Questions tagged [ajax]
AJAX (Asynchronous JavaScript and XML) is a popular technique for creating interactive websites, by providing a concept for data exchange between client and server asynchronously.
124
questions
0
votes
0
answers
156
views
How to use Hydra in Kali Linux with Ajax form?
I have a website that contains a login form, which works with Ajax jQuery. I am using Burp Suite to intercept requests to this form. Burp Suite returns this when I try to log in:
POST /php/process.php ...
- 101
0
votes
0
answers
141
views
How this JSON object can be exploitable?
I was reading this documentation https://cheatsheetseries.owasp.org/cheatsheets/AJAX_Security_Cheat_Sheet.html#server-side
One of the security recommendation is - Always return JSON with an Object on ...
- 53
1
vote
0
answers
107
views
Re-populate form with JSON data
I re-populate form with JSON data via javascript (all data has the same origin server)
1 Wen the page load, make a request post ajax
2 The response Ajax is a:
Object { primary_ns: {…}, secondary_ns: {…...
- 21
0
votes
1
answer
148
views
Is the authentication system of this website secure enough?
Since I write an API for a website, I'm interested in his login system and his requests but something bothered me, I have the impression that the security system is weak...
When I login, I send POST ...
user267196
0
votes
1
answer
615
views
Secure ajax login form
When the client is logging in, I send an xhr request to the server. However the request looks like this:
localhost:80/api/login-ajax/&username=johndoe&password=123456
This is insecure for ...
- 3
0
votes
1
answer
121
views
Reverse-proxy issues
I am trying to create a reverse-proxy web application using Flask. I don't really know weather to call it reverse-proxy or not but my idea is that the web app gets a URL from ../proxy/<URL>, ...
- 101
1
vote
2
answers
175
views
Is it insecure for the user to know the process id of a background script on my web server?
I was experiencing an issue on one of my webpages, where an AJAX call is made to another script on the server to generate some files for download. Depending on things like server load, number of files ...
- 113
0
votes
0
answers
576
views
JWT refresh tokens and Double Submit Cookies
I am struggling to implement JWT refresh tokens with the Double Submit Cookies method.
My current set up for a browser based webapp without refresh tokens looks like this:
Upon successful login, API ...
- 101
0
votes
1
answer
516
views
Sharing oauth2 token with AJAX request to be sent to resource server
I am a little confused on how the token is shared from the client to an AJAX script to the resource server in the oauth2 flow.
To explain the scenario I am trying to set up, I have
a client (http://...
2
votes
3
answers
188
views
Stop User Enumeration requests on AJAX endpoints
I have an ecommerce website with over 5 million customer database. From past couple of days, probably a hacker is hitting an AJAX endpoint continuously. This endpoint takes email address as a ...
- 149
0
votes
0
answers
278
views
XSS via Ajax request?
I'm currently honing in on my web exploitation skills and came across this JavaScript function here:
Event.observe(window, 'load', function() {
new Ajax.Request('/dir/dir', {
method: 'post',...
- 101
0
votes
1
answer
106
views
How To Validate Secure Traffic from Chrome with Element To Matrix.org on Linux
Are you familiar with the Element chat system of https://app.element.io ? Are you familiar with its connections to Matrix.org (for a free account)? Is there a way that I can sniff this traffic on the ...
- 285
1
vote
2
answers
355
views
Regenerating CSFR token in AJAX requests
I would like to create a new token for each request and would like to us the following template-
<script>
var current_token=<?php echo $_SESSION['csrf_token']; ?>
$....
- 11
0
votes
1
answer
3k
views
How to prevent Cross-site Scripting in ajax response
I have a page(parent.php) from where i am calling a another page(result.php) through jquery ajax that is returning a response in html format. This response is showed on the parent.php page in a div. ...
- 1
1
vote
1
answer
692
views
Can somebody explain why the IP address 192.168.1.1 is apparently "special" and not following the CORS rules?
I asked this question: What would happen if some random webpage made an Ajax request for http://127.0.0.1/private.txt?
The answers/comments confuse me. Am I right in interpreting them like this?
"...
- 11
1
vote
1
answer
214
views
Does the HTML password field include any protection against XHR/AJAX exfiltration?
In HTML when we describe a certain field as a password field is it somehow secured against sending out the data via XHR/AJAX/similar technologies?
This is relevant in case we have to deal with script ...
- 1,542
2
votes
1
answer
157
views
Using browser XMLHttpRequest to initiate credit card transaction with processor?
I have a website where people can make purchases.
The entire website is served with https.
On the first page, I accept user profile data and generate a random ID for my client and store that in my ...
