Questions tagged [javascript]

The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

Filter by
Sorted by
Tagged with
-1 votes
0 answers
33 views

How to bypass this code to get login to website or to get the unauthenticated URL?

There i a website where i send a post request to login to website Host: example.com Content-Length:205 ..Some other headers .. __RequestVerificationToken=something&Login.UserName=example&Login....
0 votes
0 answers
18 views

Is this code vulnerable to XSS? [closed]

var elem = document.createElement(untrustedinput1); elem.style.paddingLeft = untrustedinput2; I am just wondering if it's possible to pass XSS payloads via tags while creating an element in ...
1 vote
1 answer
87 views

Storing encrypted password in database but decrypt it on the client side

Language used is Javascript. For context, I am making a password manager where users can store different accounts of service and their passwords. The idea was to store multiple encrypted passwords in ...
  • 11
1 vote
0 answers
45 views

Client-side Javascript injection by assinging the output of window.location.href.substr to a variable

Sample code: function winLoad() { var sessionId = ''; if (window.location == window.top.location) { var semicolonIndex = window.location.href.indexOf(';'); if (semicolonIndex !=...
  • 11
2 votes
2 answers
82 views

Can a client script (running within a webpage) provide to the browser a certificate to accept in a wss:// connection?

Can a client script provide to the browser a certificate to accept in a wss:// connection? The WebSocket constructor does not seem to have many options. (I am designing an IoT server that lets the ...
1 vote
1 answer
31 views

javascript: how to apply block cipher to byte stream

I am writing browser javascript that has a pre-shared key with nonce, and creates a binary websocket connection. How can I apply block encryption-authentication such as AES-GCM to the messages? Is it ...
1 vote
1 answer
26 views

Javascript: How to check SHA of fetched script before executing

To save money and/or reduce system complexity, I am hosting a script on a server that I don't fully trust. My trust issue might be with the server itself, or the PKI setup on it. The reason doesn't ...
1 vote
1 answer
64 views

How vulnerable are secrets kept in browser javascript variables?

Suppose my website handles sensitive data in the user's browser using Javascript: let secret = decrypt (thing, ask_user("Password?")); // Global, or reachable via a global EDIT: the secret ...
  • 315
0 votes
1 answer
53 views

XSS in location.hash.match() function

I was solving a CTF. Just reading the source code of the web page, I found a vulnerable piece of code: var r4c='(.*?)'; var results = location.hash.match('token\\('+r4c+'\\);'); I am unable to ...
2 votes
3 answers
104 views

How to build a PSK website

Pre-Shared Key (PSK) with simple symmetric encryption is a popular way of solving both client and server authentication when SSL cannot be used for some reason (for example, can't trust or deal with ...
2 votes
3 answers
154 views

Is Chrome's view-source dangerous when visiting malicious sites? [duplicate]

What are the risks of viewing the source code of malicious pages on Google Chrome? I want to go directly to view-source:https://example-site.com to visit the sites without rendering anything malicious ...
1 vote
0 answers
61 views

Is this a LFI vulnerability?

I'm playing with uploads, so I'm wondering if this route is safe to use, because if you somehow break off from the md5 function path, then you can control the path (if in TypeScript null byte is a ...
0 votes
0 answers
40 views

Rust WASM's web_sys add_event_listener_with_callback "callback" is actually an eval() function under the hood. Isn't this dangerous?

Rust WASM's web_sys add_event_listener_with_callback "callback" is actually an eval() function under the hood. Isn't this dangerous? if so, how? Here is a link to js_sys function, which ...
0 votes
2 answers
47 views

Security vulnerabilities from storing anti CSRF token in global JS variable?

What are the security vulnerabilities arising from storing anti CSRF token as a global JS variable and use it for every requests made which need CSRF protection? If there are any vulnerabilities what ...
2 votes
1 answer
44 views

What does COEP do that CSP doesn't already do?

Both Cross-Origin-Embedder-Policy and Content-Security-Policy seem to do pretty similar things: they restrict the document from loading certain types of subresources (e.g. cross-origin subresources). ...
0 votes
1 answer
53 views

Dom Clobbering methods on the document object

I'm struggling to understand how this flavor of dom clobbering actually works. The green box at the top of this section of the HTML spec makes it pretty clear why I can access HTML elements as global ...
2 votes
2 answers
90 views

What could go wrong with this inlined javascript variable initialization in ASP

I am currently reviewing an ASP application where this javascript initialization is used all over the place: const someValue = "<% get_some_value() %>"; And this pattern is actually ...
-2 votes
3 answers
52 views

Does the SE login page need hardening against third party javascript?

