All Questions
16 questions
-1
votes
1
answer
269
views
Run your own code on chrome:// url?
Recently I've been trying to escape sandbox Chrome OS for fun, bounties, etc. I found you can run straight system commands through chrome:// urls (such as displaying USB Detected message, or something)...
0
votes
1
answer
918
views
XSS triggered but chrome didn't show popup. What exactly was going on?
Related to my previous question on XSS in canonical link.
At the beginning I turned off Chrome's XSS auditor and tried executing XSS with just onload event using following payload which did not ...
- 345
2
votes
1
answer
380
views
Why does Chromes XSS filter block injection into HTML element, but not into attribute?
I have this vulnerable code which takes a GET parameter, and puts it inside a HTML element (h1) as well as inside a HTML attribute (data-text):
$data = $_GET["payload"];
echo "<h1>" .$data. "&...
- 23
6
votes
1
answer
7k
views
Is there any possibilities to bypass Chrome xss auditor in this case?
I just expiremented with xss in my own server.
I wrote code like this:
<?php
if (isset($_POST['data'])) {
echo "<a href='".htmlentities($_POST['data'])."'>Click Here</a>&...
- 61
3
votes
2
answers
201
views
Why would a modern browser allow internal resources to be loaded from an external page
Recently someone announced that several Arris surfboard models lacked any form of authentication to perform functions such as reboot and factory reset a modem with a single http call.
Read more on ...
- 133
12
votes
1
answer
32k
views
How to make Firefox ignore the X-XSS-Protection response header?
I have two questions:
How can I make Firefox ignore the X-XSS-Protection header? I have a website which sends an X-XSS-Protection: 1 header and I want my Firefox to ignore that header, because it ...
- 121
1
vote
1
answer
3k
views
Security of cross-origin XMLHttpRequest Javascript
I am building a Chrome extension that will be making cross origin "get" and "post" requests to a few third party websites. I have been researching this process for hours and I am becoming increasingly ...
- 13
10
votes
1
answer
3k
views
How do I securely embed an <img> tag using a user-given URL?
If I hypothetically wanted to allow users to use an avatar from an arbitrary URL like this:
<img class="avatar" src="{user input}" />
There are many problems that I can think of:
There are ...
- 203
8
votes
3
answers
6k
views
Favicon Redirection Possible Security Flaw
I have the domain example.com
When I enter the URL https://api.example.com, Chrome loads the page and also tries to load https://myapp.example.com/favicon.ico, and that request receives a 301 ...
9
votes
2
answers
4k
views
Problem in underscore.js with "new Function()" when CSP header is set
In underscore.js, template rendering causes violation of the 'unsafe-eval' property, with CSP error at following line:
render = new Function(settings.variable || 'obj', '_', source);
The solution to ...
- 93
4
votes
1
answer
23k
views
Cannot turn off XSS filter in Chrome
I am using the following command to launch Chrome:
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --args --disable-web-security
to turn off XSS auditor in chrome in Windows 7, but ...
- 263
22
votes
6
answers
16k
views
Is Chrome completely secure against Reflected XSS?
I notice that Chrome does not execute scrips that are part of the web request,
http://vulnerable_site?pageTitle=<script>alert('xss')</script>
With such links since the script is as part ...
- 305
56
votes
5
answers
24k
views
IMG tag vulnerability
Is it safe to display images from arbitrary domains? I.e. let's say I have an image on my page:
<img src="http://badguy.com/image.gif" />
What if image.gif will return some js attack vector, ...
- 2,877
4
votes
4
answers
2k
views
What XSS attacks doesn't "Reflective XSS Protection" defeat?
Its been quite a while since I have played with cross site scripting vulnerabilities but today I came across a website today that was crying out to be tested for a basic XSS vulnerability.
So ...
- 2,782
4
votes
2
answers
1k
views
Are sandboxes overrated?
I've stumbled upon the following on the blog of the NoScript developer Giorgio Maone.
First, he quotes the following ArsTechnica article about an XSS bug in Adobe Flash:
As useful as sandboxes are in ...
user10356
13
votes
1
answer
21k
views
Does Google Chrome protect against cross site scripting (XSS)?
In Firefox I've been using the NoScript extension to protect myself from certain kinds of malware attacks. NoScript is well known as a very powerful extension for Firefox and introduced protection ...
user10356