Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs

Questions tagged [javascript]

The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

Filter by
Sorted by
Tagged with
0 votes
0 answers
7 views

How to access iframe.contentWindow.document of a nested iframe inside an iframe? [migrated]

I've been trying all day to nest created iframes and access their contents, but security restrictions dont let me. Is there a way? I shared my code and everything i tried so far in a codepen. https://...
serapath's user avatar
0 votes
0 answers
34 views

Do MS Word and Adobe Elf/Acrobat block javascripts from running?

I opened a pdf yesterday and found out it contained javascripts (that could possibly be malcious.) I wanted to know if the javascripts would trigger if I opened it in Word "protected view" ...
Kyle Yang's user avatar
0 votes
0 answers
44 views

Overcoming Middleware: Exploiting XSS to Retrieve Data

I am attempting to perform an XSS attack on my server and have successfully bypassed the CSP. In my server code, I store all users in the following manner: .get("/users", adminReq, (req, ...
EPiez's user avatar
  • 13
1 vote
0 answers
46 views

Overcoming Cookie Theft Barrier in XSS Attack despite CSP Implementation

I have a website that includes CSP rules: .use( helmet.contentSecurityPolicy({ directives: { defaultSrc: ["'self'"], scriptSrc: [ "'self'", "cdnjs....
EPiez's user avatar
  • 13
0 votes
1 answer
77 views

Bypassing CSP and implementing XSS attack

I am using Content Security Policy (CSP) rules in my code to defend against XSS attacks. Here are the CSP rules I have implemented using Helmet: .use( helmet.contentSecurityPolicy({ directives: { ...
EPiez's user avatar
  • 13
5 votes
1 answer
873 views

What are the reasons for CORS failure errors to not be available to JS?

From Cross-Origin Resource Sharing (CORS) - HTTP | MDN: CORS failures result in errors but for security reasons, specifics about the error are not available to JavaScript. All the code knows is that ...
Ooker's user avatar
  • 1,591
0 votes
1 answer
78 views

how to send cookies or token in local storage to a remote server using reflected XSS

I have an XSS vulnerability identified by <script>alert(1);</script> in the url. So when I put it in the url it gets executed (ex: www.example.com/admin/<script>alert(1);</script&...
anonymous's user avatar
2 votes
1 answer
140 views

Secure way to output encoding HTML for insert raw html via javascript

I want to be 100% secure, I create raw html this way: const template = document.createElement('template') template.innerHTML = html_raw const cloned = template.content.cloneNode(true) document....
The nothing's user avatar
0 votes
0 answers
178 views

Lax SameSite and POST (2 minute)

I was going through this link https://medium.com/@renwa/bypass-samesite-cookies-default-to-lax-and-get-csrf-343ba09b9f2b to understand CSRF using samesite. Does that mean that the LAX+POST issue has ...
Johnny's user avatar
  • 183
0 votes
1 answer
142 views

is <script>javascript:alert(document.domain); a valid script for xss?

I have submit the following text <script>javascript:alert(document.domain); in a feedback of a restaurant listed on a website and feedback is sent to website not restaurant. I want to verify but ...
Jaikaran saini's user avatar
2 votes
1 answer
147 views

Securely storing derived key in web app and handling user identity

I am currently working on an open source project to securely store notes, payment card numbers, etc. I would like to implement a zero knowledge encryption method so that no one but the user can ...
mson's user avatar
  • 21
1 vote
0 answers
93 views

Can an embedded 3rd party JS script access or keystroke log an iFrame's content

Say there is a web page with two 3rd party javascript URL scripts embedded in it. One creates a support chat window and the other creates an iFrame within which a user enters payment information into ...
AndyW's user avatar
  • 111
0 votes
0 answers
70 views

Is POST-based XSSI possible?

With standard XSSI, an attacker can include a remote script which contains user-bound secrets across origins, and then read them out. I have an endpoint which returns sensitive Javascript code, but ...
tim's user avatar
  • 29.6k
1 vote
1 answer
96 views

Is it safe to store the OIDC token in a private field of a javascript object?

I would like to initialise a React application with an OIDC token. This token will be stored in a private field of the "api client" object. This object will be used to execute API calls and ...
Marco Altieri's user avatar
0 votes
0 answers
75 views

Methods to look for when checking if a javascript program is making network requests

I'm trying to quickly audit a js browser extension to see if it doesn't talk to the outside. Am I right in thinking that I can just grep the code for the following: XMLHttpRequest fetch $.ajax axios....
Scb's user avatar
  • 101
0 votes
0 answers
114 views

unsafe-hashes an alternatives

I need to run the following inline script to inject some Thymeleaf model variables into a javascript file of mine. <script th:inline="javascript"> /*<![CDATA[*/ var ...
Shaunyl's user avatar
  • 101
1 vote
1 answer
158 views

Is this a type of XSS attack?

