Tag Info

Hot answers tagged

9

The answer is usually yes if the value is only reflected if a valid CSRF token is provided - the user can only "attack" themselves in this instance. However, if there is a form generated that correctly encodes output to a page that contains a CSRF token but then that form submits to a page that does not correctly encode output then your site is still ...


8

Most browsers allow you to disable the function. For instance with chrome you need to start the browser using C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --args --disable-web-security For Firefox you have to go type about:config in the address bar. Then you need to set the browser.urlbar.filter.javascript to False. For Internet Explorer ...


5

Your best bet would be mantra from OWASP: http://www.getmantra.com/ Contains a myriad of tools for penetration testing out of the box. Also open source should you need to add/modify anything.


3

When something like Burp finds an XSS vulnerability, I can't ever verify it when using something like TamperData. If you are already using Burp to find the vulnerability, why not use the intercepting proxy functionality to modify the request and to inject the XSS payload?


2

What is addslashes for? It has no benefit against HTML injection as it does not remove the characters that are special to HTML. If it is meant as a protection against SQL injection it is ineffective, especially for non-MySQL databases that don't even use backslash as an escape in SQL string literals. You should exclusively use parameterised queries to get ...


2

Someone could pass a link to //xss.com/malware.php, by encoding it as https://www.example.com/login.php?previous_page=%2F%2Fxss.com%2Fmalware.php. To prevent this, you could pass the path from the site root as the parameter, so you would pass only dashboard.php. Then assemble the full link on the server side.


1

I'd be tempted to put a proxy between the server and the client and compare the output of the request byte for byte. That should rule out server differences due to browser headers in the request etc. and will narrow it down to local differences. You could then also capture the output in the proxy and load it into each of the browsers on each machine (as a ...


1

From MDN: encodeURIComponent escapes all characters except the following: alphabetic, decimal digits, - _ . ! ~ * ' ( ) You would normally require a space character to add another attribute (such as onclick), unfortunately this will be encoded as part of the URI. However, from OWASP XSS (Cross Site Scripting) Prevention Cheat Sheet: Unquoted ...


1

Error pages can have reflected XSS vulnerabilities too, especially when any error trace includes input parameters. If a vulnerable error page is served when the CSRF token is not present, then your CSRF protection does not prevent reflected XSS.


1

The attack described in mustache-security describes a bypass of a Web Application Firewall (WAF) that try to prevent XSS by dropping HTTP requests that contain <script> tags. If a page is using KnockoutJS, then an attacker can use a <div> instead of a <script> tag to obtain code execution: http://localhost/xss?id=<div data-bind="html: ...


1

Refering innerHTML of generated HTMLElement causes mXSS - a kind of DOM based XSS. e.g, the code following causes mXSS at IE. var s = "<listing>&lt;img src=1 onerror=alert(1)&gt;</listing>"; var parser = new DOMParser(); var doc = parser.parseFromString( s, "text/html" ); div.innerHTML = doc.body.innerHTML; therefore, you have to ...


1

&lt; and &gt; are the correct ways to display the characters < and > in an HTML context. (There are places where just escaping <>&" isn't enough—for example unquoted attribute values, or JavaScript nested inside HTML. Do you have that?) You would usually use the term “bypass” when you know/suspect there is a vulnerability, but ...


1

I would demonstrate a simple SQL injection, it's always nice to see the look on people's faces when you attack a website with a browser as your only weapon. Setup a simple site with a login page and then show them how you can expose the admins password by simply adding few characters to the url. After you get the admin's password delete the entire site. ...


1

Appscan has the "show in browser" feature that opens Appscans special "worst of all worlds" browser for the given vulnerability. If it isn't a false positive, this browser should execute the Javascript. I have found it a pretty reliable way to check for false positives. For all other testing, I've found that Firefox is the least protected from XSS, so I ...



Only top voted, non community-wiki answers of a minimum length are eligible