Tag Info

Hot answers tagged

4

HTTPOnly disallows the cookie from being read by JavaScript via document.coookie. The Secure flag will restrict the cookie to HTTPS, but if your site has an XSS vulnerability, HTTPS will not protect you. The XSS URL https://example.com?q=<script>alert(document.cookie)</script> works just as well as ...


2

It would have helped if you would have provided with the HTML code as well. However, i think the reason why it does not work is because the value of the hash anchor is not being utilized in the JavaScript. It would have been exploited as DOM based XSS if this value was being used in JavaScript somewhere. Here's is an example of code vulnerable to DOM based ...


2

If there is an XSS anywhere on the site, an attacker can take any action the user could take. In this case the attacker could add an iframe to the vulnerable page, the iframe would have a source of /deleteaccount and then the attacker fire the click event on the submit button.


2

Based on your description this should work: \");alert("xss The " will be escaped as \", thus resulting in \\", which escapes the \, but not the ". To prevent this, you would at the very least have to also escape \ as \\.


1

An XSS attack is performed by injecting malicious code to be displayed to another user. To use a standard login form for an XSS attack, you would need the malicious code to be in the username - the only thing likely to be shown to other users. But how the username-with-malicious payload got in there isn't relevant, so it is not inherent to the fact that ...


1

Assuming that users are using modern browsers, is implementing a strict CSP policy enough to prevent all XSS attacks? Not all modern browsers implement CSP (IE has only very limited support). But assuming that the browser has proper CSP support and that you CSP is very strict (no unsafe-eval!) then it can be used to successfully prevent XSS. But... ...


1

Content Security Policy (CSP) is just a one layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. However please bear in mind that security is all about defense in depth so yes you still should implement additional security layers and please remember that preventing ...


1

They are not necessarily exclusive. They take advantage of different weaknesses. If you have the ability to do a "traditional" XSS through a reflected attack, then you likely wouldn't need to attempt a dom-based attack because you can inject any code you want before the page loads. In your examples, its not quite clear if you are differentiating the root ...


1

I observed that certain attacks could be both DOM-based and Reflected XSS No. What you list are the same payloads for both DOM based and reflected XSS (both attacks are often exploited in similar ways). But what happens underneath that is still either DOM based XSS or reflected XSS (well, or stored XSS). It's never both. The names for the different ...



Only top voted, non community-wiki answers of a minimum length are eligible