Hot answers tagged

17

Did XSS reach its end-of-life with the introduction of the HTTP X-XSS-Protection header? No. X-XSS-Protection is only used to enable or disable the inbuilt filtering[*] - which is generally enabled by default anyways. So a more fitting question would be if XSS reached its end-of-life with browser filters. But again, the answer is no. XSS is still a ...


5

The first line 'iayQS28R... is a key to be XORed with the bytes given in the code variable. When interpreted by Javascript, it does nothing because it's just a string constant. But the script opens its own source file (something you can't do in pure Javascript, but you can with the extra packages that are available when Windows runs a Javascript script as a ...


5

An XSS attack could replace a legitimate download link on the site to one that contains a trojan. The user clicks the link, downloads the executable and runs it thinking it was the genuine program they were intending to install. The attacker could even backdoor the original executable so the user doesn't suspect that anything is wrong. As for user files, it ...


4

To cause injection in this context you need to either: Close the script tag: e.g. </script><script>alert('xss'); OR close the single quote string context: e.g. '; alert('xss'); However, as the first option would result in &lt;, etc, and the second option would result in \' characters being output (and not possible to escape \ either ...


3

Original version Using document.write in an event can cause problems is the event is fired after the page is loaded (i.e. closed), because the browser will then clear the document and start a new blank one. I am not sure I understand what the "payload ain't delivered clean, as result I get a lot of other HTML mixed" is supposed to mean, but this might be ...


3

Even if the malware is successfully downloaded by the user, wouldn't he still have to execute it himself to infect his system ? In the case that no exploit was used the malware has to downloaded and explicitly executed by the user. This is usually done via social engineering, i.e. declare the software as an software update or necessary plugin to view some ...


3

Is the best choice to use some fake text to show in the box and then check that fake text on save? Yes, this sounds like the way to go. This option doesn't show the true number of characters for what they originally typed in. Is there a better method? I would see that as an advantage. I would see little benefit in revealing the number of ...


3

The user can modify and delete anything stored in their browser. Any malware installed in the user's system with the user's privilege can also do so. The system administrator can also modify and delete anything stored in any user's browser. Any malware with the administrator's privilege can do the same. Another non privileged user in the same system ...


3

What are some reasonable/interesting ideas of ways to address this issue practically? GPG encryption, with steganography to hide the fact that you're using encryption in plain sight. The basic idea you need to avoid mandatory compromise to encryption, is find any data channel that is not blocked and use non-compromised encryption over that data channel. ...


2

No, because the user script/chrome extension could simply block the script element before it even loaded. A decently designed piece of malware would do this automatically.


2

It's not obfuscated script. it's only minimized script for faster loading purposes. These are some sample scripts. Normal Script: StackExchange.ready(function() { StackExchange.using("postValidation", function() { StackExchange.postValidation.initOnBlurAndSubmit($('#post-form'), 2, 'answer'); }); StackExchange.question.init({ ...


2

I am not aware of any way to end a <script> without the presence of </script. (case insensitive, no encoding) If there is a syntax error anywhere in a particular script, then that whole script will not execute. (of course you seem to already know this, and thus you are trying to insert </script>) However, this is still serious because it is ...


2

Server side: As a security procedure they encoded the "/" in the "&#47" in order to avoid any directory path traversal or XSS (no luck mate). Try other methods of getting around the "/". Cheat-sheet: https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet Client side: Your browser is having a sort of XSS protection enabled. Try to disable that ...


1

Short answer: Acrobat JavaScript is essentially harmless. Longer answer: Acrobat JavaScript (the JavaScript in PDF) is essentially harmless because it is run in its own secured environment, and has very little access to the outside world. It is possible, however, to craft calls to a server (for example using the getURL() or launchURL() method) which may ...


1

The problem isn't the WYSIWYG editor. They are clientside code. The problem with such editors is when they are integrated with the serverside to post content or perform an image upload. Much of the bad reputation comes from when they are included in a CMS plugin. Those integrate with the serverside code base and either aren't always coded securely or the ...


1

You can disable javascript in your browser, then download the page. For mozilla go there : https://support.mozilla.org/en-US/kb/javascript-settings-for-interactive-web-pages?redirectlocale=en-US&redirectslug=JavaScript.


1

As already suggested a beef hook into the xss vector can be very dangerous in this case. Apart from the traditional metasploit intergration into the beef hook, there are some other scenarios which needs to be kept in mind. WebRTC javascript API including MediaStream,RTCPeerConnection, RTCDataChannel enables direct communication between browsers using TURN ...


1

The sugCls.handleContent method code is here starting on line 1263: https://github.com/liigo/html-parser/blob/master/test/testfiles/sohu.com.html You can see that it does some interesting slicing and dicing to extract parts of the string it is passed. To de-obfuscate, one would need to follow each step manually, run the command in its intended context and ...


1

First, control which scripts are loaded The most important reason to block ads is to protect yourself from malicious, dangerous and incompetent code delivered through these ads. Accordingly, script blocking is a far better method than ad blocking (alone). Once you do that, you can leverage that tool for fine-grained control. Let's first assume that you ...


1

The way these scripts work is by trying to detect if a HTML element that is supposed to be holding the ad exists or is empty since adblocks methods are to remove the content from the page. Adblocker's don't have much to do about it since they remove the elements/empty them which can be easily detect by Javascript with some code as the following: if (...


1

Old versions of IE will treat it , if you embeded it in a script tag it will be rendered and executed



Only top voted, non community-wiki answers of a minimum length are eligible