Tag Info

New answers tagged

6

The class attribute could be used for redressing the UI to make untrusted elements and text appear to be authoritative text coming from the website itself. See the Google Browser Security Handbook for more information. Instead of writing your own, use an established HTML sanitiser such as Google Caja. These are hard to write because there are so many ways ...


3

BeatifulSoap is not designed as a Sanitizer for HTML but primarily designed for extracting data from the HTML like needed in screen scraping. That is don't expect it to deal correctly with malformed HTML which nevertheless gets executed by the browser. Apart from that a large part of your question is already answered in your previous one. And to cite myself ...


5

So, how can I (the user) feed (spoof) the VPN IP address (which I have in a text file) to any JS that might run so that it all looks the same to the web server? The detection of local IP addresses you refer to depends on WebRTC. There is no way to spoof the addresses returned during the WebRTC discovery without changing either the browser code or ...


0

However, enabling javascript now means that a website can run a snippet of javascript code to retrieve the user's ip address (even if they are behind a proxy or VPN). Firstly, I think it's nearly impossible to retrieve any actual useful information about IP addresses through javascript. I think it's possible via some WebRTC hackery to get the local ...


1

I don't see a risk for most of the cases. The JavaScript will return the address of the machine, which is useless if it is communicating behind something like proxy, router, Wifi AP or NAT.


-1

If the user is authenticated and an attacker manages to use some kind of exploit to inject javascript (or flash) into the page, then yes, the attacker will be able to steal the secret token. They simply make a request using AJAX to the /auth endpoint and read the redirect URL that comes back. This was made possible recently by the addition of the responseURL ...


3

Question 1:- assuming the polling interval is acceptable, is this a strong enough defense? Could the malicious code fool the polling code? No, its not a strong enough defense. Yes, the malicious code can identify the polling server/service by its IP, User Agent etc. and serve the clean file to your polling agent while continue to serve malicious files ...


0

As far as Question 1 goes, it would be easy for malicious code to fool the polling code. As am example, a lot of PHP malware looks at User Agent strings, and gives back 404 codes to Google, Bing, Yahoo and others. It would be almost as easy to keep track of IP addresses that make repetitive requests, and spoof them. Given a dedicated opponent, the whole ...


4

There are a number of local processes that will watch files and directories for any changes, writes, deletions, and accesses. When these events occur, the process creates an event log through syslog. This can happen in a second. If the syslog entries are sent to a remote server (as they should be) you will have nearly instant alerting to file changes, ...


1

Though this being an old question, I'm adding an answer for future viewers. "Cross-Frame Scripting" is basically data leakage that can happen when an attacker embeds a victim's website into a frame within their own website and monitor/spy on the activities does on the framed website. An attacker can register a JavaScript listener which listens to all key ...


0

As the commentators suggested you correctly, you will need to use the HttpOnly fla as a solution. But I just want to add a note regarding the right comments you received about HttpOnly flag. In fact, if a client of your website uses a Mozilla Firefox browser of version before 3.0.6 (Bug 380418: XMLHttpRequest allows reading HTTPOnly cookies) and/or ...


21

You are trying to fulfill something impossible. If it is that easy, web malware would be dead few decades ago. If you want to use mathematical tools to track malicious JavaScript code, you need first to know which features are employed by JS malware. Once you understood these features, you may guess that it will be impossible to factor anything meaningful ...


1

Your attempt to recognize malicious JavaScript will certainly fail at character level. I doubt there is any difference in the first place, and even if there was, the author could easily obfuscate their code and get a mostly uniform distribution for the code's characters. I believe a more fructuous approach would be to detect combinations of particular ...


2

As of 2015 this is how you prevent your website from sending the Referer header: Just add this to the head section of the web page: <meta name="referrer" content="no-referrer" /> This works both for links and for Ajax requests made by JavaScript code on the page. Other valid meta options include: <meta name="referrer" content="unsafe-url" ...


2

A mature wiki software like Wikimedia usually does not allow normal users to embed any scripts in wiki articles. But still, wikis are prime targets for search engine spammers. The structure of wikis is very search-engine friendly which means that wikis often get quite a lot of page rank which in turn exends to any websites linked from them. Also, anything ...


2

I've never before seen anything like this. Is this the only case or has this been known to happen? The scenario you experienced could be innocuous as highlighted in @RоryMcCune' answer as well as it can be a nefarious attempt/attack. Let me explain this last scenario. There is one interesting scenario about your question: as @RоryMcCune said, what ...


13

Wikipedia and big popular sites are mostly safe, as any security holes are found quickly, usually long before the site gets its momentum. Smaller blogs/forums which allow user content are more vulnerable. I used to visit a Russian tech blog several years ago, and the posting form allowed some HTML formatting. Someone managed to include JavaScript code from ...


44

Assuming that you are coming from a BT connection, it's possible that this is part of the BT parental controls program. There is a discussion of a similar looking pop-up here , which seems to tie into what you're seeing, and also a thread here on the BT site which has a link to a process to turn off that setting. To test this theory you could log into ...


1

I found this page, but here the the fingerprint is only retrieved after a request has already been made. You need to do some kind of request to get information about the peer, because somehow it needs to collect these information. But of course you can do a dummy request (pre-flight) not containing any sensitive data. But note that a normal application ...


5

To keep you up-to date, you can read about the freshly MFSA2015-78 where Firefox sandboxing mechanism is bypassed by violating the same origin policy. The problem fixed by Mozilla Firefox on the 6th of August 2015. This vulnerability allows attackers to bypass the same-origin policy and execute malicious JS code remotely that will be interpreted in the ...


2

This sounds fine, and seems like a good solution to protect the session cookie against XSS attacks by duplicating the value of username into a non-http only cookie. All your authorisation checks should be being made server-side anyway. So if your client wants to do something server-side, it sends the request and then the server makes the authorisation ...


-1

Because you are using Google Chrome Developer Tools, here some information from my experience: COULD BE that the User Agent change is not being applied in the website. Mobile User Agent Emulator in Google Chrome Developer Tools is not really efficient, sometimes it works and sometimes not. Depends of the user agent detection of the website (Web Mobile ...


1

JavaScript itself is not dangerous, the complexity of modern browsers and consequentially the bugs introduce are. But of course JavaScript is one common way to exploit these bugs. Limiting the usage and/or execution of scripts increases the security, there are different ways to do that. Browser configuration allows you to completely deactivate scripts or ...


0

I had to read your question a couple of times to understand what you were describing in option one - if your session cookie contains a predictable, clear text value (in your example the authenticated username and the redundant fact that they are authenticated) then your security is fundamentally broken. Session is should be random or encrypted with time ...



Top 50 recent answers are included