Questions tagged [html]

HTML (HyperText Markup Language) is a language used to create web pages using tags inline with the content to indicate to browsers how to display that content, using the tags to interpret formatting, images, scripts and other content.

Filter by
Sorted by
Tagged with
0
votes
0answers
64 views

Using XSS to Steal Cookies WITHOUT access to external server [closed]

I'm working on a project where we need to craft an HTML page that launches a CSRF attack that logs in to an attacker account on a victim computer. The biggest hurdle however is an authorization cookie ...
0
votes
0answers
26 views

How to run dirb or gobuster against dynamic html applications with same response data to every request?

I have an application under test. The application response with a simple HTML with a response code 200 to every requests. The HTML contains link tags and script tags which contains necessary js files ...
3
votes
1answer
90 views

What security concerns are there for a fully client-side JS/HTML5 app?

I'm working on an Interactive Fiction story in Undum, which is a fully client-side JS/HTML5 framework. I've been reading about Content Security Policy lately (after looking up what a crypto nonce is) ...
-2
votes
1answer
79 views

Prevent unauthorized download of files from a webserver [closed]

So i have a webserver and i would like to have users login and then be able to download an exe file directly from the webserver the issues with this is that users can easily download the file directly ...
0
votes
2answers
148 views

Is it risky to download but not use a zip file?

Is there any possibility of malware infection in Windows 10 for the following three situations: When you download a zipped file, but do not use it (you do not open it)? When you only open a zipped ...
2
votes
1answer
63 views

Why are cookies sent with HTML page's cross domain requests but not with JS's XHR?

When we write a HTML page with form tag and an action attribute and a submit button. As soon as we click on submit a request is sent (with cookies) to the URL which was the value of action attribute. ...
0
votes
0answers
18 views

xss filter bypass <>& [duplicate]

i've been trying to bypass an xss filtering system but i failed to exploit it , i've searched alot but couldn't find anything that works so i thought i should ask u guys i've entered all the ...
1
vote
0answers
68 views

Clickjacking and XSS on file upload input?

I reported a self-xss on file uploader input to a bug bounty company and they said that they will only accept it if i can find a good clickjacking exploit for that input. My question is: Is it ...
3
votes
2answers
205 views

How can I inject real php code into this website?

So I found a file uploader on example.com. The file uploader accepts every file extension and the file is uploaded inside the directory /temp/random-numeric-id.php I tried to upload a php file and ...
1
vote
1answer
90 views

XSS in HTML Context without < and >

I have a webpage that blindly removes < and > as hardcoded rule. I know XSS doesn't always need < and > since it is not needed in HTML attribute and javascript contexts. But is it ...
1
vote
1answer
72 views

Does the HTML password field include any protection against XHR/AJAX exfiltration?

In HTML when we describe a certain field as a password field is it somehow secured against sending out the data via XHR/AJAX/similar technologies? This is relevant in case we have to deal with script ...
38
votes
7answers
8k views

Security risks of user generated HTML?

I am creating a website that allows people to upload HTML content. Currently these are the tags that are banned: <script></script> <iframe> <object> <embed> <style&...
0
votes
0answers
59 views

Can a corrupted image/video become a XSS vector?

Let's suppose that I allow users to upload an image or a video. Obviously, I rename it on the server side. Can an attacker use it to conduct an XSS attack? I show images in this way: <img src="...
23
votes
12answers
12k views

Is there a way to hide HTML source code yet keeping it effective?

I have a website with a client-side HTML contact form created manually (not as output of an HTML constructor like PHP): <form action="mailto:someone@example.com"> Email Adress:<br> ...
3
votes
0answers
86 views

Is this XSS filter for HTML comments safe?

HTML comments can be notoriously tricky from an XSS standpoint, and the standard recommendation seems to be to never put untrusted user data in them. But shouldn't it be possible to strip out a few ...
1
vote
1answer
100 views

Ingesting markup from WYSIWYG text editors

Maybe I'm missing something obvious here... The development landscape is littered with client-side WYSIWYG text editors (for example, TinyMCE), all of which seem to want to send raw HTML back to my ...
0
votes
1answer
64 views

Exposing a version number through the assets urls

I just received a blackbox pentesting report where the security company recommended to hide the version number from the page (be it returned to the user as a text or used as a cache-buster in the css/...
2
votes
1answer
97 views

Can a javascript on parent page log keystrokes inside an iframe?

