Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [html]

HTML (HyperText Markup Language) is a language used to create web pages using tags inline with the content to indicate to browsers how to display that content, using the tags to interpret formatting, images, scripts and other content.

0
votes
1answer
57 views

java script in link href=“javascript:alert(1)”

In an app I am testing they allow to input a domain name, store it, and when they print it on the browser they concatenate "http://" at the beginning of the domain. So, if you input "google.com", then ...
0
votes
1answer
167 views

Is security by obscurity / obfuscation a valid option, or do the crawlers have JavaScript enabled?

I'm creating a new website, so I am thinking about how to protect my email address and phone number against crawlers, I actually mean email harvesters (most of which I suppose don't have JavaScript ...
1
vote
4answers
126 views

can XSS attacks be nullified by prepending a backward slash to all external links?

In my website I noticed my developers had set it up so certain form data was past from the URL to the content of the website. E.G ?email="email" The obvious vulnerability means that I can put ?email=...
-2
votes
1answer
64 views

Inspect Element Prevention?

I was just actually wondering if there is a permanent way of preventing or disabling inspect element on client-side? Assuming with inspect element you could change values in hidden forms as well as ...
0
votes
0answers
37 views

Security Measures for HTML Anchor Download Feature

Do I need to explore security measures for the native HTML <a download> feature? What are some ways that this feature opens my website up to potential threats, and how should I mitigate those ...
0
votes
2answers
88 views

Cross Site Scripting href=/\evil

I've seen <base href=/\evil> and <base href=//0> as a vector to use XSS. Could someone make an example using these vectors and explain me if "/\" is the same as http:// or has some ...
1
vote
1answer
75 views

Is it possible to exploit XSS by replacing image data for img tag [duplicate]

If I have HTML page served over https with image loaded over http (image from other domain): <img src="http://some-image.png"/> so it's possible to inject any data to browser as image by using ...
0
votes
1answer
56 views

Is this CORS exploitable?

So i was able to upload a html file on a server i'm allowed to test. The file is uploaded on a subdomain of the main server. Knowing that they allow CORS for anything.domain.com, is it possible to ...
0
votes
0answers
30 views

is xss possible without these chars? [duplicate]

I'm wondering if xss is possible without these chars disallowed/filtered text: < > ! @ # $ % ^ & * : ? = ( ) I'm able to break out of a style attribute of an element by introducing an ending ...
-1
votes
1answer
126 views

Unknown code on my website comments [closed]

During the last few weeks, I often find on my website these "Comment": {"name":"BryantFlogy","email":"cgorillamail@gmail.com","message":"Hi, htmlkurss.xyz \r\n \r\nI&#39;ve been visiting your ...
1
vote
2answers
249 views

How to exploit XSS vulnerability through an iframe

Recently, I found a stored cross site scripting vulnerability in a rather large website, but I am not sure if it is dangerous or worth reporting. On this website, there is a resource section that is ...
1
vote
1answer
267 views

Bypass a simple XSS filter that only looks at <

Say, I have a page where the input from the user is taken and is passed through a simple client-side XSS filter. That filter only replaces < characters with ''. in = in.replace(/[<]/g, ''); ...
2
votes
0answers
64 views

Persistent HTML form data across sessions

I'm currently testing an application which appears to have a somewhat persistent HTML form data storage, yet I don't understand how. UserA logs in Fills form with custom data Logs out before sending ...
43
votes
8answers
7k views

Is it ever safe to open a suspicious HTML file (e.g. email attachment)?

If I receive an email that has an attachment called something like safe-link.html would it ever be safe to open this file? Clearly, HTML files may have malicious scripts embedded that could run when ...
0
votes
0answers
49 views

Embeddable 3rd party web tools security against stealing the key

We are building a website and we are using plenty of third-party tools that basically give you an HTML script tag and ask you to place it into your index.html. A few examples of such tools are: ...
0
votes
4answers
161 views

Is XSS and HTML injection the same?

