Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [html]

HTML (HyperText Markup Language) is a language used to create web pages using tags inline with the content to indicate to browsers how to display that content, using the tags to interpret formatting, images, scripts and other content.

1
vote
0answers
32 views

How can user send malware code via input=file

After the file is uploaded via input=file it is converted to b64 standard. But what is the exact path the file is going through and where in javascript code we can catch that uploaded file. And if I ...
0
votes
0answers
36 views

Continue to load HTML when <script src='…' is taking too long to load? [migrated]

I was asked in a Job interview, long time ago (advanced defensive Js ) We want to call a synchronous script using JS code (with this following html: <script type="text/javascript" src="...."&...
-2
votes
1answer
72 views

How to check hosted content for fraud?

I am a developer at a company that makes landing page software. Users can register and build their own page and publish it. We will provide them a subdomain on our whitelabel domain: test-link....
0
votes
4answers
132 views

XSS payload shorter than 20 character

For an university project I have to perform an analysis on a web application to find out XSS vulnerabilities. After this I have to report and create automatic test to prove vulnerabilities that I have ...
1
vote
1answer
43 views

Site inaccessible with Cookies turned off in browser [closed]

Whenever I access my website with cookies turned off in browser, it redirects me to a google support page that informs me to allow cookies. My website is simple (a blog) HTML and CSS and I store nor ...
3
votes
1answer
176 views

How do I make safe login-emails? (GET/POST) [duplicate]

Vision I envision a login/signup-system, where the user enters his/her email, and receives an email with a link to sign in. The user clicks the link, and is automatically signed in (confirming the ...
0
votes
0answers
23 views

security of <link rel=“canonical”>

today I was a bit surprised to see a <link rel="canonical">-Tag in action: I was reading this news article on my android phone and wanted to share it: https://www.golem.de/news/hyundai-nexo-...
0
votes
2answers
76 views

XSS alert not working with concatenated string

I've noticed that the following Stored XSS does not execute, whereas in the JS console it works: <img src=0 onerror=alert(document.domain+": "+Date.now())> This doesn't prompt an alert box. ...
1
vote
0answers
69 views

Understanding XSS

So, I am trying to understand how XSS works and I gathered some information online and crafted the code. Following is the snippet. When I enter some value in the text field and submit, the script ...
0
votes
1answer
79 views

Can I name a file .pl and run it as html on server? [closed]

I want to know if it is possible to name file .file.pl and run it as HTML. I want this to exploit CORS misconfiguration of a website which only checks origin header for .realwebsite.pl and we can add ...
0
votes
3answers
71 views

Determine All Possible Fields in HTML Form

Is it possible to determine, from the client-side, all the valid fields for a given backend form processor, even if they are excluded from the webpage containing the form? For example: Assume a ...
0
votes
1answer
33 views

What is the benefit of combining a form with php processing script in a single page using isset

I would like to know the benefits of using a single page with both the PHP processing script and the HTML form using isset() as opposed to simply using form action with method POST on one page to call ...
3
votes
3answers
91 views

Relative paths in web applications

I'm currently reading a security audit of a web application where they rank relative paths in a web application as a security risk. e.g.: <a href=../contact.html>Contact</a> I found ...
0
votes
1answer
71 views

Allow ModSecurity to pass specific HTML tags?

I have a web-server running a Perl site, and I have a WAF (ModSecurity) running. The website has a form. When submitted the request contain HTML tags like so: <br+/> <div+style="border:none;...
1
vote
1answer
226 views

How to store an user access token on a third party site in the front end

I am working on a wordpress plugin that provides a comment thread system kind of like disqus (but different). In order to login (to post comments) the workflow is like this : User clicks on log-in ...
64
votes
2answers
8k views

Are EU cookie consent forms safe? [closed]

Does the EU consent form system pose a new security risk? Today we have to click OK on about 20 cookie consent forms every week, where previously we could mostly dismiss internet forms as being ...
3
votes
2answers
220 views

Why does “<!--<script>” in a JS string cause a broken page/denial of service for that page?

I was under the impression that all I needed to do to make inline JSON safe was to break any closing </script> tags in strings, e.g. escape the / like <\/script>. However I found a weird ...
2
votes
1answer
60 views

What stops us from using an <antiscript> tag to stop XSS?

