Tag Info

New answers tagged

0

Define rules based on API keys (Something like RESTful API) A1SA2 If no one hacks the https connection the keys are ok Ex: https://S/req?api_key=A1&contet=action


2

This procedure is probably helpful in identifying and blocking a large number of bots, but people that want to steal your data, will customize and randomize as much as possible in order to avoid detection. Then No. This approach isn't the most effective against the more sophisticated scrapers. I've seen scrapers changing entirely their HTTP requests several ...


1

Never evaluate untrusted input as HTML. Even if the DOM is disconnected (i.e. not inserted in the document), evaluation of HTML can still cause XSS. Your specific example can be exploited using event attributes: var userInput = '<img onerror="alert(\'XSS\')" src="bogusurl:">'; $("<i></i>").html(userInput); If you really need to parse ...


0

If you need to take this approach then why not remove everything apart from alphanumerics and the space character? i.e. go for a whitelist rather than a blacklist. You do not know how standards in HTML and JavaScript may change in future so only allow the characters likely to be good instead of disallowing known bad. I do not necessarily have control ...


1

No, since that would imply that Flash or JavaScript does have access to raw hardware, outside of its sandbox. Think opposite, that if a flash applet or JavaScript applet would have this access, it would be possible to build a keylogging website that remained Active across tabs. If you need to protect against keyloggers, I would suggest some sort of 2FA. ...


2

In general, you can't. If you want to execute code on a user's machine, nothing whatsoever stops that user from manually doing the very same stuff themselves. You cannot effectively keep something secret from a motivated user and simultaneously run it on their computer; any secret in the app's code is accessible to the user. The solution is that you can't ...


0

This form of DOM based XSS that is called self-inflected XSS, which can be exploited using Clickjacking. It is DOM based, because JavaScript introduced the XSS vulnerability after the static HTML was rendered by the browser. Although it can be tricky to exploit self-inflicted xss, this weakness should be avoided, use ...


1

Presumably it would need to not capture content loaded from other domains (like iframes or images), but that seems solvable. The easiest explanation is that for any feature to exist it has to be prioritized over all of the other features that don't exist. You have to sell it to developers and this seems like it would have privacy implications that would ...


28

For general comments, the script tags are properly escaped, so that it's just interpreted as text instead of as actual code. In this case, that sort of thing is handled via something known as HTML encoding, where your <script> tag would get turned into &lt;script&gt; and rendered as a text string instead of interpreted as code. That said, ...


3

This is done by sanitizing data that is input by users and converting it to a safe format for displaying on the screen. In essence you take the user input and convert special characters ( <, >, / , \, etc) into html entities, which renders them harmless for displaying on a web page.


4

You seem to be asking: Is it possible to reverse engineer Javascript malware Yes. And you don't need acces to the server to do that. However it is possible for the malware author to make it more difficult to do so. I won't enumerate the potential methods here - they are (mostly) well described elsewhere. Most attackers don't bother with such sophistication ...


1

A common vector for this type of attack is to modify the .htaccess file to include a auto append statement for php. Otherwise I suspect it's located in your database as it appears to trigger after your content is loaded.



Top 50 recent answers are included