Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

learn more… | top users | synonyms

5
votes
2answers
733 views

XSS in HTML title tag without forward slash

I am trying to find out whether this is vulnerable against XSS: I can control the content of the title tag through the URL. This would make the site vulnerable if it wasn't for the fact that the site ...
4
votes
1answer
140 views

JS snippets on my live project do not appear in my code residing on my production server

I have a Django website project that is live (let's call it example.com). It's a forum where users can submit comments and reply to them. It has a Postgresql database, and gunicorn + nginx reverse ...
3
votes
1answer
251 views

How did the Tweetdeck XSS vulnerability work?

How exactly did the recent TweetDeck vulnerability work? It says here that it had something to do with the HTML heart character but I don't fully understand what the explanation means. From the link: ...
2
votes
1answer
126 views

XSS not exploitable when POST data is sent in JSON?

There is a reflected XSS flaw in an application I am testing. Initially, the payload is sent in POST request as value of a JSON key and the response is also a JSON object. The returned value in the ...
1
vote
1answer
56 views

Does removing user interaction create a secure sandbox that nullifies XSS?

Say there is a service online that takes as input a DOM string, loads that DOM in a browser on their server, and returns a screenshot. Would it be possible for the online service to completely ...
1
vote
1answer
120 views

Is it possible to get a flash src after a redirect or an element inside an embed/object/iframe tag (cross-domain)?

The URL example.com/auth will automatically redirect the user (HTTP 302) to example.com/signed_in.SWF?token=SENSITIVE. Is it possible for an attacker to steal the token, using javascript or flash, in ...
-1
votes
1answer
80 views

<,>,/ etc symbols are getting escaped while trying for xss,anyother alternatives for these symbols to carry out the attack successfully?

Symbols like >, <, / etc are getting escaped any alternative to carry out the xss attack ? most of the websites are having xss filters
5
votes
0answers
731 views

Content-Security-Policy & Facebook login

This question seems to be related to http://stackoverflow.com/questions/15913200/facebook-js-sdk-not-executed-in-my-chrome-extension , but I am not developing a chrome extension. I am developing a ...
3
votes
0answers
260 views

Problem in underscore.js with “new Function()” when CSP header is set

In underscore.js, template rendering causes violation of the 'unsafe-eval' property, with CSP error at following line: render = new Function(settings.variable || 'obj', '_', source); The solution ...
2
votes
0answers
59 views

Angular XSS not evaluated

Using an older version of AngularJS : 1.2.21 from example, there are some playload that can generate an XSS. {{toString.constructor.prototype.toString=toString.constructor.prototype.call;["a","alert(...
2
votes
0answers
48 views

How to validate Excel data to protect against XSS?

My application is dynamically constructing a source URL and then writing the resource file (Excel) directly to the response. The URL is read from a properties file, based on the application ...
2
votes
0answers
67 views

What percent of stored XSS attacks use external JavaScript?

What % of XSS attacks use external JavaScript. For example: <script src="http://badsite.com/maliciouscode.js"></script> Instead of: <script>alert(document.cookie);</script> ...
1
vote
0answers
57 views

JavaScript variable evasion when quote is escaped, but not newline

I'm searching a way to properly evade from a JavaScript variable to perform XSS. A normal user input will give var a='<b>user input</b>'. a isn't eval anywhere and is not usable. Howewer,...
1
vote
0answers
91 views

XSSF cookie stealer not working

I am playing with XSSF with Metasploit and attacking Mutilldae(security 0). I was able to get the generic XSS inject working. The inject was added to the Mutilldae blog. However, when I try to get the ...
1
vote
0answers
115 views

XSS encode / decode strange char interpretation

Can anyone tell me why I can't get this XSS to reflect? Or why is this Filtered or not rendering? The Post sent is: ... Content-Length: 91 add=1&reference=A</><img src=a onalert=alert(...
1
vote
0answers
298 views

XSSER get and post

I am using xsser for XSS vulnerability testing and I have a doubt about the parameters when it's a POST method. I have tried against DVWA (which uses get) with success like this: xsser -u "http://...
1
vote
0answers
186 views

XSS Vectors for new Image()

What are possible XSS vectors to this JavaScript code new Image().src = encodeURI('[user url here]'); Let's assume two cases: [user url here] is some string provided by user (with no validation) [...
1
vote
0answers
592 views

How safe is Apache's Commons StringEscapeUtils.escapeXml function to prevent XSS

I am using escapeXML StringEscapeUtils.escapeXml to prevent XSS in my Java application. But I am wondering if it resolves XSS to the fullest. I have tried some XSS attack vectors, and escapeXml seems ...
1
vote
0answers
118 views

Hacking attempts:in.js

A client of mine keeps getting hacked by seemingly SQL injection where a script tag containing a link to an "in.js" file is added. Sometimes from a domain called sportserve.co.uk, other times from ...
0
votes
0answers
13 views

Does CKEditor for ASP.NET do auto sanitation?

I don't see anywhere to enable a sanitizer in the CKEditor ASP.NET implementation. How are we supposed to do sanitation?
0
votes
0answers
63 views

Using phpinfo() to get httponly cookies?

phpinfo() shows all cookies, even the httponly. So the question is - how can I receive users cookis on target website through xss with phpinfo? The xss will contain code that will open phpinfo page in ...
0
votes
0answers
26 views

Different chanels for BeEF UI and Communication Server

I am working with BeEF tool and I want to access the UI interface using https (I don't want to communicate via VPN to access the control panel), while at the same time, I need to serve the http hooks ...
0
votes
0answers
109 views

Is Primefaces vulnerable to host header attack?

Is the Primefaces JSF framework vulnerable, or secured against host header attack?
0
votes
0answers
33 views

XSS script syntax problem

I have a server running on port 4444 on localhost that just echoes messages it receives. I have a JS script embedded in a message that is supposed to send the cookies of whoever looks at it. Here ...
0
votes
0answers
108 views

Securing my API: concept of access tokens

First of all I want to excuse for the bad spelling and grammar. English is not my mother tongue. I have built a JSON communication between a front-end (website) and my Node.js web server. I want to ...
-1
votes
0answers
31 views

How does this XSS “filter bypass based polyglot” from OWASP work?

I tried some XSS on a practice site and copied random codes from the OWASP cheat sheet to see what happens and I found this code: '">><marquee><img src=x onerror=confirm(1)></...