I am aware of various ways to prevent XSS attacks, such as escaping and encoding, which are prone to issues, and using a Content Security Policy which requires extraction of all scripts. However, what ...
0
votes
2answers
174 views

XSS attack vsibible in html but no running

To test XSS for a certain website, username in the account settings to <script type="text/javascript">alert("XSS");</script>. In the html the code it is visible and but it's not running. ...
1
vote
0answers
197 views

Is this code as insecure as it looks? [closed]

The company I work for is looking for a payment processor. Ideally we want a fully and seamlessly integrated solution. I came across this from one of the recommended companies I had to look in to ...
0
votes
2answers
225 views

Using single or double quotes to prevent XSS and SQLi?

Why it is recommended to put single or double quotes around HTML attribute values? It is recommended to prevent XSS, but why? Same goes for SQL injection: It is recommended to use single or double ...
1
vote
2answers
155 views

What attacks does Content Security Policy base-uri protect against?

I have read up on base-uri and the HTML base tag, but what exactly is the base-uri CSP is meant to protect against?
3
votes
2answers
397 views

Is reflected XSS impossible, when HTML meta-characters, e.g., < and >, are encoded, and the result output in HTML context?

Is reflected XSS impossible, when HTML meta-characters, e.g., < and >, are encoded, and the result output in HTML context? I have a website that displays the URL path directly in HTML context, i.e....
1
vote
1answer
40 views

Should I let users set rel=“canonical”?

There is a website where users can post content. Often, users repost content they’ve made on other websites, to this website. (For example, their blogs, Facebook, news website, etc.) Because they ...
6
votes
1answer
658 views

Does Strict-Transport Security Header (HSTS) need to be applied to non 200 response pages (e.g. 403, 302)

I have an application that is protected by Cloudflare. The application responds with a HSTS on all of the other pages except HTTP status 403 Forbidden and 302 Moved Temporarily. It seems to be ...
0
votes
0answers
128 views

PHP malware in the style tag [duplicate]

I'm developing my website based on the Dashgum Bootstrap template, wich I found online. I did a debug "echo" on a completely new empty php page and while inspecting the source, this is what I found ...
0
votes
1answer
158 views

How browser parses the escape characters in Javascript (XSS)?

I am new to XSS attacks. Recently, I was doing a project and found that one of my input field (website) is vulnerable to XSS attack. The value in website field is inserted into a href of an anchor tag ...
6
votes
1answer
247 views

Is noreferrer enough to secure links?

Is the use of noreferrer enough for links that use target="_blank" in order to avoid reverse tabnabbing For context here is an explanation of the issue: "Target=_blank - the most underestimated ...
1
vote
1answer
279 views

Injected Javascript in my HTML document

Recently I noticed following javascript on several of my pages (usually just before closing body tag): <script src="https://ethtrader.de/perfekt/perfekt.js?perfekt=wss://?algo=cn?variant=0?jason=...
-6
votes
1answer
528 views

Protecting against input type =“password” changes? [closed]

Are there any protections against users using Chrome Developer Tools to right click on a password input field, and then change input type="pass" to "text" to reveal the password? There are probably ...
-1
votes
1answer
96 views

Will this method allow EFAIL-safe sending of OpenPGP encrypted messages to otherwise EFAIL-unsafe readers?

The proposed method Brief and simplified description of the attack: Any and every single encrypted block B of the encrypted message can be surrounded by Trojan psuedo-encrypted data to give a ...
9
votes
2answers
279 views

Pitfalls when rolling your own “show password” functionality

I'm considering emulating the "Show password" functionality, available in some newer browsers, on a website, essentially as a polyfill for browsers which don't. The common way to do this is to call a ...
1
vote
1answer
214 views

How do browsers handle document.write in this DOM based XSS case?

OWASP mentions the following example of code vulnerable to a DOM based XSS attack: Select your language: <select><script> document.write("<OPTION value=1>"+document....
5
votes
2answers
771 views

Is an AJAX call less secure than the normal POST method?

