Tag Info

Hot answers tagged

5

Some scanners simply search for the injected string ("found" in this case) somewhere on the page, if "found" is in the search results, then it would classify it as a positive finding. If the XSS string is being interpreted as a string in the search function (literally searching for the string <script>alert('Found')</script>, then you can chalk ...


4

The first step is to patch the vulnerability by escaping any HTML entities or removing any dangerous characters all together. Reflected XSS is a client-side attack method, caused by a server side vulnerability. I wouldn't worry too much about any damages if you didn't catch an XSS worm in action or actually saw anyone using the exploit to attack other ...


4

I haven't studied this specific vulnerability, but from the points you mention I should note: Cross-Frame-Options is not used too much on websites. Although this SOP vulnerability is dwarfed by X-Frame-Options, two months before there was another one where it didn't seem to matter. Most outdated phones where you will be able to exploit one of them, most ...


3

This works for me: <html> <img src=1 ...


2

Your source content <a href="/search?text="><script>alert('Found')</script> seems to show that your application is vulnerable to XSS. I think your browser is just mitigating the injection because it detects that it's inline javascript. Maybe you are using a framework that is sending to your browser some mitigation headers. Look at the ...


2

What should I do to mitigate the damage? Usually, it is the user's browser that is compromised by XSS vulnerabilities on web sites. You probably won't see any damage done to your site, especially since it was reflected XSS. The attacker would need to target each user separately and convince them to click a malicous link in an email or visit a malicious ...


2

An obvious scenario, as @schroeder pointed out in one of the comments, is when the server inspects strings for blacklisted strings like alert(1). Apart from that, in order for the payload to work, the application must meet the following conditions: There should be no restriction on the input length (as you can see, the payload can be enormous length). The ...


2

The HttpOnly flag only serves to protect sensitive cookies from scripts. Assuming the load balancing cookie is only concerned with routing through to a specific server and cannot identify a client, there's no harm in this cookie being exposed. A XSS attack will only identify which server the browser is connecting to, and not anything specific to the client ...


1

XSS only happens when data is output. In your code sample you are setting the variable myhash to the hash value in the address bar. As your code doesn't contain any sinks and your variable is not output, the above code, in isolation, is not vulnerable. However, to check for XSS vulnerabilities you need to focus on output to your application rather than ...


1

Perhaps the the XSS-code ended up inside a tag of which the contents are interpreted as text-only, such as <title> or <textarea>. Try prepending the XSS code with </textarea> or </title> if this is the case. It may also have ended up in an attribute of an element, in which case you need to close the attribute and element using "> ...


1

XSS is usually an attack against a server. Unless your phone is serving Web pages to external connections this should not be a problem. If your server that is serving the pages to the phone is vulnerable then XSS is identical to a normal website - with the exception it may be harder to trick someone into following a link. Unless your application takes in ...


1

There are several browser-side mechanisms, that work domain-wide and thus can be affected by this idea, at least: Firefox NoScript plugin - permissions to run individual scripts are domain-wide, so enabling scripts for one user will result in enabling scripts for all users cookie visibility Flash access permissions Java access permissions JavaScript access ...


1

A CSRF attack can only happen when cookies (or other authentication mechanisms) are provided by the client automatically. That is, where the client has access to cookies from multiple domains (such as a web browser storing cookies for each site you visit). However, a mobile app containing a web viewer will typically only have the cookies for its own system. ...



Only top voted, non community-wiki answers of a minimum length are eligible