1

As a part of work, I've come across content sniffing, and i understand web apps can be vulnerable to xss because of it. There is another post, regarding content sniffing and xss, but didnt quite answer my question, or maybe i just misread it. content sniffing will read the file to try and determine what type of file it is. If there are malicious html tags, they may be rendered.

So say i go to www.xyz.com, it loads, (using chrome for this example), i right click --> view page source, copy the page source into an html file, save on my desktop, added a xss line within the page. I reload in chrome and page loads with the typical alert box. Now, because the modified html was loaded from my desktop, is this not a xss vulnerability on the website's end?

  • Something to think about: following the procedure you just used, how would you target someone else? – paj28 Jul 22 '14 at 9:03
2

No, loading an HTML file from your computer is never an XSS vulnerability. You can run whatever code you want locally, but that doesn't affect the website.

Cross-site scripting is about getting your code executed on other user's browsers so you can interact with their session for that site. Whether that is stealing a session cookie, performing actions, or any other interaction on the site, it has to be on another user. Running scripts on yourself is rather meaningless, you could do the action yourself!

Always consider: what could I do with this? If you can't do anything that affects the confidentiality, integrity, or availability of a service, then it's not a security vulnerability.

1

No, not at all.

What you did, is just a simple XSS test on your own browser. No other user can be affected by the XSS you coded to run on your own computer.

You can deploy the same vulnerability on your own hosted website: that way, your website will be either XSS vulnerable. In which case, it can either be used against your own website by hackers wanting to exploit your database for example, or against the visitors of your website: this depend purely on the nature of the XSS you coded.

But the one you created is a simple test that will execute only on your own browser, and won't affect that website or any of its users accept your desktop (browser) locally.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.