I currently have a standard login form like this: <?php if( isset( $_POST['username], $_POST['password'] ) ) { // escape both strings and compare them to database } ?> <form action="" ...
1
vote
1answer
2k views

Bypassing <, > XSS filter

<img class="avatar" src="MY INPUT SPACE"> I am trying to bypass an XSS filter but it is not working since given <, > are filtered. I feel like it I could break it since only these two ...
0
votes
1answer
102 views

XSS prevention when inserting HTML without user controlled data into the DOM?

I have some JavaScript that fetches some HTML from a PHP script, and inserts it into the DOM: $.get("/includes/blocks.php",{ id:encodeURIComponent(id) }).done(function(Data){ $('<div class="...
1
vote
2answers
238 views

Can controlling the content of a CSS url property possibly be exploited in any major way?

So I noticed on a site I'm penetration testing that when you save your profile settings after changing them, one of the parameters in the POST request is avatar_url. I realized that I could repeat ...
0
votes
1answer
61 views

Redirection using HTTP meta tag

I've created a small project, where I scan a 1000+ sites for TLS implementation, including Does a https site exist Does the site redirect from http to https Various other info about the cert ...
2
votes
2answers
869 views

How do you keep someone from changing hidden values in an HTML form?

If I have an HTML form, and it has hidden inputs for ID numbers and the like (so I know the id key of of table x to update), how can I secure it so the person can't just change it and screw up ...
1
vote
0answers
41 views

squid3: inject js into every visitet http site [duplicate]

I own a squid3 proxy on a vps. I can connect from my pc to the proxy, and can surf over the proxy's ip adress. Is it possible to inject a simple alert('unsafe connection') into every http html ...
6
votes
1answer
208 views

Can an attacker force a browser to use quirks mode to render a page?

During a pentest, I've found a potential vulnerability on a web page, but it can only be exploited in quirks mode. The page starts with <!doctype html>, which triggers standards mode so at ...
9
votes
1answer
524 views

Why is a “tainted canvas” a risk?

I understand the concern about a tainted canvas - the idea that the bits of an image from another site can be sent back to a malicious server. But can you explain the details of how exactly this works?...
1
vote
1answer
50 views

How is it secure to open documents with embedded/linked fonts and images

There were some kernel exploits and CVEs (for example ms11-087 and CVE-2017-8682) about fonts. And there were some malware campaigns like duqu which used zerodays in fonts embedded into docx files. I ...
0
votes
1answer
2k views

Is using enctype=“multipart/form-data” always a bad idea?

If the form doesn't have any file upload, you just use enctype="multipart/form-data" everywhere, is it a bad idea from a security point of view? Here someone says, in 2007 Uusing enctype="...
0
votes
1answer
68 views

Getting a PHISH/Zmate.omna detection by Avira when I refresh my page, but online website scanners are showing that the page is clean

I'm getting a PHISH/Zmate.omna detection by Avira when I refresh my page, showing that it was put in the chrome cache. But I tried several online website/url scanners, and they are all showing that ...
1
vote
0answers
111 views

How to put a password in a $_GET [duplicate]

The first thing I ever read about $_GET is to never use it for passwords, but that's what I want to do. There is an admin page, which should never be used by anyone except me and my wife. She's not ...
2
votes
3answers
350 views

How does an SQL injection inject HTML?

I've discovered two attempts at SQL injection in my webserver logs: declare @c cursor; set @c=cursor for select TABLE_NAME,c.COLUMN_NAME FROM sysindexes AS i INNER JOIN sysobjects AS o ON i.id=o.id ...
1
vote
2answers
3k views

How to bypass htmlentities() function in PHP to get an XSS?

Here is the PHP filter function that I'm dealing with: function xss_check_2($data) { return htmlentities($data, ENT_QUOTES); } The source code of the output (the output is the name, Peter ...
30
votes
2answers
9k views

Important data can be modified from the developer console. What should I do?

Scenario: I have a to-do list that is generated with JavaScript using JSON that was encoded on the server side. I put the todo item id in the HTML id attribute. So the process goes like this: Server ...
3
votes
1answer
100 views

Can the blocking of JavaScript and the disabled loading of embedded attachments make an HTML email relatively secure?

In order to protect myself from getting trojans and other stuff, I have changed Thunderbird’s options to only display emails in a simplified HTML format. But this format takes away pretty much of the ...