Closely related to the Meta question Can Google and Cloudflare find my SE password? In short the SE login page loads javascript from Google and Cloudfare. I believe the javascript has full access to ...
  • 105
0 votes
0 answers
16 views

How to turn this particular HTML rendering into a XSS or open redirection

I am performing penetration testing on a web application. Let's say the site as "https://example.com" There is a comment field , where a user can add data and it will be shown in the same ...
1 vote
0 answers
19 views

Can the data between Express.js middleware be manipulated/tampered in any way?

In the node.js express.js framework there is middleware support. Let's assume I have two middleware - the first one, which verifies whether the JWT token is legit and not tampered with and the second ...
  • 234
1 vote
0 answers
85 views

Possible window.location.hash DOM XSS

I've recently gotten into web security and javascript and I think this looks like apretty promising DOM XSS: let hastagIntentos = 0 , posAnterior = 0 , reintentosHatagPos = 0; function ...
0 votes
1 answer
37 views

Amount changed in Javascript SDK security issue

I was working on PayPal gateway integeration on my website using Javascript SDK and then I came up with this thought that, what if someone changes the value of amount in the code below through ...
  • 1
-1 votes
3 answers
89 views

Who can we read the contents of the variable? Which format is used? [closed]

We are not IT security specialists but we are very curious to know more about a scam we received through mail. We received a mail with a HTML file attached. The subject of the mail looked very ...
  • 3
0 votes
2 answers
204 views

Javascript command from a scam website

I was trying to get verified on a 28k user server on discord. Verify channel directed me to this page and I followed the steps in order to get verified. The command was this javascript:fetch(atob('...
  • 3
0 votes
1 answer
191 views

XSS in href attribute

I'm currently pentesting a website where I can set a URL on my profile. I'm trying to get an XSS to fire, but my javascript knowledge is a bit limited for this use case: Imagine this is your ...
  • 50
1 vote
1 answer
119 views

Is this code code vulnerable to XSS?

I have a function that accepts the param url and passes it to exec() function getQueryValue(url, name) { name = name.replace(/[\[]/, "\\[").replace(/[\]]/, "\\]"); var ...
  • 135
0 votes
0 answers
57 views

Dealing with CVE-2022-2584 in Angular JS

The package angular after 1.7.0 is vulnerable to Regular Expression Denial of Service (ReDoS). There aren't many details available around this issue. Since this version of Angular is out of support, I'...
  • 101
1 vote
1 answer
254 views

Is the Web Crypto API secure when the server is trusted?

I've heard a lot of people say that the Web Crypto API is not very safe. For example: https://tonyarcieri.com/whats-wrong-with-webcrypto, Problems with in Browser Crypto. However, I'm looking to use ...
0 votes
1 answer
67 views

Can you have an <iframe> tag with no spaces?

I am looking to figure out how to create an iFrame tag without any spaces. I have found an input on a Bug Bounty program that reflects my input back into the page, and allows me to escape double ...
  • 50
0 votes
1 answer
147 views

XSS payload to Send request to server without closing tag

I was testing a website which does not have XSS in their scope. So I thought it would be a good idea to escalate XSS to a bug which is valid. I need to make a request to my server but the problem is ...
0 votes
0 answers
76 views

Threats that JavaScript poses to a web crawler

I'm writing a simple crawler with node.js, which searches for web pages and conditionally executes any JavaScript present. The problem is that in doing so, I execute code form untrusted sources in my ...
0 votes
0 answers
33 views

JavaScript API calls in Browser security

We want to develop a JavaScript application (with Angular) which will communicate with various other systems via API calls. For example, a checkout page where all entered information should be sent to ...
0 votes
0 answers
45 views

Accidentally locked an XSS vulnerable input

On https://ais.osym.gov.tr/ I saw an XSS vulnerable input. I tried some payloads without malicious intent which only contained alerts or console logs. The code img \x00src=x onerror=alert(1) worked. ...
2 votes
1 answer
136 views

Can I visit a malicious website by using Tor with settings set to safest or by using NoScript on an ordinary browser with settings set to untrusted?