I am trying to analyze the possibility of accessing keystrokes from an iframe using a javascript running on the parent page. The potential attack which I am looking to verify is Cross Frame Scripting. ...
0
votes
1answer
48 views

Does A6 - Security Misconfiguration be reported for embedded JS? [duplicate]

We have a HTML file with a minified JSlibrary pasted inside with the license header and version number. Our client reported that it's a security risk (https://www.owasp.org/index.php/Top_10-2017_A6-...
2
votes
2answers
137 views

Understanding POST based XSS

I have been trying to learn about XSS, more specifically, POST based XSS. But I am unsure if I actually understand how POST based XSS works. With a GET, you can do XSS with the URL parameters, but to ...
0
votes
2answers
77 views

Is there any good reason to move files outside webserver document root?

Let's say I create a website (with apache for example) and my php pages get some sensitive information from a file on disk (a .ini file, a SQLite db or whatever). I thought two ways to prevent users ...
1
vote
1answer
540 views

How can Instagram cause Chrome to attempt to login and show me my username when I'm using incognito mode?

When I reach Instagram user pages while in Incognito mode, Chrome pops up a window with my non-incognito username asking whether or not to sign in. See screenshot below. Although I assume Chrome ...
2
votes
1answer
131 views

Is <meta> http-equiv secure?

I'd like to redirect a visitor to the login page if he's not authenticated and she/he wants to access a protected page. I can handle this via the backend code, but it's easier to make it using HTML. ...
-1
votes
1answer
91 views

Javascript with HTML for CSRF [closed]

<html> <h1>POC CSRF</h1> <form> Enter bWAPP Password:<input type="password" id="password" placeholder="password"> </form> ...
3
votes
1answer
176 views

Safe user input HTML in 2019

(I know this topic has been discussed a lot in the past, and I've read a lot of threads here as well as OWASP, but have additional questions including the specific CSP listed below.) We want to allow ...
1
vote
1answer
427 views

java script in link href=“javascript:alert(1)”

In an app I am testing they allow to input a domain name, store it, and when they print it on the browser they concatenate "http://" at the beginning of the domain. So, if you input "google.com", then ...
0
votes
1answer
257 views

Is security by obscurity / obfuscation a valid option, or do the crawlers have JavaScript enabled?

I'm creating a new website, so I am thinking about how to protect my email address and phone number against crawlers, I actually mean email harvesters (most of which I suppose don't have JavaScript ...
1
vote
4answers
165 views

can XSS attacks be nullified by prepending a backward slash to all external links?

In my website I noticed my developers had set it up so certain form data was past from the URL to the content of the website. E.G ?email="email" The obvious vulnerability means that I can put ?email=...
-2
votes
1answer
293 views

Inspect Element Prevention?

I was just actually wondering if there is a permanent way of preventing or disabling inspect element on client-side? Assuming with inspect element you could change values in hidden forms as well as ...
1
vote
0answers
48 views

Security Measures for HTML Anchor Download Feature

Do I need to explore security measures for the native HTML <a download> feature? What are some ways that this feature opens my website up to potential threats, and how should I mitigate those ...
0
votes
2answers
118 views

Cross Site Scripting href=/\evil

I've seen <base href=/\evil> and <base href=//0> as a vector to use XSS. Could someone make an example using these vectors and explain me if "/\" is the same as http:// or has some ...
1
vote
1answer
135 views

Is it possible to exploit XSS by replacing image data for img tag [duplicate]

If I have HTML page served over https with image loaded over http (image from other domain): <img src="http://some-image.png"/> so it's possible to inject any data to browser as image by using ...
0
votes
1answer
80 views

Is this CORS exploitable?

