Tag Info

Hot answers tagged

9

Lets say an application was using the Content Security Policy properly, and an attacker could inject HTML, but is unable to get JavaScript to execute. A good paper on this attack scenario is Postcards from the post-xss world, and one of the attacks that is described is using "dangling markup injection". In this attack, the goal is to read a CSRF token ...


5

If you take OWASPs definition of XSS very strictly I would say no it's not possible: Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected... unless you are using some other type of client side script. That said, you could still be vulnerable to HTML Injection, which is closely related to XSS. With this ...


4

Yes, there's a possible attack: You someday change the frontend, and stop using JSON and start using something else. The XSS stored on the database kicks in and your users are attacked. It is a very good practice to sanitize the user input as soon as possible. I always sanitize them as soon as it reaches my code.


4

XSS is both a vulnerability and an attack. If we were being very strict about terminology, we would say "my website has an XSS vulnerability" and "we logged an XSS attack at 08:43". Often for shorthand people just say "XSS" and leave you to imply from the context whether they mean a vulnerability or an attack. I would say that "insufficient filtering" is ...


3

Because the index.php file is already being processed. When you attempt to inject a ?> tag into the file, you're actually injecting it into the page that will eventually be sent to the client.


3

XSF is, essentially, XSS in a Flash applet. Where in XSS you find vectors (e.g. URL parameters or form fields) for injecting content into the DOM that is parsed as script, in XSF you look for cases where you can get untrusted data to be placed into Flash variables, which may then be used in an unescaped context inside the Flash applet, resulting in script ...


2

Many attack scenarios remain possible. The definitive resources on HTML injection attacks without Javascript are: Scriptless Attacks – Stealing the Pie Without Touching the Sill. Mario Heiderich, Marcus Niemietz, Felix Schuster, Thorsten Holz, Jörg Schwenk. CCS 2012. Postcards from the post-XSS world. Michal Zalewski. December 2011. Those two papers ...


2

I use the OWASP PHP Filters. They're really simple to use and effective. https://www.owasp.org/index.php/OWASP_PHP_Filters The source code is highly readable. There are a lot of painful lessons in there.


2

As the definition says Cross-site scripting (XSS) is a type of computer security vulnerability typically found in Web applications. XSS enables attackers to inject client-side script into Web pages viewed by other users. Source: http://en.wikipedia.org/wiki/Cross-site_scripting XSS is a vulnerability, because XSS-vulnerable site gives the attacker ...


2

You can read the values of cookies using document.cookie or other client side solutions only if that particular cookie is not flagged as HttpOnly (assuming the browser you're using supports this flag).


2

Due to the same-origin policy for cookies, a kind of "chicken or the egg" situation is created. In order for the attacker to make this XSS vector viable, they would need another flaw to set the cookie value . One possible exploit path is using a XSS vulnerability on a subdomain to leverage the following property of cookies: www.foo.bar.example.com ...


2

According to the article a user created a user named "login_home_index_html" then they used HTML and CSS to hide stuff on their profile page and make it look like it was the legitimate login page. From what it looks like is MySpace didn't sanitize its user's custom HTML properly.


1

It really depends on how you use this regex. I'll use PHP code as an example: Unsave Example echo "replaced: " . preg_replace('/<(?:\w+)\W+?[\w]/', '', $_GET['input']); This would not be save. Example: input=<<a|ascript>alert('xss');</script> Saver Example If on the other hand you use it like this: $isAttack = ...


1

I don't think they spoofed the domain name. I would say they either compromised the server or found some sort of HTML injection vulnerability that allowed them to just drop in the HTML that they wanted onto a "legitimate" myspace page that existed on their domain.


1

I'm a bit confused about your question, but it seems like a framework like BeEF might do what you are talking about. This is an interesting project that allows you to drop a hook into a site that contains an XSS vulnerability and then gives you a dashboard that displays who has loaded the page. From here you can target specific users with all types of ...


1

I can't look into your problem, as you gave a fake URL for testing XSS. Here's a real URL demonstrating an XSS vulnerabilities: http://www.insecurelabs.org/Task/ Using the first task this is a URL that has an XSS vulnerability: http://www.insecurelabs.org/Task/Rule1?query=%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E Using requests python ...


1

How are you generating the record ids? If they are incremental, I could retrieve all of your images in a breeze… (but as I don't know what are those images for, perhaps you don't care 😉)


1

So at first moment i thought an alert('xxx') is enough to create a POC but inserting alert or any thing else is leading the code to become faulty Breaking the code is usually a good sign. A syntax error may show the victim is not performing the correct escapes to keep the code valid. Look at the generated source to see what it produces for your input. ...


1

Chrome and Firefox seem to no longer support UTF-7 in any format. The HTML5 specification says: User agents must support the encodings defined in the WHATWG Encoding standard. User agents should not support other encodings. User agents must not support the CESU-8, UTF-7, BOCU-1 and SCSU encodings. [CESU8] [UTF7] [BOCU1] [SCSU] Support for ...


1

I suspect it really means «They have stolen your cookies and can impersonate you. Change your password in order to invalidate the session» Another explanation would be that they could show a fake login prompt (eg. simulating that you got logged out, or entered a wrong password) and obtain your password from there.



Only top voted, non community-wiki answers of a minimum length are eligible