Tag Info

New answers tagged

3

Don't rely on using your own "conversion" rules, OWASP recommends using a security-focused encoding library to make sure the necessary rules are properly implemented. Escape the following characters with HTML entity encoding to prevent switching into any execution context, such as script, style, or event handlers. In addition to the 5 characters significant ...


2

Updated browsers will encode the referrer URL. So your examples will not work to trigger XSS nowadays. Try this: <div id="cat"></div> <script> document.getElementById("cat").innerHTML = decodeURIComponent(document.referrer); </script> JSFIDDLE: http://jsfiddle.net/y4afy8h9/1/?<img%20src=x%20onerror=alert(9)>?


0

Considering that these are static resources I don't think these are attacks. I have no idea what it could possibly be... this suggestion doesn't even make sense, but maybe a random syntax of parameters that prevent server side caching. Maybe certain crawlers use this. It's weird because it's not even requesting specific files in the directory it looks like. ...


4

It depends on where within the HTML document the data is printed as there are different contexts within different rules. Replacing a literal < by &lt; is only viable when < is a special character, which would change the current parsing state. There is a quick overview of prevention rules in OWASP’s XSS (Cross Site Scripting) Prevention Cheat ...


3

This is very bad practice. You are keeping a blacklist. But recommended way is keeping a whitelist which give only allowed chars after a filter. Answer to your question is, < can be hex encoded and write in other encoded schemes. So Simply replacing < with &lt; would not be adequate.


1

Where are you parsing out the <? If it is on the client, then you have have only maybe stopped a ten year old hacker (but not this ten year old hacker). However, if you are parsing out the executable code server-side, then yes, you've effectively stopped this particular form of injection -although there are more complete and secure ways of doing this. ...


3

Depends on a lot of factors. If the malicious input (all user's input is malicious by default) is echoed just to your HTML body and your server sends the headers "Content-Type: text/html; charset=utf-8" and "X-Content-Type-Options: nosniff", the answer is yes, this method is secure enough. When I say HTML body, I am supposing you are echoing the input to ...


2

Besides capturing the screen with Javascript, a common thing is tracking a users mouse movements/actions on a web page. This previous question on StackOverflow shows how to capture the position of the mouse in Javascript and jQuery. With this information, people can take those mouse positions and map them with a screenshot of the web page (created using ...


19

JavaScript has full access to the document object model, so at least in theory, it could capture what's on its own web page (but not anything outside the browser window) and there's a library to do that: http://html2canvas.hertzen.com/ (I haven't tried it.) The same-origin policy prevents JavaScript from accessing the DOM of another site. Since ...


0

If you want passwords, the best way is to use TLS, and then send the passwords in clear. This is simpler than a challenge-response mechanism. If you however can't have TLS for websockets, but you have TLS for the code (delivered over HTTP), best thing to do is to do the login via HTTPS, generate session cookies (or some other form of keys) and use them to ...


1

If you want security, transmitting authentication data through TLS is a big start. But let's assume the websocket is already set up over TLS. A solution I would recommend would be based on a challenge-response mecanism : The server would set up a random set of bytes (the challenge), set a timeout at the end of which the challenge wouldn't be authorized. ...


0

What does that really mean? Can you please give me a real life example? Simple attack example On page at evil.com the attacker has put (jQuery because lazy): $.post("http://bank.com/transfer", { to: "ciro", ammount: "100" }) The attacker then convinces you to visit evil.com (YOU'VE GAINED A PRIZE!) This would work because authentication cookies ...


1

Actually Phonegap apps are not really "all native". Only system functionalities (like file access, camera access, etc.) are translated to their Java counter-parts. It still uses a webview and a lot of javascript to implement the application business logic. So, answering your question, the local storage issue is still a valid concern as it is a feature of ...


1

Well, according to PhoneGap/Cordova security guide it seems that localstorage is not recommend to store sensitive data. So what you can do? Well, here are two options I think you can use. 1- Encrypt the refresh token and store it encrypted in the localstorage. You can use CryptoJS (a JS library to encrypt/decrypt the data) to encrypt your token using AES ...


0

It the code works, obfuscation is worthless. Take this example: Before obfuscation: function say(whatever){ alert(whatever); } after: eval(function(p,a,c,k,e,d){e=function(c){return c};if(!''.replace(/^/,String)){while(c--){d[c]=k[c] ||c}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(ne w ...


0

In Firefox you may manually edit prefs.js file adding: user_pref("capability.policy.policynames", "localfilelinks"); user_pref("capability.policy.localfilelinks.sites", "http://localhost:8080"); user_pref("capability.policy.localfilelinks.checkloaduri.enabled", "allAccess"); Notice the need for explicit port specification if different from 80.


0

One possible risk is that Adobe and third-party reader extensions are supported, your PDF viewer may have extra modules loaded, or may require them to open certain documents. Examples include: Adobe LiveCycle Rights Management ES4 Time limited PDFs for which there are commercial products Both of these endeavour to constrain digital document use. At ...


0

Reading the marketing copy from the links, the type of 'bot' you're talking about is not a typical 'browser' at all, but often just a simple script or even the venerable wget. If that is the case, then it is trivial to determine if a script is navigating or if a full-fledged browser is. But, as you suspect, if someone is interested in defeating these ...



Top 50 recent answers are included