Linked Questions
18 questions linked to/from How does XSS work?
4
votes
2
answers
644
views
Web Application security [closed]
I am a web app developer, and recently one of my apps was hacked. I wanted to know what are the possible kinds of attacks done on web application (in detail) and methods on how to prevent those.
I ...
- 129k
25
votes
3
answers
6k
views
Why is it called cross-site scripting? (XSS)
Why is Cross-site scripting called Cross-site scripting? The term implies to me (a non-native English speaker) that there is some other web site involved that attacks your web site, but most of the ...
- 1
28
votes
1
answer
7k
views
Is Dom based XSS still a valid security concern in modern browsers?
I am trying to understand how DOM based XSS work, e.g. from this post, I managed to reproduce it in IE11, but e.g. Chrome and Firefox are immune at least against this exact example.
What happens is ...
- 2,287
11
votes
2
answers
8k
views
Understanding Layer 7 DoS
I recently read this article about how a lone hacker (The Jester) conducts, amongst various other things, his DoS attacks over layer 7 instead of layer 4. It also mentions at one point he was able to ...
- 2,265
6
votes
5
answers
20k
views
Blacklisting vs. whitelisting characters to prevent XSS?
I've been reading about XSS prevention on OWASP and other security channels. They all say that I should use ESAPI or a similar library and do input filtering through a whitelist approach.
However, I ...
- 65.6k
23
votes
3
answers
11k
views
Is it possible to transfer a virus through browser video?
I know that there is already a question related to viruses in videos, but the implication in the other question is that videos in question have been downloaded and played by media software on the ...
CommunityBot
- 1
27
votes
4
answers
38k
views
How to hijack a session?
Despite the blatant title of the question, this is actually for a genuine purpose.
My site uses PHP code like this:
$select="select id from tableA where user_id='".$_SESSION['sess_user_id']."'";
...
CommunityBot
- 1
3
votes
2
answers
1k
views
Found this textarea with PHP in it. Might it be malicious/exploitable?
I came across this textarea on the website of a Medical Center. Clients enter sensitive medical data here.
What users see:
HTML:
<textarea name="message"><?php echo $_POST['message']...
CommunityBot
- 1
1
vote
1
answer
8k
views
Preventing reflected XSS in URL [duplicate]
We have just had some pen testing completed against a web application and the one area identified as High Impact and Medium Probability was:
Cross-Site scripting (reflected)
The example given was ...
- 173
-3
votes
1
answer
774
views
Could blocking script in the url prevent DOM XSS? [closed]
On my site, if I were to block <script> from the url, could this prevent some cases of XSS? Any way someone could bypass that?
- 11
9
votes
2
answers
19k
views
What is the difference between ordinary XSS and Dom XSS vulnerabilities? [duplicate]
I'm not a computer guy, but just out of curiosity I've recently started to learn PHP for programming my own website and I've read about some most common vulnerabilities that exist in web applications. ...
- 2,748
0
votes
3
answers
131
views
Can isolated forms be dangerous for my server security? [closed]
I'm learning PHP and at the same time I write the examples that I get from the book to .php pages to test them and eventually publish them. My concern is about a bunch of forms that are there to test ...
CommunityBot
- 1
10
votes
2
answers
1k
views
Is there any risk related to allow user to give an URL as their image profile?
Building a website, I'd like to allow users to specify an url that point to an image that will be used as a profile picture (included in the HTML DOM as a ).
But before doing anything stupid, I was ...
CommunityBot
- 1
1
vote
0
answers
170
views
How can I explain Cross Site Scripting in a non-technical way? [duplicate]
Possible Duplicate:
Can anybody explain XSS to an idiot?
I can reasonably explain Cross Site Scripting (XSS) in technical terms to other technically minded people or people familiar with web-dev/...
CommunityBot
- 1
4
votes
2
answers
1k
views
What is cross-site-scripting? [duplicate]
Possible Duplicate:
Can anybody explain XSS to an idiot?
First I ask is there an aboslute definition? I've done some Googleing and it seems like everyone says something different.
On SO one ...
CommunityBot
- 1
97
votes
7
answers
39k
views
How does hacking work?
I am specifically talking about web servers, running Unix. I have always been curious of how hackers get the entry point. I mean I don't see how a hacker can hack into the webpage when the only entry ...
CommunityBot
- 1
10
votes
3
answers
7k
views
Is it possible to forge a post request?
Consider the following URL http://mysite.com/form?date=x. Suppose that if x is in an incorrect format, that a page is returned with <p>x is not a valid date</p>, where the page author has ...
- 4,078
11
votes
2
answers
6k
views
How to address XSS security issues in FCKeditor / CKeditor?
A security report we conducted through an outside company reported XSS vulnerabilities in FCKeditor which we're using in our PHP application.
They pointed out that accessing URLs such as:
http://www....
CommunityBot
- 1