Questions tagged [html]

HTML (HyperText Markup Language) is a language used to create web pages using tags inline with the content to indicate to browsers how to display that content, using the tags to interpret formatting, images, scripts and other content.

Filter by
Sorted by
Tagged with
3
votes
0answers
56 views

Does Windows Server ship with any sensitive images in the filesystem?

I'm working with an interesting vulnerability I found which enables local file inclusion (LFI) on a target server. In summary, there is a PDF generation API endpoint which accepts an HTML string as ...
0
votes
1answer
126 views

Could there be malware in a video on twitter? [duplicate]

I don't know anything about security. I want to download the videos I like from twitter. And I'm not going to do it by writing a program. I will manually find the necessary link in the html document ...
4
votes
1answer
38 views

Mitigation for Insecure Deserialization

I'm trying to look for some way for mitigation of insecure deserialization vulnerability for the application front-end Then I found this link https://blog.jscrambler.com/exploring-the-owasp-top-10-by-...
1
vote
0answers
37 views

Security implications of an HTTP POST endpoint that accepts arbitrary HTML and returns it back

For generating PDFs in our web application we have a simple service that accepts a chunk of HTML from the client, wraps it in a standard template, does a couple of simple transforms (like replacing ...
0
votes
0answers
44 views

Security issues in xhr DOM update

I'm writing a javascript code that update DOM with html/javascript from XMLlHttpRequest response (A sort of JQuery's $.load() function), depending on some client side condition (e.g. which browser ...
0
votes
1answer
204 views

Is there malicous HTML?

I'm writing a chrome extension that evaluates certain code blocks from GitHub pages, e.g., Lorem ipsum ```html-embed <iframe></iframe> ``` dolor site amet. and adds their content as HTML ...
1
vote
1answer
76 views

Bypass input validation

I'm trying to create a vulnerable sandbox environment for pentesting challenges. As part of the challenge, I want to include some elements of XSS or SQLi if possible. However, I do not wish to make ...
0
votes
1answer
71 views

XSS Payloads: <script> vs javascript:

Hello I was experimenting with XSS payloads and couldn't help wonder the syntax for javascript:alert(0) The most basic payload for XSS makes sense, since the tag is used for JavaScript in HTML. <...
0
votes
1answer
57 views

Can display a GIF in <img> tag causing Client-side DOS

SVG image can be used in DOS user browser with billion laugh attack. Can we do the same with other image types? especially GIF? Thanks everyone.
2
votes
1answer
94 views

Is an XSS attack possible under these constraints?

The output is: <img src="http://example.com/[input]" oncontextmenu="openUrl('http://example.com/[input]')"> Where [input] is the user input, which is sanitised through this ...
0
votes
1answer
43 views

Principally, is input type=“text” instead input type=“url” a security problem for “website” form fields?

I have a simple HTML-PHP-CSS contact form (no JavaScript) with some trivial fields sent via PHP's mail() function. One of the fields is "website" field in which a user should input a website ...
1
vote
1answer
153 views

for reCaptcha, the token needs to be sent to backend for validation right?

So far, I have reCAPTCHA setup in the "submit" button for my login form with v2 Invisible recAPTCHA. But, I have a feeling that the token that I retrieve from Google needs to be sent to my ...
2
votes
2answers
88 views

Protecting bare text / link email address published in a website

I have an all-core MediaWiki website; no addons, no forms besides a login form (not even a contact us form); the MediaWiki installation is continuously upgraded and everything is quite minimal and ...
0
votes
0answers
28 views

Whats wrong with this XSS vector? [duplicate]

Payload: <DIV STYLE="background-image: url(javascript:alert('XSS'))"> Reference: http://seguretat.wiki.uoc.edu/index.php/XSS_Cheat_Sheet Can someone please explain why this payload is ...
2
votes
1answer
375 views

using rel=“noreferer” without rel=“noopener” or without target=“_blank”

I have been reading about the security and performance implications of rel="noopener" and rel="noreferrer" in links with target="_blank". These are some of the ...
0
votes
0answers
19 views

How can I bypass double quote transformation in &quot; and < transformation in &lt; and > &gt; in XSS bug bounty attack [duplicate]