- 123
0
votes
1
answer
211
views
Is it possible to exfiltrate a router config file to server using csrf ajax?
the curl commend used to download the file
curl "http://192.168.1.1/html/management/downloadconfigfile.conf?RequestFile=/html/management/cfgfile.asp" -H "Cookie: SessionID_R3=dsadwdwqdasdwasdawd" --...
- 15
1
vote
0
answers
634
views
Does OWASP recommend to include a CSRF-token in a header or to use it as a parameter (in a State-scenario)?
The CSRF Cheat Sheet by OWASP, concerning (Anti-)CSRF-tokens is quite confusing.
For a State(ful)-scenario (the Synchronizer Token Pattern), they write:
... for AJAX calls it is recommended to add ...
- 123
0
votes
1
answer
373
views
Do URLs used in JavaScript AJAX GET calls need to be sanitized through Apache when there is no server side scripting or database involved?
I am aware that any data coming into a server from a client should be handled safely (as in sanitized, whitelisted, etc.) but I had slapped together a very simple system that pulled file contents ...
- 103
-1
votes
2
answers
145
views
Why do so many websites use third-party sites for hosting JavaScripts?
Why do so many websites serve JavaScripts from ajax.googleapis.com and other third-party sites? Wouldn't it be securer for these sites to host these scripts themselves?
- 1,676
3
votes
1
answer
844
views
Is xhr.withCredentials making POST endpoints vulnerable to CSRF?
From what I've seen, someone can add the following code to a malicious site (lets say: http://sth.malicioussite.com) and be able to perform ajax post requests to a 3rd party site, along with any ...
- 191
2
votes
3
answers
1k
views
Returning POST JSON data securely?
I have a webpage (HTTPS encrypted and authorized only via domain credentials) that displays grid information. This grid information is received via a POST request to my server which will send back ...
- 135
2
votes
2
answers
2k
views
Why is it important to never use `eval` in conjunction with AJAX?
From OWASP AJAX Security Cheat Sheet:
Eval is evil, never use it. Needing to use eval usually indicates a problem in your design.
I understand that evaling untrusted JS code can lead to a whole ...
- 5,667
2
votes
2
answers
4k
views
XMLHttpRequest CSRF fails with allowed CORS
I'm currently working on a PoC for a CSRF attack, which should be possible due to the lax CORS configuration. I have a permission to attack.
Now the following code should send a OPTIONS request, ...
- 1,019
1
vote
2
answers
2k
views
Is it possible to send cookies from third party server to browser using CORS
UPDATED FROM THE LAST QUESTION WITH MORE DETAILS
I'm building a full javascript app from Salesforce.com API with no server side script that will be hosted on salesforce.com domain (https)
This app ...
- 111
2
votes
2
answers
32k
views
Why Chrome blocks ajax locally?
Could not find dup, so let me know if there is one
I am trying to create static one page website (to host it on neocities). I use jquery's load() function for that. It works fine in Firefox (and Edge)...
- 2,316
2
votes
0
answers
187
views
Web application making a call to a REST API when already authenticated
I'm new to ASP.NET Core and OpenID connect/AzureAD, so I'm looking for some validation (or otherwise) of my approach. Extensive reading/googling over the last couple of weeks while I've been learning ...
- 121
6
votes
2
answers
3k
views
Is an AJAX call less secure than the normal POST method?
I currently have a standard login form like this:
<?php
if( isset( $_POST['username], $_POST['password'] ) ) {
// escape both strings and compare them to database
}
?>
<form action="" ...
- 197
0
votes
1
answer
362
views
XSS prevention when inserting HTML without user controlled data into the DOM?
I have some JavaScript that fetches some HTML from a PHP script, and inserts it into the DOM:
$.get("/includes/blocks.php",{
id:encodeURIComponent(id)
}).done(function(Data){
$('<div class="...
- 3
1
vote
1
answer
2k
views
jQuery $.get HTML code and XSS
JS code
var id = $(this).data("id");
$.get("/api.php",{id:encodeURIComponent(id)}).done(function(data){
$('<div>'+data+'</div>').appendTo('.parent');
});
api.php:
echo json_encode('&...
- 13
1
vote
0
answers
168
views
Protecting an api-token with cookie authentication only
I have a webpage that will provide an JSON object of an api-token if a valid session cookie of a logged in user is provided. If an attacker gets this api-token then they now have full control over ...
- 131
2
votes
3
answers
929
views
How do I prevent XSS in direct access to AJAX/JSON APIs?
In my rich client, I escape user-provided data before rendering to prevent XSS.
