Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

The tag has no usage guidance.

0
votes
1answer
66 views

Why this XSS payload doesn't work?

TOday I needed to demo DOM Based XSS, and I came across this page which is made for the same exact purpose. I wonder why <img+src+onerror=alert(1)> works but <script>alert(1)</script>...
0
votes
0answers
53 views

Shouldn't I follow the OWASP DOM based XSS recommendations no matter where the payload is injected?

I heard/read at various contexts that DOM based XSS is caused by untrusted client side input and developers need to follow instructions at the OWASP "DOM based XSS Prevention Cheat Sheet" in order to ...
1
vote
1answer
122 views

How do browsers handle document.write in this DOM based XSS case?

OWASP mentions the following example of code vulnerable to a DOM based XSS attack: Select your language: <select><script> document.write("<OPTION value=1>"+document....
2
votes
1answer
89 views

Possible Vulnerability in the following Php/JS code

I was practicing on one of the open source penetration testing frameworks bWAPP. I came across this code, $url = "http://" . $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]; echo $url; I was able ...
6
votes
1answer
418 views

DOM based XSS inside src attribute

I have the following JavaScript code: var url= document.location.href; document.write("<img src='?bla="+document.location.href+"'>"); I am able to inject code when I append e.g. ?b=a'onX=alert(...
7
votes
1answer
1k views

In what situations can element.setAttribute allow XSS?

Burp has identified a potential DOM XSS vulnerability: The application may be vulnerable to DOM-based cross-site scripting. Data is read from window.location.href and passed to the 'setAttribute()' ...
1
vote
2answers
1k views

Is the payload for DOM based XSS defined to originate from only inside the browser or even outside of it

I have read in multiple places contradictory views on what might be considered a DOM based XSS. It seems that the original definition says that it is a form of XSS where the payload originates ...
1
vote
1answer
376 views

Is echoing GET parameters into a script tag reflected or DOM based XSS?

I am struggling to understand whether the following would be considered as a DOM-based XSS or reflected XSS and was hoping that someone could help me distinguish the the difference. Imagine the ...
0
votes
1answer
883 views

Security risks with setDomStorageEnabled(true) in Android?

What are the security risks associated with enabling setDomStorageEnabled(true) method? Reference.
4
votes
2answers
760 views

Is this codes usage of document.location.toString() a DOM based XSS vulnerability?

I have come across the following JS code in multiple web applications. I think the reason for the popularity of this code snippet is this accepted answer on SO. Developers seem to be using this code a ...
2
votes
0answers
449 views

Is it safe to use DOMParser to parse client side XML files

Some javascript frameworks or libraries use the DOMParser API to parse XML files from the client. Is it safe to do this. Malicious code can easily be embedded into the XML file (in either the ...
2
votes
1answer
168 views

Is this code vulnerable to DOM based attacks?

We are developing code for a Banking web application. We want to make sure that the code is secure and since we are using a lot of javascript code, we are kind of worried if any chance of a web based ...
1
vote
3answers
3k views

Is this code JavaScript vulnerable to DOM based XSS?

I have some JS code below that is redirecting to a location taken from a HTML form. Is this vulnerable to an attack like DOM based XSS? document.theform.reference.onchange = function(){ var id = ...
3
votes
1answer
2k views

Dom based Xss Query - location.hash

I was just looking at Dom based xss and wondering if hash value is written to a variable in javascript context can lead to Cross site scripting. The code looks something like this: <script> var ...
1
vote
1answer
308 views

Is this reflected or DOM-based XSS?

Scenario: Server-side script takes URL parameter parameter1 and writes it without encoding into cookie cookie1. Then regular HTML page containing client-side script is returned. Client-side script, ...
7
votes
1answer
664 views

Safe to render data directly to DOM from localStorage? XSS attack possible?

I read that localstorage is susceptible to XSS attacks. I currently store JSON Web Token (JWT) in localstorage, and I access and display data about the user through localstorage: var localstore = //...
5
votes
2answers
287 views

Limiting latter dom-based XSS when setting document.title

Given some JavaScript which modifies the page's title by taking in variable data document.title = someVariable I am looking to address dom based XSS while keeping the title fairly readable. ...
1
vote
2answers
231 views

XSS outside of the DOM

I have the following JS (using jQuery for brevity's sake but it isn't necessary for the question): $("<i></i>").html(userInput); Is it possible for someone to input some string, ...
0
votes
1answer
1k views

What is DOM based XSS? And How to prevent it? [duplicate]

I know very well about the classic XSS vulnerabilities such as reflected & stored XSS. I have read a lot about DOM and DOM based XSS vulnerabilities. I came to an inference that there is nothing ...
1
vote
2answers
1k views

Why doesn't this XSS attack work?

I have a site that has the following javascript that is being executed: var t=location.hash.slice(1); $("div[id="+t+"]").text("The DOM is now loaded and can be manipulated."); I was thinking that if ...
9
votes
2answers
3k views

How can document.referrer be used for XSS?

A very simple example... <div id="cat"></div> <script> document.getElementById("cat").innerHTML = document.referrer; </script> or <script src="' + document.referrer + '"&...
1
vote
1answer
2k views

Can location.pathname lead to XSS?

<div id="cat"></div> <script> $("#cat").html(location.pathname); </script> I think that example would work, but anyway, if location.pathname has to be a valid page, can this ...
4
votes
2answers
1k views

Exploiting XSS with window.name without iFrame

I know XSS is possible if the window.name is echoed onto the page, but from my understanding, this requires you to use an iFrame, but what if the page has clickjacking protection, stopping the page ...
1
vote
1answer
5k views

exploit document.write with unsanitized user input

I'm trying to inject javascript into a js scriptfile but it's not working. I have the following setup: html file with javascript-file include (all inline js is blocked!) Welcome, <script src="js/...
9
votes
2answers
2k views

How is DOM XSS possible here?

I was looking at this website and trying to understand how this XSS is possible, but I just can't figure it out. Here's the URL: http://www.domxss.com/domxss/01_Basics/05_jquery_html.html?681973661 &...
0
votes
1answer
2k views

How can attacker bypass this dom xss filter? [closed]

I'm trying to solve an dom xss challenge where filter used is : var anchor = window.location.hash.substring(1); if (window.location.href.match(/(script|javascript|src|onerror|%|<|>)/g)) { ...