about the user through localstorage: var localstore = ...
5
votes
1answer
948 views

How make Firefox ignore X-XSS-Protection header from server?

I have two questions: 1)How can I make Firefox ignore X-XSS-Protection header? I have a website which sends X-XSS-Protection: 1 header and I want my Firefox to ignore that header, because it destroys ...
4
votes
1answer
122 views

JS snippets on my live project do not appear in my code residing on my production server

I have a Django website project that is live (let's call it example.com). It's a forum where users can submit comments and reply to them. It has a Postgresql database, and gunicorn + nginx reverse ...
4
votes
1answer
673 views

XSS in HTML title tag without forward slash

I am trying to find out whether this is vulnerable against XSS: I can control the content of the title tag through the URL. This would make the site vulnerable if it wasn't for the fact that the site ...
2
votes
1answer
57 views

Differences between Burp request and Browser - Has different responses

So I was put on an engagement over the last week and I found a potential XSS when using Burp's intruder/repeater. However, the strange thing that I noticed was that the response in Burp is different ...
1
vote
1answer
109 views

Tweaks related to javascript execution in browser

Suppose, a filter validates the url, but not the protocol. In that case I can XSS that field with the following payload javascript://%0D%0Aalert(document.domain);//validurl.com You can paste above ...
1
vote
1answer
111 views

Is it possible to get a flash src after a redirect or an element inside an embed/object/iframe tag (cross-domain)?

The URL example.com/auth will automatically redirect the user (HTTP 302) to example.com/signed_in.SWF?token=SENSITIVE. Is it possible for an attacker to steal the token, using javascript or flash, in ...
-1
votes
1answer
79 views

<,>,/ etc symbols are getting escaped while trying for xss,anyother alternatives for these symbols to carry out the attack successfully?

Symbols like >, <, / etc are getting escaped any alternative to carry out the xss attack ? most of the websites are having xss filters
4
votes
0answers
692 views

Content-Security-Policy & Facebook login

This question seems to be related to http://stackoverflow.com/questions/15913200/facebook-js-sdk-not-executed-in-my-chrome-extension , but I am not developing a chrome extension. I am developing a ...
2
votes
0answers
42 views

Angular XSS not evaluated

Using an older version of AngularJS : 1.2.21 from example, there are some playload that can generate an XSS. ...
2
votes
0answers
47 views

How to validate Excel data to protect against XSS?

My application is dynamically constructing a source URL and then writing the resource file (Excel) directly to the response. The URL is read from a properties file, based on the application ...
2
votes
0answers
168 views

Is it safe to store bearer tokens in an iframe and/or pass them back to the parent window

I am not a security expert, so I am hoping that a few of you might be able to tell me if there are any gaping flaws in the security design for my web app. Hopefully I'll be able to explain this ...
1
vote
0answers
65 views

What percent of stored XSS attacks use external JavaScript?

What % of XSS attacks use external JavaScript. For example: <script src="http://badsite.com/maliciouscode.js"></script> Instead of: <script>alert(document.cookie);</script> ...
1
vote
0answers
86 views

XSSF cookie stealer not working

I am playing with XSSF with Metasploit and attacking Mutilldae(security 0). I was able to get the generic XSS inject working. The inject was added to the Mutilldae blog. However, when I try to get the ...
1
vote
0answers
236 views

Problem in 'underscore.js' “new Function()” when CSP header is set.

In underscore.js, template rendering causes violation of the 'unsafe-eval' property, with CSP error at following line: "render = new Function(settings.variable || 'obj', '_', source);" The solution ...
1
vote
0answers
275 views

XSSER get and post

I am using xsser for XSS vulnerability testing and I have a doubt about the parameters when it's a POST method. I have tried against DVWA (which uses get) with success like this: xsser -u ...
1
vote
0answers
214 views

How did the Tweetdeck XSS Vulnerability work

How exactly did the recent TweetDeck vulnerability work? It says here that it had something to do with the HTML heart character but I don't fully understand what the explanation means. From the link : ...
1
vote
0answers
181 views

XSS Vectors for new Image()

What are possible XSS vectors to this JavaScript code new Image().src = encodeURI('[user url here]'); Let's assume two cases: [user url here] is some string provided by user (with no validation) ...
1
vote
0answers
570 views

How safe is Apache's Commons StringEscapeUtils.escapeXml function to prevent XSS

I am using escapeXML StringEscapeUtils.escapeXml to prevent XSS in my Java application. But I am wondering if it resolves XSS to the fullest. I have tried some XSS attack vectors, and escapeXml seems ...
1
vote
0answers
117 views

Hacking attempts:in.js

A client of mine keeps getting hacked by seemingly SQL injection where a script tag containing a link to an "in.js" file is added. Sometimes from a domain called sportserve.co.uk, other times from ...
0
votes
0answers
51 views

Using phpinfo() to get httponly cookies?

phpinfo() shows all cookies, even the httponly. So the question is - how can I receive users cookis on target website through xss with phpinfo? The xss will contain code that will open phpinfo page in ...
0
votes
0answers
26 views

Different chanels for BeEF UI and Communication Server

I am working with BeEF tool and I want to access the UI interface using https (I don't want to communicate via VPN to access the control panel), while at the same time, I need to serve the http hooks ...
0
votes
0answers
98 views

Is Primefaces vulnerable to host header attack?

Is the Primefaces JSF framework vulnerable, or secured against host header attack?
0
votes
0answers
33 views

XSS script syntax problem

I have a server running on port 4444 on localhost that just echoes messages it receives. I have a JS script embedded in a message that is supposed to send the cookies of whoever looks at it. Here ...
0
votes
0answers
107 views

XSS encode / decode strange char interpretation

Can anyone tell me why i cant get this XSS to reflect ? or why is this Filtered or not rendering ? The Post sent is : ... Content-Length: 91 add=1&reference=A</><img src=a ...
0
votes
0answers
107 views

Securing my API: concept of access tokens

First of all I want to excuse for the bad spelling and grammar. English is not my mother tongue. I have built a JSON communication between a front-end (website) and my Node.js web server. I want to ...