The data comes from the server unescaped. That is necessary for application logic, e.g., avoiding situations where I ...
- 239
2
votes
1
answer
2k
views
Django, ajax and HttpOnly cookies
While reading "Tangled web" I came across description of http only cookies and I wanted to try it out in my project, so I've added these settings according according to docs:
CSRF_COOKIE_HTTPONLY = ...
- 123
0
votes
1
answer
1k
views
Intercepting with Burp does not work - alternative ways
When doing bug bounty, there are some sites, which prohibit for good reasons to intercept the requests and responses (with SSL) to the site with Burp and other proxies. So I have the problem to get ...
- 201
0
votes
4
answers
531
views
Protecting from console attacks
I am creating a web-app using PHP and jQuery Ajax for my client-side. When I was testing some security stuff, I thought of inserting a malicious user account with admin access in the database by ...
- 3
0
votes
1
answer
2k
views
How can I prevent requests from the browser console while still using ajax? [duplicate]
I have a publicly available API endpoint. I have to prevent a simple $.ajax script from downloading all of the exposed data within seconds and at least force a page refresh everytime a new request ...
- 1
1
vote
1
answer
1k
views
Is it secure to reuse CSRF token from existing cookie (for a new tab in browser)?
We have a system that does async request to backend to get CSRF (via AJAX). The response from the server is a new cookie and a header that we remember in javascript and use later.
It all works fine ...
- 2,257
0
votes
1
answer
145
views
HMAC API exposed through public site?
(I also asked this question over on StackOverflow.)
What steps can I take to prevent unauthorised access to a method on an unauthenticated controller?
Background
The diagram below illustrates a ...
- 125
1
vote
2
answers
4k
views
Is CSRF protection useless with AJAX?
I've asked a question regarding an ASP.NET WebAPI implementation of CSRF protection:
https://stackoverflow.com/questions/45389512/the-anti-forgery-cookie-token-and-form-field-token-do-not-match-when-...
- 83
1
vote
2
answers
4k
views
Requesting CSRF token via AJAX for JavaScript webapp [duplicate]
I have a JavaScript web application that communicates with an API on a different subdomain. The HTML and Javascript are all hosted in S3.
A conventional CSRF token is put into the body of the HTML ...
- 113
17
votes
4
answers
20k
views
How does CSRF correlate with Same Origin Policy
I'm trying to understand what roles do CSRF and same origin play in the grand scheme of things. With CSRF, I'm able to pretty much do anything on other websites on clients by making requests.Same ...
- 179
2
votes
1
answer
815
views
What does Same-origin policy apply to?
Until now I though same-origin policy applied to AJAX requests using either fetch or xmlHttpRequest, but I just learned that media objects also use this policy.
Are there other things that use the ...
- 231
1
vote
1
answer
7k
views
No Preflight Request is made during XHR cross-origin request
I made a XHR cross-origin request from a html file, hosted on a python Simple HTTP Server.
var xhr = new XMLHttpRequest();
xhr.open("GET", "https://www.facebook.com/favicon.ico", true);
xhr....
- 79
4
votes
1
answer
17k
views
Reflected XSS via JSON executed with Burp, but how to do it in realistic conditions?
I am testing a scenario with Burp proxy.
I am located on a website https://website.com/web
There's an option there to delete an item, when you click it , a certain POST request is sent (...
- 175
2
votes
1
answer
906
views
XSS from JSON outputs
In the book "XSS Attacks - Exploits and Defense" Jeremiah Grossman writes:
The exploit found in Google’s reader was due to the developers thinking that JSON was only going to be viewed by the ...
3
votes
2
answers
1k
views
Does appending data from a form to a URL with encodeURIComponent safely sanitize user input?
In my web app, I want to send a cross-domain AJAX request to another site. I want to take the text that the user enters in a form and append that text to the query string in the URL I send the request ...
- 202
1
vote
1
answer
143
views
How to securely send cookies from one site to another via userscript?
I am part way through creating a 3rd party service for an online game. Currently to pull the game data from outside the game I use my own auth cookies, however, I want to make this available for other ...
- 1,219
0
votes
1
answer
443
views
PCI Compliance : Capture Credit Card, make ajax call to save address, then post of Payment Provider
Say on the guest checkout page of an e-commerce website, if the user enters the delivery address, payment details (Credit card details) and clicks Submit button - and if
an ajax request is made to ...
- 103
3
votes
2
answers
3k
views
document.cookie and its scope
There is some basic confusion that I have.
A non-suspecting victim visits a vulnerable website, vulnerable.com and logs in there. vulnerable.com, post login, sends back a response that has the ...
- 1,512