When doing a XSS, we usually put the JavaScript code between the <script> tags. I have noticed that HTML injections are very similar because you are doing almost the same thing, but using ...
0
votes
1answer
29 views

How to filter HTML Event in Native PHP7

i want to creating xss filter for my own project, this is for html event filtering preg_replace("/ on\w+='[^']*'/i", '', preg_replace('/ on\w+="[^"]*"/i', '', $framed)); but considering to more ...
1
vote
2answers
187 views

Can a hacker determine what version of WordPress and PHP a site is using?

Can a hacker determine what version of WordPress and PHP a site is using? Assume this info is not available by View Source.
0
votes
1answer
174 views

What would be an example of an attack that exploits escape characters?

As far as I know escape characters are characters which change the meaning of the following character. In HTML for example the & is an escape character that declares the beginning of an entity ...
1
vote
5answers
99 views

How to stop a request for an external image from exposing my IP to the server hosting the image?

Suppose I have a server A, and that there is a website W hosted on A. The HTML of W contains: <img src=https://www.domainD.com/testT.jpg> Then I have a computer C, that accesses W. Will ...
1
vote
1answer
194 views

Does CSP block javascript in <a href> tags?

I recently discovered that its possible to run javascript from an <a> tag like this <a href="javascript:alert('test')"> and this gets run on the current page when clicked. It also seems ...
2
votes
2answers
236 views

Vulnerability in using `input type=“text”` for website password other than shoulder surfing

I found a website that uses the plain text field as a password input form. <input type = "text" autocomplete= off ...> I understand shoulder surfing is one vulnerability but are there other ...
2
votes
1answer
99 views

How can user send malware code via input=file

After the file is uploaded via input=file it is converted to b64 standard. But what is the exact path the file is going through and where in javascript code we can catch that uploaded file. And if I ...
-2
votes
1answer
82 views

How to check hosted content for fraud?

I am a developer at a company that makes landing page software. Users can register and build their own page and publish it. We will provide them a subdomain on our whitelabel domain: test-link....
0
votes
4answers
473 views

XSS payload shorter than 20 character

For an university project I have to perform an analysis on a web application to find out XSS vulnerabilities. After this I have to report and create automatic test to prove vulnerabilities that I have ...
1
vote
1answer
43 views

Site inaccessible with Cookies turned off in browser [closed]

Whenever I access my website with cookies turned off in browser, it redirects me to a google support page that informs me to allow cookies. My website is simple (a blog) HTML and CSS and I store nor ...
3
votes
1answer
218 views

How do I make safe login-emails? (GET/POST) [duplicate]

Vision I envision a login/signup-system, where the user enters his/her email, and receives an email with a link to sign in. The user clicks the link, and is automatically signed in (confirming the ...
0
votes
0answers
28 views

security of <link rel=“canonical”>

today I was a bit surprised to see a <link rel="canonical">-Tag in action: I was reading this news article on my android phone and wanted to share it: https://www.golem.de/news/hyundai-nexo-...
0
votes
2answers
201 views

XSS alert not working with concatenated string

I've noticed that the following Stored XSS does not execute, whereas in the JS console it works: <img src=0 onerror=alert(document.domain+": "+Date.now())> This doesn't prompt an alert box. ...
1
vote
0answers
153 views

Understanding XSS

So, I am trying to understand how XSS works and I gathered some information online and crafted the code. Following is the snippet. When I enter some value in the text field and submit, the script ...
0
votes
1answer
82 views

Can I name a file .pl and run it as html on server? [closed]

I want to know if it is possible to name file .file.pl and run it as HTML. I want this to exploit CORS misconfiguration of a website which only checks origin header for .realwebsite.pl and we can add ...
0
votes
3answers
77 views

Determine All Possible Fields in HTML Form

Is it possible to determine, from the client-side, all the valid fields for a given backend form processor, even if they are excluded from the webpage containing the form? For example: Assume a ...
0
votes
1answer
38 views

What is the benefit of combining a form with php processing script in a single page using isset

I would like to know the benefits of using a single page with both the PHP processing script and the HTML form using isset() as opposed to simply using form action with method POST on one page to call ...
3
votes
3answers
106 views

Relative paths in web applications

I'm currently reading a security audit of a web application where they rank relative paths in a web application as a security risk. e.g.: <a href=../contact.html>Contact</a> I found ...
0
votes
1answer
279 views

Allow ModSecurity to pass specific HTML tags?

