Tag Info

Hot answers tagged

6

I work at Disqus and I feel the answers above are misinformed about how our application works. Basically, our application is loaded almost entirely inside an iframe. This dramatically changes how your site is exposed to both our code and 3rd-party code. Am I essentially giving scorecardresearch.com access to my users and user's cookies for my domain, ...


4

BeEF has 4 ways to keep user browser hooked - Create popup under the browser to keep BeEF js code executing, Prevent closing tab with BeEF code running by asking confirmation Open new pages in foreground iframes Capture all link clicks and load new pages through ajax, without reloading page. Details are here: BeEF Persistence


4

The number one reason why we are not all compromised is that there are just not enough attackers to do the job, and most of you are not interesting enough targets either. Civilization as a whole can keep on running because most people are basically honest; you can walk in the street among complete strangers and none of them will try to punch you or stab you, ...


2

It will render that content in the div and show the alert. My question is if the act of rendering the contents of the textbox on the client side could pose any kind of threat? If so, what could a malicious user do? If this is the case I would fix it (defence in depth), but as AviD pointed out without seeing the full site and its context, it is ...


1

While the previous answer does explain how to do this, since this appears to be a demonstration problem, it is probably beneficial to give a little more explanation about why it works. This example appears to be a demonstration of the weakness of client side code. In public networks, such as the Internet, client computers are pretty much never trusted. ...


1

This is a moving target, as there is a cat-and-mouse game as attackers discover new techniques and browsers implement new defences. In general, JavaScript: can access config information about your browser and plugins. The site you linked seems to be a good summary of the current techniques. cannot access your local files, at least, unless you explicitly ...


1

Edit: itscooper's answer is the correct interpretation of the vulnerability in the THN article that the question linked to, in my opinion. The answer below is for the general question of how to hide js and have it be executed inside an image object. Historically, you could XSS some browsers by inserting "javascript:" URLs as image sources, because they ...


1

In the article you linked to, the Javascript code is not being included inside the image file itself per se, it's manifesting within the HTML page that references the image. Untrusted input is being returned inside the image tag without sufficient validation or sanitisation. This is persistent cross-site scripting since the malicious input is being returned ...


1

There are 2 ways you can do this, the first is simply writing a script in a text file and saving it as a jpg. This is obviously not an image, but it will work. If you want a real image, you can take your image and use a hexeditor to add your script to the image metadata. This works because the browsers interpret the code as they try to render the image into ...


1

Preventing cross-domain WebSockets is server-sided. So yes, a successful XSS attack can create a websocket connection to a 3rd party server and send sensitive information. But it's far from the only technique an XSS attack can use to leak information to a 3rd party server. Take the following code for example: var password = getCredentials().password; var ...


1

Generally speaking, login pages don't display content that can be attacked with XSS. There isn't a good way to alter the code on that page to be able to monitor the entry. Also, in general, XSS protection is pretty good on most modern sites, at least on the parts where it could be particularly damaging.


1

The second method relies on this library: http://nxtra.org/nxt-client/js/seedrandom.js It is a pain to read that code, but I think I can confirm that it is at least good enough for the job. The important parts are that there is a plenty big entropy pool, the code ensures that enough entropy is gathered, the whitening function scrambles the gathered entropy ...


1

In on itself it should be fairly secure as a concept, but generally speaking one should not rely on JavaScript for any kind of security. It's trivially easy to do injections and interceptions on any JavaScript code and doing complex math in JavaScript can easily trigger 'stop script' or any other browser script sanity checks so developers tend to either ...


1

You are going about it wrong. There is no point at all to a hash for authentication if the comparisons are being done locally because an attacker can simply inject the hash value directly into memory and bypass the authentication check. For local purposes, you have to use something like your second part of your idea, but that part should be done using ...



Only top voted, non community-wiki answers of a minimum length are eligible