So i was able to upload a html file on a server i'm allowed to test. The file is uploaded on a subdomain of the main server. Knowing that they allow CORS for anything.domain.com, is it possible to ...
0
votes
0answers
34 views

is xss possible without these chars? [duplicate]

I'm wondering if xss is possible without these chars disallowed/filtered text: < > ! @ # $ % ^ & * : ? = ( ) I'm able to break out of a style attribute of an element by introducing an ending ...
-1
votes
1answer
133 views

Unknown code on my website comments [closed]

During the last few weeks, I often find on my website these "Comment": {"name":"BryantFlogy","email":"cgorillamail@gmail.com","message":"Hi, htmlkurss.xyz \r\n \r\nI&#39;ve been visiting your ...
1
vote
2answers
1k views

How to exploit XSS vulnerability through an iframe

Recently, I found a stored cross site scripting vulnerability in a rather large website, but I am not sure if it is dangerous or worth reporting. On this website, there is a resource section that is ...
1
vote
1answer
344 views

Bypass a simple XSS filter that only looks at <

Say, I have a page where the input from the user is taken and is passed through a simple client-side XSS filter. That filter only replaces < characters with ''. in = in.replace(/[<]/g, ''); ...
2
votes
0answers
76 views

Persistent HTML form data across sessions

I'm currently testing an application which appears to have a somewhat persistent HTML form data storage, yet I don't understand how. UserA logs in Fills form with custom data Logs out before sending ...
43
votes
8answers
9k views

Is it ever safe to open a suspicious HTML file (e.g. email attachment)?

If I receive an email that has an attachment called something like safe-link.html would it ever be safe to open this file? Clearly, HTML files may have malicious scripts embedded that could run when ...
0
votes
0answers
54 views

Embeddable 3rd party web tools security against stealing the key

We are building a website and we are using plenty of third-party tools that basically give you an HTML script tag and ask you to place it into your index.html. A few examples of such tools are: ...
0
votes
4answers
915 views

Is XSS and HTML injection the same?

When doing a XSS, we usually put the JavaScript code between the <script> tags. I have noticed that HTML injections are very similar because you are doing almost the same thing, but using ...
0
votes
1answer
30 views

How to filter HTML Event in Native PHP7

i want to creating xss filter for my own project, this is for html event filtering preg_replace("/ on\w+='[^']*'/i", '', preg_replace('/ on\w+="[^"]*"/i', '', $framed)); but considering to more ...
1
vote
2answers
300 views

Can a hacker determine what version of WordPress and PHP a site is using?

Can a hacker determine what version of WordPress and PHP a site is using? Assume this info is not available by View Source.
0
votes
1answer
534 views

What would be an example of an attack that exploits escape characters?

As far as I know escape characters are characters which change the meaning of the following character. In HTML for example the & is an escape character that declares the beginning of an entity ...
1
vote
5answers
108 views

How to stop a request for an external image from exposing my IP to the server hosting the image?

Suppose I have a server A, and that there is a website W hosted on A. The HTML of W contains: <img src=https://www.domainD.com/testT.jpg> Then I have a computer C, that accesses W. Will ...
1
vote
1answer
946 views

Does CSP block javascript in <a href> tags?

I recently discovered that its possible to run javascript from an <a> tag like this <a href="javascript:alert('test')"> and this gets run on the current page when clicked. It also seems ...
2
votes
2answers
405 views

Vulnerability in using `input type=“text”` for website password other than shoulder surfing

I found a website that uses the plain text field as a password input form. <input type = "text" autocomplete= off ...> I understand shoulder surfing is one vulnerability but are there other ...
3
votes
2answers
199 views

How can user send malware code via input=file

After the file is uploaded via input=file it is converted to b64 standard. But what is the exact path the file is going through and where in javascript code we can catch that uploaded file. And if I ...
-2
votes
1answer
86 views

How to check hosted content for fraud?

I am a developer at a company that makes landing page software. Users can register and build their own page and publish it. We will provide them a subdomain on our whitelabel domain: test-link....
0
votes
4answers
1k views

XSS payload shorter than 20 character

For an university project I have to perform an analysis on a web application to find out XSS vulnerabilities. After this I have to report and create automatic test to prove vulnerabilities that I have ...

1 2 3 4 5 6