Questions tagged [javascript]

The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

Filter by
Sorted by
Tagged with
0
votes
3answers
61 views

Admin privileges depending on JWT body

From a security perspective is it ok to store the permissions of a user inside the body of the Json Web Token? For example a jwt body like this: { "username": "lukas", "isAdmin": true } The ...
0
votes
1answer
64 views

What Same Origin Policy related risks are there with static pages?

I am wondering what risks there are if you have static pages on the same host that don't trust each other. A key concept of Javascript and web security is the Same Origin Policy (SOP), which is also ...
0
votes
0answers
30 views

In memory local variables (javascript), OAuth token storage, and XSS

Quoting from a long-dead Auth0 forum post: https://community.auth0.com/t/why-is-storing-tokens-in-memory-recommended/17742 "Any values stored in memory are still vulnerable to XSS attacks since ...
2
votes
2answers
91 views

using NoScript - what approach to use with randomnly named CDN scripts?

I ran across this on namecheap.com. This question isn't about namecheap.com itself, which I have no problem trusting. Rather, what approach do you recommend in dealing with CDN scripts that have ...
0
votes
0answers
63 views

What kind of virus this website have? [closed]

I found website https://coronavirus-map.com and send it to a friend, then he said this website have a virus because his antivirus detect this website like virus. I didn't know that websites can have ...
4
votes
1answer
123 views

What's the worst security issue what can happen by using eval() in Android WebView?

I've come across a hybrid Android app - meaning most of its UI is implemented in a WebView using HTML and JavaScript technologies. The app itself is connecting to the server and one of the possible ...
0
votes
0answers
33 views

Testing session.cookie_httponly .htaccess

I have been trying to confirm which browsers will accept session.cookie_httponly but for my test each browser I am using fails. Which more than likely indicates my test is not correct. What I am ...
0
votes
1answer
52 views

Demonstrating reflected XSS with GET Parameter and URL encoding

A client is developing a website which is vulnerable to reflected XSS through a GET parameter: https://example.com/vulnerable-url?")||true)alert("XSS");</script> I would like to demonstrate ...
0
votes
2answers
90 views

Why not sandbox websites instead of using Same-Origin-Policy?

Why do Browsers implement a Same-Origin-Policy (SOP) to prevent open websites in the browser from executing scripts that may access / modify data of other open websites in the used browser? Another ...
0
votes
0answers
47 views

XSS into Javascript?

Im testing an application for XSS. My input from an HTTP request is being reflected into an inline script in the response. Specifically it is being reflected into an object. I am trying to escape ...
2
votes
1answer
63 views

XSS attack on websites that allows JS file upload?

Consider a website example.com that allows users to upload arbitrary JS files, that are then stored on the server and served to visitors with a JS content type. Could an attacker use this to perform ...
0
votes
1answer
107 views

IP retrieval without visiting the site or clicking the link

I am doing some research. There are site like grabify and iplogger.org which allow you to get the IP of the person who has clicked the link. Logs are also generated by various bots when you send a ...
0
votes
1answer
92 views

Some questions about encryption in Java

I have some questions about encryption in java as I'm trying to develop a password-manager-like application for my final test in Computer Science in High School (Germany). The password manager uses a ...
6
votes
1answer
83 views

Why was the Same-origin policy originally introduced (before XMLHttpRequest)?

As I understand it, the Same-origin policy (SOP) basically prevents a script in a web page from obtaining or sending information from/to a different domain. I understand that this is important to ...
1
vote
0answers
38 views

How to handle application/jsonp response

I am testing a Web Application and i have found a endpoint which is returning some data in json the endpoint is this. /api/vtexid/pub/authenticated/user Now i was testing to find out that if this ...
0
votes
0answers
52 views

JS Input Validation and XSS

I have an html form that allows a user to change their password. I have been reading up on XSS and have been adding protection where I can. Most of that has been server side. I am curious (and I think ...
-1
votes
1answer
88 views

Is there an advantage in removing an element both from CSS and JS? [closed]

I have a website built with MediaWiki CMS which I host on a CentOS based Apache "shared server environment" (SiteGround). This website contains a ContactPage contact form in which the subject field ...
1
vote
1answer
68 views

Is encrypting localStorage data more secure?

