Questions tagged [html]
HTML (HyperText Markup Language) is a language used to create web pages using tags inline with the content to indicate to browsers how to display that content, using the tags to interpret formatting, images, scripts and other content.
41
questions
10
votes
1answer
3k views
What are the benefits and drawbacks of the HTML5 Keygen element?
As of January 2013, what are the potential benefits and drawbacks of the HTML5 Keygen element?
asked Jan 13 '13 at 15:08
Christopher Jon Mankowski
49.5k51 gold badges242 silver badges522 bronze badges
106
votes
5answers
57k views
Should websites be allowed to disable autocomplete on forms or fields?
Currently, there is an HTML form/input attribute called autocomplete, which, when set to off, disables autocomplete/autofill for that form or element.
Some banks seem to use this to prevent password ...
2
votes
1answer
11k views
Bypassing <, > XSS filter
<img class="avatar" src="MY INPUT SPACE">
I am trying to bypass an XSS filter but it is not working since given <, > are filtered. I feel like it I could break it since only these two ...
89
votes
8answers
75k views
What could an "<img src=" XSS do?
Most WAFs when blocking XSS will block obvious tags like script and iframe, but they don't block img.
Theoretically, you can img src='OFFSITE URL', but what's the worse that can happen? I know you ...
25
votes
2answers
3k views
Is there a way to make the browser remove the login-password from it's memory immediately, like Chrome seems to do on accounts.google.com?
I did some testing, and found that a memory dump of Chrome doesn't hold the password of gmail.com/Google after logging in to that site (the login happens on accounts.google.com).
(My System is ...
10
votes
2answers
17k views
Why are scripts injected through innerHTML not executed whilst onerror and other on<event> attributes on elements are? - Google XSS Challenge 2
SPOILER ALERT : Do not continue if you do not want to be spoiled
I am currently doing the Google XSS Challenge Level 2 .
I am injecting XSS code that is inserted into the document using element....
1
vote
1answer
584 views
Bypass a simple XSS filter that only looks at <
Say, I have a page where the input from the user is taken and is passed through a simple client-side XSS filter. That filter only replaces < characters with ''.
in = in.replace(/[<]/g, '');
...
0
votes
1answer
2k views
XSS to overcome HTML entities
In a search box (<input value=" *insert search term here* "...>), when I input " onmouseover="alert(1), the double quotes are converted to their entities, so it's not possible to break out of ...
16
votes
5answers
2k views
Why should XSS filters escape forward slash?
In OWASP recommendations regarding escaping untrusted input for HTML element content, they list the following:
& --> &
< --> <
> --> >
" --> "
' --...
5
votes
3answers
494 views
Input validation: how to do it if I must accept HTML as part of my input?
I'm writing a service which receives FHIR data and it stores it. FHIR is an HL7 healthcare information standard format which contains HTML by definition, embedded into a JSON or XML, (to ensure human-...
4
votes
3answers
4k views
Can these html tags and attribs make my site vulnerable?
I am developing a social website and want to allow user ONLY these html tags and attributes in their posts:
tags: <img>, <b>, <strong>, <blockquote>, <a>
attributes: '...
2
votes
3answers
711 views
Is this filter safe enough to mitigate XSS?
I have an application that escapes the following special characters.
& < > " '
The application heavily displays HTTP request parameters throughout the application. The request parameters ...
0
votes
1answer
10k views
Bypassing HTML encoding [closed]
I am testing a web application where the server accepts special characters like @#$*, but when I insert double / single quotes, the server HTML encodes it.
("test">%3Cscript%3Ealert(&...
0
votes
2answers
3k views
Is it risky to download but not use a zip file?
Is there any possibility of malware infection in Windows 10 for the following three situations:
When you download a zipped file, but do not use it (you do not open it)?
When you only open a zipped ...
22
votes
2answers
2k views
Does this CSS code expose if a message is read, and how long they have been reading it?
This email analytics company offers an 'engagement metric' that shows how much time someone spends looking at an email, whether the email is printed or deleted.
They also claim it works in pretty ...
64
votes
2answers
8k views
Are EU cookie consent forms safe? [closed]
Does the EU consent form system pose a new security risk?
Today we have to click OK on about 20 cookie consent forms every week, where previously we could mostly dismiss internet forms as being ...
28
votes
2answers
11k views
Why is "hovering over" a link in an email considered safe? Or is it harmful?
We are using a browser based email client and the email content is in HTML.
One of my employers told us that if we receive a suspicious email with links, we have to hover over the link (to check ...
40
votes
7answers
8k views
Security risks of user generated HTML?
I am creating a website that allows people to upload HTML content.
Currently these are the tags that are banned:
<script></script>
<iframe>
<object>
<embed>
<style&...
23
votes
2answers
64k views
How to launch XSS code from an INPUT HTML tag upon page load?
Say I have the a website with the following code on it:
<input type="text" id="search-text" name="query" value="?" />
Double quotes aren't escaped so I can break out of the value attribute, ...
9
votes
2answers
5k views
Escaping rich text editor output
When having a rich text editor on a web application, what is the best way to escape HTML entities and prevent XSS attacks but keep the formatting (<b>, <i>, <u>, ...etc.) ?