I have been exploring customer support in a website as part of bug bounty program. I then started a chat with their customer support and pasted the following in the box: <!--<img src="-->...
Testing Graphics's user avatar
2 votes
1 answer
716 views

Is JSON vulnerability still possible?

I have a bunch of REST APIs which would be consumed by frontend applications created by customers using our product. I have suggested to only use last 2 versions of Chrome for running frontend apps. ...
user120947's user avatar
0 votes
0 answers
148 views

How to abuse the onerror method to get XSS?

In the book Javascript for hackers, Gareth Heyes overwrites the window.onerror method with eval, used to execute a function. From my understanding, the following snippet run in a browser console ...
Riccardo D's user avatar
1 vote
1 answer
158 views

Timing Attack using bcrypt.js

I am using bcrypt.js for basic login. I have found that the below code runs noticeably quicker when no user is found, since it exits immediately, and no check is done on the hash. This could give an ...
Timothy Pulliam's user avatar
0 votes
0 answers
194 views

Optimal way to securely store password on client with server invalidation but not knowledge

A number of similar questions have been asked about this general topic before (e.g. How to store user credentials in browser securely?), but I wanted to seek some clarification on a specific scenario. ...
InterLinked's user avatar
0 votes
0 answers
137 views

What's an example of a good uninjection in Node.js? (mySQL)

I'm hosting a simple MariaDB/mySQL server on my Raspberry Pi. I would like to know whether or not this code is secure enough to reject an injection attempt made by login/signup, etc. function ...
Parking Master's user avatar
0 votes
2 answers
161 views

Why do most examples of CSRF use roundabout ways of executing an API call instead of just using pure Javascript?

When I see examples of CSRF attacks, it is almost always explained with someone entering some external API url in an <img> tag, e.g. <img src="bank.com/transfer?amount=10000?recipient=...
colioli's user avatar
0 votes
0 answers
116 views

Safe Sinks js confusion

Have some confusion regarding safe sinks in javascript. The DOMpurify library linked in the OWASP article does not explicitly mention the .files and .valueAsDate of an HTMLInputElement as safe sinks, ...
okzoomer's user avatar
  • 101
0 votes
0 answers
84 views

What can be leaked using a browser extension where one of the extensions loads JavaScript from a remote site?

Can one remotely log my IP, browser history, and saved passwords? I think the IP should be easily done if one of the extensions load a remote JavaScript to run in my browser. I'm not sure about other ...
Maxfield's user avatar
  • 149
0 votes
0 answers
25 views

i found an inserted script in all my pages and posts [duplicate]

I found this script in all my pages & posts and custom CSS. I want to delete it and prevent regenerating it again. This script stopped me from updating custom css in customize. please help if you ...
mohamed haddad's user avatar
0 votes
1 answer
122 views

Certificate structure for accessing a local device from a web app

I have a pretty standard web app (react client, node server), https-enabled. I want to add the ability for the web app to access a device on the local LAN. The device has REST APIs and I can install ...
Jim B.'s user avatar
  • 101
0 votes
0 answers
191 views

Path-Based Vulnerability on security report on images

We are running Qualys security tests on our angular webapp, and we are getting one issue. Whatever images we are loading in the screens, we are getting "Path-Based Vulnerability" issue for ...
Salil Bansal's user avatar
1 vote
1 answer
9k views

Where to store JWT refresh tokens

Where to store JWT refresh tokens? My idea was to encrypt the refresh token with crypto-js AES and salt, keeping it in an environment variable (.env). Then, the refresh token would be stored in either ...
simple_developer's user avatar
0 votes
1 answer
192 views

Is <img :src="require`${JSON.parse(string)}`"> in electron vue is safe from XSS?

I am inspecting a client's application written with Vue.js and I found there a following construction. // Somewhere else in the code var data = JSON.parse(jsonString); // In the vue component <...
Max's user avatar
  • 101
1 vote
0 answers
114 views

Is there a way to prevent/detect DOM Clobbering in the browser?

It is possible to clobber document attributes, e.g.: <img name="cookie"> ... typeof(document.cookie) //=> 'object' Is there any way to prevent this from happening, access the ...
muhashi's user avatar
  • 11
1 vote
1 answer
957 views

XSS in document.write(location.href)

Let's say a website contains the following <script> tag and does not have a CSP blocking any execution here. <script type="text/javascript"> document.write(location.href) </...
J Heschl's user avatar
  • 123
2 votes
1 answer
693 views

Why don't Internet browsers allow me to fetch a JSON file from raw.githubusercontent.com, but they allow me to fetch .psm files from there?

When I was making my PicoBlaze Simulator in JavaScript, I added 6 examples of how to use it. Those examples are on my GitHub profile, they are the .psm (PicoBlaze Assembly) files. I decided not to ...
FlatAssembler's user avatar
0 votes
0 answers
95 views

Are there any html Sanitizer() API configs that allow javascript execution?