I'm building an SPA app and I have to use an access token to make requests to an API. The most common way to store the JSON Web Tokens is to use localStorage, but I have always thought that was a bad ...
3
votes
1answer
90 views

What security concerns are there for a fully client-side JS/HTML5 app?

I'm working on an Interactive Fiction story in Undum, which is a fully client-side JS/HTML5 framework. I've been reading about Content Security Policy lately (after looking up what a crypto nonce is) ...
0
votes
1answer
96 views

Why is JavaScript executed manually from the browser console not allowed to access everything?

Why is JavaScripts executed manually from the browser console not allowed to access "everything"? Especially the "visited" status (see this question) of links? What kind of security threat would that ...
2
votes
1answer
128 views

Session id in custom header

Is there a way to perform session fixation attack with XSS present if session id is passed in request header? As far as I see it, theoretically there are three ways to do so: intercept request on ...
2
votes
2answers
108 views

Compromise of a Public JS Library

I was listening to a podcast about cybersecurity, and I heard that a public JavaScript library was compromised by attackers who injected a credit card scraper into the library, and then every site ...
0
votes
2answers
138 views

What practical damage a compromised/malicious third-party JavaScript can cause?

It is well-known that third-party JavaScript inclusion is risky, I wonder what actual damage can be caused if the third-party script is malicious. Of course the script can cause as much damage as ...
2
votes
1answer
63 views

Why are cookies sent with HTML page's cross domain requests but not with JS's XHR?

When we write a HTML page with form tag and an action attribute and a submit button. As soon as we click on submit a request is sent (with cookies) to the URL which was the value of action attribute. ...
3
votes
1answer
130 views

Can string comparison realistically be exploited in a timing attack on a web server?

Suppose you have the following code in Node: const { token } = req.body const hash = crypto.createHmac('sha256', SECRET).update(token).digest('hex') const user = await User.findById(req.session....
0
votes
0answers
18 views

xss filter bypass <>& [duplicate]

i've been trying to bypass an xss filtering system but i failed to exploit it , i've searched alot but couldn't find anything that works so i thought i should ask u guys i've entered all the ...
1
vote
0answers
68 views

Clickjacking and XSS on file upload input?

I reported a self-xss on file uploader input to a bug bounty company and they said that they will only accept it if i can find a good clickjacking exploit for that input. My question is: Is it ...
3
votes
2answers
159 views

URL parameter manipulation and injection

I have a scenario with 2 sites. Site 1 is mysite.com and Site 2 is secondurl.com. Site 1 is using Wordpress. There, I did a Javascrit/jQuery routine that checks if a given url parameter comes in. If ...
0
votes
2answers
83 views

In page Payment script security needs [closed]

Currently, I'm working in a Fintech StartUp. We have already implemented our payment solution with redirect in a checkout page hosted in our domain (like https://stripe.com/docs/payments/checkout). ...
-2
votes
3answers
146 views

Can a URL contain executable JavaScript?

I am learning about "Session fixation" and have read the corresponding OWASP page. In their Example 2 in the above page, they describe an attack via JavaScript, that is embedded in the URL like: ...
0
votes
1answer
43 views

Bypassing header validation

I have made a script that can be used for exploiting CORS misconfiguration. The script works fine but if I want to send an extra header to the request by xhttp.setRequestHeader("test_header", "...
1
vote
1answer
102 views

Can somebody explain why the IP address 192.168.1.1 is apparently “special” and not following the CORS rules?

I asked this question: What would happen if some random webpage made an Ajax request for http://127.0.0.1/private.txt? The answers/comments confuse me. Am I right in interpreting them like this? "...
0
votes
1answer
93 views

derived key from email + password?