30
votes
2answers
9k views
Important data can be modified from the developer console. What should I do?
Scenario: I have a to-do list that is generated with JavaScript using JSON that was encoded on the server side. I put the todo item id in the HTML id attribute. So the process goes like this:
Server ...
7
votes
1answer
3k views
What possible use does an iFrame have for security?
I'm looking at code for an old login form I'm redesigning. It's a simple table with two input fields for username and password.
But just before the end </table> tag there's a blank iFrame which ...
4
votes
2answers
7k views
Is using htmlentities or htmlspecialchars functions enough to block XSS attack
I know this question was discussed on net various times. and people give some example how to bypass these functions through passing some code. But here one issue, All example of htmlentities/...
7
votes
2answers
1k views
Workarounds for :visited CSS History reconnaissance
Several years ago it was possible to use
a:visited {
background: url('/log.php');
}
to figure out on what website user has been previously. But now it is restricted by browsers. Is there any ...
4
votes
4answers
5k views
HTML password fields
Imagine you are in a HTML page which offers you the password change service. Some websites bring the previous password in a password field, which you can't read. Is it possible to retrieve the ...
12
votes
2answers
4k views
Why shouldn't I put user input in HTML comments?
The OWASP XSS Prevention Cheat Sheet has a list of locations where untrusted data should never be put:
<script>...NEVER PUT UNTRUSTED DATA HERE...</script> directly in a script
<!-...
9
votes
1answer
2k views
How do I securely embed an <img> tag using a user-given URL?
If I hypothetically wanted to allow users to use an avatar from an arbitrary URL like this:
<img class="avatar" src="{user input}" />
There are many problems that I can think of:
There are ...
5
votes
2answers
622 views
Why are cookies sent with HTML page's cross domain requests but not with JS's XHR?
When we write a HTML page with form tag and an action attribute and a submit button. As soon as we click on submit a request is sent (with cookies) to the URL which was the value of action attribute.
...
5
votes
1answer
801 views
HTTP security headers on non HTML (images, JavaScript, etc)
Let's say, the HTTP security headers below are applied to all HTML pages of a site:
HTTP Strict Transport Security (HSTS)
X-Frame-Options (XFO)
X-XSS-Protection
X-Content-Type-Options
Is it OK to ...
4
votes
1answer
7k views
HTML iframe security exploit
Can somebody explain if there's something malicious in this HTML, The width and height of the iframe ares set to 1 and it's out of the view with top: -100px; statement. I believe it takes some some ...
3
votes
5answers
3k views
Is it secure to use jQuery on the server-side for user input validation?
I'm thinking about using jQuery on the server-side (node.js) to validate user input (filter tags, remove every attributes except href, rel, target & style, modify css rules which are applied ...
2
votes
2answers
2k views
Modify Javascript Variable with URL Exploit
Is it possible to set a javascript variable through the URL?
Here's an example of the code I'm trying to modify:
<script type="text/javascript">
var x = 0;
</script>
Is there a way to ...
9
votes
3answers
2k views
Any eventhandlers that apply to hidden elements?
I'm trying to XSS a search field and my attack vector is getting reflected like this:
<input type="text" id="txtRpHiddenKeyword" style="display: none;" value="ATTACK VECTOR HERE" />
Only ...
7
votes
6answers
3k views
Cleartext password in HTML
Is there any problem with outputing a user's password to the HTML in an hidden field (see use case below before flaming xD)?
The use case is a registration form with two steps. The user fills in the ...
6
votes
1answer
2k views
Why is a child window allowed to change the location of its parent?
Maybe a silly question. When opening a new tab via target="_blank", the page that loads in that tab is allowed to set a new location in the parent tab using:
window.opener.location.replace('http://...
2
votes
1answer
449 views
using rel="noreferer" without rel="noopener" or without target="_blank"
I have been reading about the security and performance implications of rel="noopener" and rel="noreferrer" in links with target="_blank". These are some of the ...
2
votes
2answers
950 views
Can a hacker determine what version of WordPress and PHP a site is using?
Can a hacker determine what version of WordPress and PHP a site is using?
Assume this info is not available by View Source.
2
votes
2answers
2k views
Hacked HTML page - what's in the comment following the obfuscated code?
Chrome just warned me about malicious content when visiting a site - so I visited it.
The source code is like the following:
<html>
<head>
<link href="images/DPT2.ico" title="Dynamic ...
2
votes
1answer
329 views
How to make the most secure text editor in Django?
As a follow up to this question, I'm wondering what is the most secure way (using either markup or markdown) to allow users to format their inputs and upload images in a Django app?
I'm not asking ...
1
vote
2answers
9k views
How to bypass htmlentities() function in PHP to get an XSS?
Here is the PHP filter function that I'm dealing with:
function xss_check_2($data)
{
return htmlentities($data, ENT_QUOTES);
}
The source code of the output (the output is the name, Peter ...
1
vote
1answer
662 views
Are HTML Entities inherently unsafe?
When submitting HTML that contains entities to the OWASP HTMLSanitzer, entities are converted.
For example:
BEFORE: <p>blah blah blah ♦</p>
The resulting HTML ends up looking ...
