While I was reading a ASP.NET book I found that is supports VBScript but this made me think if VBScript is still a tool of hackers to attack other users, I guess only Internet Explorer users, As I know some users with Intranet (IE only website) use Internet Explorer, But I havent seen any website with VBScript. Should we worry about VBScript ?



VBScript, like JavaScript, is a client-side script which can be abused for XSS attacks. I've only seen a few websites which support it in practice. The principles are the same though, input validation is very important to prevent attackers from injecting malicious script into the website (e.g. stored XSS).

I don't worry about specific languages, I worry about how developers implement the code. If you keep to good practices, doing correct encoding and input/output validation, you should be ok.

  • A lot of browsers also don't run VBScript by default. – Polynomial Apr 12 '15 at 21:40
  • 1
    @Polynomial are there any other aside from IE? – Lucas Kauffman Apr 12 '15 at 21:45
  • 2
    I'm too drunk to check right now, but if I remember correctly Chrome, Firefox, and Opera can run VBscript if you enable it. – Polynomial Apr 12 '15 at 21:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.