I started bug bounting and I am trying to do an XSS attack and my " and < > are converted in &quot; &lt; &gt; How can I bypass this?
0
votes
2answers
164 views

Can converting a virus-infected webpage to PDF format still contain viruses [closed]

So I know that PDF files can contain viruses themselves if they are target specifically for that purpose. However, my question for here is this: If a webpage that has some malicious scripts or a virus ...
0
votes
2answers
81 views

DataURL Browser Cache Security Implications

What are the security implications that come with loading an image in dataURL format <img src="dataURL" />? After signing into my website the browser loads an image in dataURL format ...
0
votes
0answers
55 views

Understanding the Webview (html) code coming from the server

I am using an Android app downloaded from playstore and wanted to know whether the app uses Webview. So, I tried intercepting the network calls with the help of Charles (proxy) and I found out that ...
0
votes
1answer
124 views

Are there security issues around controlled cross site sharing behind SSO?

Very simply we have a ton of websites at our company behind SSO. I am having a hard time figuring out what security issues there are if we open cross-site sharing between these sites but wanted to get ...
0
votes
0answers
66 views

Are user customizable HTML e-mails secure?

Let me prefix this by saying I am aware of how HTML e-mails can implement trackers and other malicious content, however this question is quite specific. Consider a service where a company can register ...
1
vote
0answers
966 views

How can wkhtmltopdf be used without introducing a security vulnerability?

Background Per the project website, wkhtmltopdf is a "command line tool to render HTML into PDF using the Qt WebKit rendering engine. It runs entirely "headless" and does not require a ...
0
votes
1answer
59 views

Tor Browser: Could a website or ISP detect modification to DOM done by users if Javascript is disabled?

I have Tor Browser (which is basically Firefox ESR) on "Safest" setting (Javascript disabled). We're generally scolded about using extensions in it, as they can alter web traffic patterns to ...
0
votes
0answers
139 views

Is it safe to embed a google form on a website without an SSL Certificate?

I designed a Google Form for a website which does not have an SSL Certificate. I have planned to embed it onto a page using an iframe tag. I am currently testing it and have published a test page with ...
2
votes
1answer
46 views

CSRF: GET request with POST data?

I have stumbled upon a vulnerability in a web application and was wondering if it was exploitable / worth reporting. The bug is a CSRF which would allow an attacker to send friend requests to himself ...
1
vote
2answers
470 views

Attacking through a malicious HTML file apart from XSS through Javascript?

I recently came across a behavior in a web application where the application (through the use of the header Content-Disposition: attachment) offers to download an HTML file instead of allowing it to ...
1
vote
1answer
88 views

Is rel=“noopener” any different from rel=&quot;noopener&quot;?

I have a Wordpress tooltip plugin that converts any links in the tooltip text using special entities, so that my rel="noopener" becomes rel=&quot;noopener&quot;. Is there any ...
1
vote
1answer
128 views

IFrame Vulnerability Classification

I was participating in a bug bounty on a website we will call example.com, when I ran into a very strange edge case which I am not sure I should report. The website uses ads and tracking similar to ...
0
votes
1answer
66 views

Does FB share button contain trackers?

I am considering putting a Facebook share button (shown below) on my website to encourage people to share content to their FB page. However, I do not want cross site trackers "bloating" my website or ...
0
votes
1answer
624 views

WYSIWYG Rich text editor and renderer with no XSS risks

In our web app, we need to allow users to input rich text which is then presented to other users. We are looking for a simple WYSIWYG (JavaScript) editor that outputs a format which is backwards ...
0
votes
1answer
441 views

“/> <script>alert('xss')</script> <br class=” doesn't reflect in input tag [closed]

I've my this webapp running on localhost. I've been trying to reflect XSS through this input tag but it's not working for some reason. could someone please tell how to have it reflected? the payload ...
3
votes
2answers
428 views

Effect of Script tag inside HTML comment

I recently participated in a CTF and solution of that CTF is based on this weird behavior of browser. In First case when I am including script tag inside an HTML comment and without closing that ...
1
vote
1answer
191 views

How to conduct XSS via message body or HTTP cookie?