I have a web-server running a Perl site, and I have a WAF (ModSecurity) running. The website has a form. When submitted the request contain HTML tags like so: <br+/> <div+style="border:none;...
1
vote
1answer
363 views

How to store an user access token on a third party site in the front end

I am working on a wordpress plugin that provides a comment thread system kind of like disqus (but different). In order to login (to post comments) the workflow is like this : User clicks on log-in ...
64
votes
2answers
8k views

Are EU cookie consent forms safe? [closed]

Does the EU consent form system pose a new security risk? Today we have to click OK on about 20 cookie consent forms every week, where previously we could mostly dismiss internet forms as being ...
3
votes
2answers
292 views

Why does “<!--<script>” in a JS string cause a broken page/denial of service for that page?

I was under the impression that all I needed to do to make inline JSON safe was to break any closing </script> tags in strings, e.g. escape the / like <\/script>. However I found a weird ...
2
votes
1answer
66 views

What stops us from using an <antiscript> tag to stop XSS?

I am aware of various ways to prevent XSS attacks, such as escaping and encoding, which are prone to issues, and using a Content Security Policy which requires extraction of all scripts. However, what ...
0
votes
2answers
472 views

XSS attack vsibible in html but no running

To test XSS for a certain website, username in the account settings to <script type="text/javascript">alert("XSS");</script>. In the html the code it is visible and but it's not running. ...
1
vote
0answers
215 views

Is this code as insecure as it looks? [closed]

The company I work for is looking for a payment processor. Ideally we want a fully and seamlessly integrated solution. I came across this from one of the recommended companies I had to look in to ...
0
votes
2answers
342 views

Using single or double quotes to prevent XSS and SQLi?

Why it is recommended to put single or double quotes around HTML attribute values? It is recommended to prevent XSS, but why? Same goes for SQL injection: It is recommended to use single or double ...
1
vote
2answers
391 views

What attacks does Content Security Policy base-uri protect against?

I have read up on base-uri and the HTML base tag, but what exactly is the base-uri CSP is meant to protect against?
3
votes
2answers
517 views

Is reflected XSS impossible, when HTML meta-characters, e.g., < and >, are encoded, and the result output in HTML context?

Is reflected XSS impossible, when HTML meta-characters, e.g., < and >, are encoded, and the result output in HTML context? I have a website that displays the URL path directly in HTML context, i.e....
1
vote
1answer
40 views

Should I let users set rel=“canonical”?

There is a website where users can post content. Often, users repost content they’ve made on other websites, to this website. (For example, their blogs, Facebook, news website, etc.) Because they ...
6
votes
1answer
998 views

Does Strict-Transport Security Header (HSTS) need to be applied to non 200 response pages (e.g. 403, 302)

I have an application that is protected by Cloudflare. The application responds with a HSTS on all of the other pages except HTTP status 403 Forbidden and 302 Moved Temporarily. It seems to be ...
0
votes
1answer
322 views

How browser parses the escape characters in Javascript (XSS)?

I am new to XSS attacks. Recently, I was doing a project and found that one of my input field (website) is vulnerable to XSS attack. The value in website field is inserted into a href of an anchor tag ...
6
votes
1answer
370 views

Is noreferrer enough to secure links?

Is the use of noreferrer enough for links that use target="_blank" in order to avoid reverse tabnabbing For context here is an explanation of the issue: "Target=_blank - the most underestimated ...
2
votes
1answer
309 views

Injected Javascript in my HTML document

Recently I noticed following javascript on several of my pages (usually just before closing body tag): <script src="https://ethtrader.de/perfekt/perfekt.js?perfekt=wss://?algo=cn?variant=0?jason=...
-6
votes
1answer
1k views

Protecting against input type =“password” changes? [closed]

Are there any protections against users using Chrome Developer Tools to right click on a password input field, and then change input type="pass" to "text" to reveal the password? There are probably ...