Tag Info

Hot answers tagged

12

Assuming you're handling the image data in a sensible manner, no. The data never gets put in a place where it could be seen as code. Even if you're not handling the image data in a sensible manner, probably not. The base64 "alphabet" is missing some of the characters essential to producing useful Javascript -- there's only so much you can do with +, /, =, ...


6

Google spends a lot of money each year in bug bounty to ensure that Gmail isn't susceptible to XSS. Part of this effort has produced Google-Caja, which is an open source project that filters HTML to a "safe" subset. HTML filter sandboxes like Caja rely upon an "older" solution that uses complex parsing techniques, and thousands of regular expressions to ...


4

The problem is that there are a whole load of ways to get XSS in such a case: <style src="http://ha.ckers.org/xss.css"/> <a onclick=alert(1) style="position:absolute; display:block; z-index: 9999; top:0; left:0; width:10000px; height: 10000px"></a> <div onmouseover='alert(1)'/> <svg src=x onerror='eval("...")' /> Just to name ...


3

PHP does not encode characters when setting $_SERVER['REQUEST_URI']. Any URL-encoding you may see is performed client-side (e. g. in your browser). So all you have to do is use a different HTTP client which sends the raw URL with no prior encoding. For example, cURL will do this. While literal spaces aren't allowed within a URL, it's perfectly possible to ...


1

Web browsers evolve constantly. It is possible (although very rare according to my experience) that you manage to create a blacklist that blocks every meaningful XSS attack today, but tomorrow a new browser feature may introduce new possibilities for the attacker. You can check out http://html5sec.org/#html5 to see how many weird just got introduced ...


1

I came up with the code below but it doesn't work That's because you are performing a CSRF attack, but in exercise 2.1 there is actually an anti-CSRF token preventing this. You have to exploit the XSS vulnerability here. I came up with a plan to use a cookie and set the token to 'abc'. So, when I come to login, i use the username and password that I ...



Only top voted, non community-wiki answers of a minimum length are eligible