I am reading Hackers Handbook and in one chapter it says: "Parameters submitted within the URL query string, message body, and HTTP cookies, are the most obvious entry points..." I understand that ...
0
votes
1answer
577 views

How to bypass origin based csrf protection?

I'm trying to do some csrf attack test on a site. I found that the site protect itself from csrf by checking the http Origin header. But I guess maybe under some conditions I can bypass the ...
0
votes
1answer
203 views

Triggering an XSS through a shortened URL?

I have this piece of HTML: <img src="image src" alt="{injectable}" title="{injectable}" border="0"> where {injectable} values correspond to the same input value that has to be 32 characters ...
2
votes
1answer
295 views

How to safely display html emails?

I'm building a webmail application using php at the moment. I'm getting the email content from gmail using Imap and wanted to display the email as close as I can to how gmail shows it. Is it safe to ...
0
votes
0answers
110 views

How to run dirb or gobuster against dynamic html applications with same response data to every request?

I have an application under test. The application response with a simple HTML with a response code 200 to every requests. The HTML contains link tags and script tags which contains necessary js files ...
3
votes
1answer
260 views

What security concerns are there for a fully client-side JS/HTML5 app?

I'm working on an Interactive Fiction story in Undum, which is a fully client-side JS/HTML5 framework. I've been reading about Content Security Policy lately (after looking up what a crypto nonce is) ...
-2
votes
1answer
131 views

Prevent unauthorized download of files from a webserver [closed]

So i have a webserver and i would like to have users login and then be able to download an exe file directly from the webserver the issues with this is that users can easily download the file directly ...
0
votes
2answers
2k views

Is it risky to download but not use a zip file?

Is there any possibility of malware infection in Windows 10 for the following three situations: When you download a zipped file, but do not use it (you do not open it)? When you only open a zipped ...
4
votes
2answers
521 views

Why are cookies sent with HTML page's cross domain requests but not with JS's XHR?

When we write a HTML page with form tag and an action attribute and a submit button. As soon as we click on submit a request is sent (with cookies) to the URL which was the value of action attribute. ...
1
vote
0answers
144 views

Clickjacking and XSS on file upload input?

I reported a self-xss on file uploader input to a bug bounty company and they said that they will only accept it if i can find a good clickjacking exploit for that input. My question is: Is it ...
3
votes
2answers
1k views

How can I inject real php code into this website?

So I found a file uploader on example.com. The file uploader accepts every file extension and the file is uploaded inside the directory /temp/random-numeric-id.php I tried to upload a php file and ...
2
votes
1answer
370 views

XSS in HTML Context without < and >

I have a webpage that blindly removes < and > as hardcoded rule. I know XSS doesn't always need < and > since it is not needed in HTML attribute and javascript contexts. But is it ...
1
vote
1answer
80 views

Does the HTML password field include any protection against XHR/AJAX exfiltration?

In HTML when we describe a certain field as a password field is it somehow secured against sending out the data via XHR/AJAX/similar technologies? This is relevant in case we have to deal with script ...
40
votes
7answers
8k views

Security risks of user generated HTML?

I am creating a website that allows people to upload HTML content. Currently these are the tags that are banned: <script></script> <iframe> <object> <embed> <style&...
0
votes
0answers
311 views

Can a corrupted image/video become a XSS vector?

Let's suppose that I allow users to upload an image or a video. Obviously, I rename it on the server side. Can an attacker use it to conduct an XSS attack? I show images in this way: <img src="...
23
votes
12answers
14k views

Is there a way to hide HTML source code yet keeping it effective?

I have a website with a client-side HTML contact form created manually (not as output of an HTML constructor like PHP): <form action="mailto:someone@example.com"> Email Adress:<br> ...
3
votes
0answers
140 views

Is this XSS filter for HTML comments safe?

HTML comments can be notoriously tricky from an XSS standpoint, and the standard recommendation seems to be to never put untrusted user data in them. But shouldn't it be possible to strip out a few ...
1
vote
1answer
180 views

Ingesting markup from WYSIWYG text editors

Maybe I'm missing something obvious here... The development landscape is littered with client-side WYSIWYG text editors (for example, TinyMCE), all of which seem to want to send raw HTML back to my ...

1
2 3 4 5
7