When deriving a private key from a password, will the resulting secret key be any weaker if the user email is included in the function input? Meaning, user email concatenated with the user password. ...
1
vote
1answer
70 views

Is this javascript vulnerable to dom based XSS?

I was testing example.com and i found a js reflection point. If i send the following request: https://example.com/?token=test%22test="'-confirm(1)-' I can see the following in server response: <...
0
votes
1answer
64 views

Exploiting CORS and storing the response to server

I am trying to exploit misconfiguration CORS. I have created and hosted a file in HTML and Javascript where if someone clicks the link there HTTP response containing cookies will reflect them on the ...
0
votes
0answers
54 views

How much damage can JavaScript do? [duplicate]

I've tried to find an answer to this question for quite a bit of time, but I can only find example of how an XSS attack is accomplished. My question is, once JS is successfully injected into a site, ...
2
votes
1answer
131 views

Browser copy function overridden silently, is this security risk?

I came across a site which overrides copy functionality and injects current page url as paste value. I was trying to select couple of words and instead it copied the page link. Simple developer tools ...
1
vote
1answer
66 views

Telcom company injecting javascript in the header of a web-page

The start page of my browser is example.com. Recently, connecting through the main Spanish telcom network (Movistar), I got a different page, with a header showing the name of the this company. This ...
2
votes
1answer
143 views

XSS inside JavaScript string literal without single quotes?

As a pentester I came across this scenario: <script type="text/javascript"> URL = 'http://example.com?x=input'; I am able to insert a new line with %A0, spaces and almost anything except '. ...
2
votes
0answers
73 views

Is it possible to launch XSS if only the left angle bracket is encoded

I find some website only encode the left angle bracket of inserted HTML tag, for example: <div style="position:absolute;left:63.35px;top:108.41px" class="cls_002"><span class="cls_002">&...
0
votes
1answer
98 views

Are there any security concerns with storing private keys in browser's javascript?

I'm working on a web app, and I know little about security/cryptography (for now, still learning) but I'm trying to set up a front-end where: At the very beginning, the user puts in their private key....
1
vote
1answer
73 views

Is there a security benefit to testing HTTP header presence with Javascript?

I have found in one of the client side libraries that it is performing an AJAX call to an API and checking if response contains all of the following headers with corresponding values (as a security ...
1
vote
1answer
100 views

Use a WHERE clause that's stored in a table?

Background: I have a workorder management system (WMS). The WMS has functionality that allows users to save queries. The queries are saved in a database table called QUERY (in a CLAUSE column). An ...
1
vote
1answer
498 views

How to store user credentials in browser securely?

I need help to authenticate User with user credentials. We are using Angular 5 as a front-end & need to store user's email and password if user checks on remember Me. autofill user credentials ...
0
votes
2answers
111 views

Can JavaScript from different origins communicate securely

I want to know if there is a way for JS from one Origin to delegate a task to JS from another origin in a secure way. The use case is to have a JS Agent from the users' home origin use the ...
2
votes
2answers
112 views

CSRF Clarification and Demystification

I understand how Cross-Site Request forgery happens, but I'm very unclear about how to protect against it using a SPA(React) application. For instance, my current strategy is to, on login, send a ...
1
vote
1answer
51 views

Using local files securely on website

I have a website on which users can select a file from their local machine, manipulate it and then save it. The website is written entirely in JavaScript to ensure it's purely client-side. Is the ...
-4
votes
1answer
84 views

I want to hide my youtube embeded code from my source code [closed]

I have iframe in my website i want it to be encrypted so that user can't understand the link and when user try to paste on browser it should show the video <iframe id="<?php echo $...
0
votes
3answers
132 views

Xss payload with onpointerover?

I bypassed a WAF and found an XSS vulnerability using the onpointerover event handler. In the page where I found the vulnerability, there's also a login page. What XSS payload can I use with the ...
1
vote
1answer
95 views

preventing cross iframe key logging in javascript

We have a web application, where other partners can include their pages as iframes. We implemented a server-to-server way of authenticating users for the iframes, but one partner doesn't want to ...

1 2 3 4 5 23