I'm talking specifically about the HTML Sanitizer API: https://developer.mozilla.org/en-US/docs/Web/API/HTML_Sanitizer_API The API allows you to configure the sanitizer with a list of allowed elements ...
user1131308's user avatar
0 votes
1 answer
175 views

What is the best way to validate third-party domains calling an API?

Our business is in the payment processing space and one of our core products is a Payment Gateway API. In terms of security we issue an API Key, Signature and RSA Encryption for sensitive information ...
chris's user avatar
  • 103
0 votes
1 answer
235 views

Feedback wanted regarding how secure this encryption/decryption is

I am creating a Password Manager and I wanted to create a JavaScript function to encrypt/decrypt data in the client-side, then I will be saving the only the encrypted data in MySQL Server. To encrypt/...
Manuel's user avatar
  • 9
1 vote
2 answers
1k views

Check if javascript in pdf is malicious

I used Didier Stevens's pdfid.py to check a pdf, and it found js and automatic actions associated with the pdf: How do I check if this is malicious code?
Randusr's user avatar
  • 23
0 votes
1 answer
125 views

XSS not executing properly

Instead of receiving Alert(XSS) I get [object Object] The application is expecting a .csv file and the name of the file is being reflected. I put the original .csv file and then I remove it in order ...
ilich262's user avatar
2 votes
2 answers
691 views

When using double submit cookies as protection against csrf, does it matter where the random key is created?

I have a stateless backend and a spa-frontend. Except for the login request, all requests are secured by a jwt in the header. Additionally the application should now be secured against csrf. Since the ...
samjaf's user avatar
  • 121
0 votes
1 answer
203 views

Why does it seem like websites can still use JavaScript in Chrome after disabling JavaScript?

I have disabled JavaScript under "Site settings" in Chrome. That is, I selected: "Don't allow sites to use Javascript". After doing so, I encountered a webpage that somehow manages ...
anon_wh1's user avatar
1 vote
1 answer
142 views

JS bug is stopping my xss payload to exeute

The XSS vector is at the * but the function issue_type is not declared hence my payload is not getting executed. following is the instance of the vulnerable code:- <select name="sub_subissues&...
joao silva's user avatar
1 vote
2 answers
697 views

xss: is it possible to continue javascript code execution after a "throw new Error()" line?

there is this javascript file that a can inject code after throw new Error("error string") line. But it seems that after the throw statement, no code can be executed. throw new Error("...
nv92Cczb1's user avatar
1 vote
1 answer
230 views

How is a XSS attack possible in this context?

I'm testing a website, which is vulnerable to XSS. <input type="hidden" id="referer" name="referer" value="INJECTION_POINT"> <script> document....
Hyper's user avatar
  • 11
0 votes
0 answers
114 views

Can WebASM provide JavaScript style interactivity without the same vulnerabilities?

JavaScript is useful for interactivity. However, it is often disabled by security conscious browsers, such as the Tor Browser Bundle, and blocked with plugins such as NoScript. I was wondering if it ...
user5623335's user avatar
1 vote
0 answers
522 views

force XSS after bypassing Request.Form using URL Encoding

I am testing a cross-site scripting attack on a website, as we all know the Request.Form function validates the input so the user couldn't insert a <script> inside the input. My focus in this ...
syk's user avatar
  • 11
0 votes
1 answer
187 views

Need help about how to generate the Key and Passphrase to encrypt/decrypt data (JavaScript)

I am developing a public website (with https) where each user is going to register and save confidential data, this data needs to be encrypted/decrypted only by the user. I need help to know how to ...
Manuel's user avatar
  • 9
1 vote
1 answer
747 views

Storing encrypted password in database but decrypt it on the client side

Language used is Javascript. For context, I am making a password manager where users can store different accounts of service and their passwords. The idea was to store multiple encrypted passwords in ...
cannons's user avatar
  • 11
1 vote
0 answers
564 views

Client-side Javascript injection by assinging the output of window.location.href.substr to a variable

Sample code: function winLoad() { var sessionId = ''; if (window.location == window.top.location) { var semicolonIndex = window.location.href.indexOf(';'); if (semicolonIndex !=...
jne's user avatar
  • 11
2 votes
2 answers
959 views

Can a client script (running within a webpage) provide to the browser a certificate to accept in a wss:// connection?

Can a client script provide to the browser a certificate to accept in a wss:// connection? The WebSocket constructor does not seem to have many options. (I am designing an IoT server that lets the ...
personal_cloud's user avatar
1 vote
1 answer
115 views

javascript: how to apply block cipher to byte stream

I am writing browser javascript that has a pre-shared key with nonce, and creates a binary websocket connection. How can I apply block encryption-authentication such as AES-GCM to the messages? Is it ...
personal_cloud's user avatar

1
2 3 4 5
28