Can I visit a malicious website by using Tor with settings set to safest or by using NoScript on an ordinary browser with settings set to untrusted? If not then is there any way to visit a malicious ...
1 vote
0 answers
657 views

Checkmarx Client DOM XSS Violation in ReachJS

I have this message from Checkmarx: The application's = embeds untrusted data in the generated output with location, at line 19 of ****.js. This untrusted data is embedded straight into the output ...
  • 111
2 votes
1 answer
178 views

Is any client-sided password just security by obscurity?

Let's say I want to deploy a simple static website (with no backend server) with some protected pages only visible after entering a password. I could write a hardcoded salted hashed password and ...
  • 123
1 vote
0 answers
48 views

How to debug javascript code with Windows functions on Linux?

I am a beginner in analyzing javascript code on Linux and whenever the code is for a Windows machine I cannot proceed with debugging because there are undefined functions. Examples: GetObject(_6078(1),...
0 votes
2 answers
137 views

Is it possible to get "real" IP from a host machine which is using a SSL-VPN connection?

We'd like to obtain the public IP of a user that connects via SSL VPN, the one that the user would have if he didn't connect that way. But this looks impossible to do, if we use web services like the ...
0 votes
1 answer
37 views

What other methods would an attacker use for making an HTTP request that isn't Fetch() or an XHR or using the DOM?

We are running user-submitted JavaScript, server-side to be executed within a headless browser that doesn't have a DOM or any child of the window or document or location objects - because these are ...
  • 47k
1 vote
0 answers
99 views

Need for URL encoding in XSS / CORS lab

I am doing one of Portswigger's labs on web security, specifically CORS (cross origin resource sharing). I am having trouble understanding why there is a need for URL encoding certain parts of the XSS ...
  • 11
0 votes
1 answer
161 views

portswigger Lab - Reflected XSS into HTML context with most tags and attributes blocked

I am busy with the portswigger lab studies, doing "Reflected XSS into HTML context with most tags and attributes blocked". I successfully fire the print() on myself and the simulated victim, ...
  • 1
0 votes
1 answer
360 views

XSS against jQuery PortSwigger challenge

I am trying to do this jQuery XSS challenge here by PortSwigger. They have a good walkthrough for XSS attacks, however I could not find anything on jQuery, which is also a programming language I have ...
1 vote
0 answers
87 views

What is the value of no paste text boxes for bank web sites?

HSBC Bank plc (UK) has a OTP system to confirm online payments via SMS. The 6 figure number is sent to the user who enters it into the website. Sometimes the cards registered email address is ...
  • 121
0 votes
1 answer
73 views

Is this SQLi or XSS? (or both/neither)

I'm trying to get the hang of SQLi and XSS, and I am starting to get the hang of it. However: in my lab I made this: ignore'"; UPDATE users SET name=<script>alert('Malicious activity')</...
0 votes
0 answers
44 views

Is There Any Security Risk to Opening an Official JavaScript File in Command Prompt?

I was studying how to create a simple app with Vue.js Javascript framework and downloaded the official and latest (as of today) CDN file from https://unpkg.com/vue@3.2.36/dist/vue.global.js. I saved ...
  • 77
1 vote
1 answer
6k views

XSS: window.location.href and window.open

I'm working through all issues that the static security analysis tool Fortify found in our internal Angular application. There is one particular issue I'm not confident of how to work with. Please see ...
  • 125
0 votes
0 answers
36 views

How to turn a relative path script (js) import to an absolue one with a url for XSS ? (more details below)

I have a parameter whose value is injected in the HTML as the following <script src="/dir1/dir2/dir3/dir4/INJECT_HERE"> </script> I was able to traverse back to just / but when ...
1 vote
1 answer
57 views

How to mitigate risk of exploiting open POST endpoints?

I'd like to ask for advice reg. protecting the state-altering HTTP API endpoints of the API that I'm owning (POST etc.). I'm owning a web application that exposes some HTTP endpoints to the world. ...
  • 11
3 votes
2 answers
749 views

Create a cryptographically secure random string for auth cookie in javascript

I know there are multiple libraries for managing authentication, but I have a hobby project and wanted to create a very simple authentication system. It'd set a cookie in the client's browser with a ...
  • 225
0 votes
0 answers
16 views

Threat Assessment Javascript User-controlled Variable Names on Window

I have a requirement to support some external integration to a 3rd party vendor on our site (which is a SaaS site with multiple tenant logins). The vendor requires a script and a global variable to be ...

1
2 3 4 5
27