Questions tagged [javascript]
The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.
1,347
questions
0
votes
0
answers
21
views
Is POST-based XSSI possible?
With standard XSSI, an attacker can include a remote script which contains user-bound secrets across origins, and then read them out.
I have an endpoint which returns sensitive Javascript code, but ...
- 29.5k
1
vote
1
answer
36
views
Is it safe to store the OIDC token in a private field of a javascript object?
I would like to initialise a React application with an OIDC token.
This token will be stored in a private field of the "api client" object. This object will be used to execute API calls and ...
- 653
0
votes
0
answers
28
views
Methods to look for when checking if a javascript program is making network requests
I'm trying to quickly audit a js browser extension to see if it doesn't talk to the outside. Am I right in thinking that I can just grep the code for the following:
XMLHttpRequest
fetch
$.ajax
axios....
- 101
0
votes
0
answers
42
views
unsafe-hashes an alternatives
I need to run the following inline script to inject some Thymeleaf model variables into a javascript file of mine.
<script th:inline="javascript">
/*<
- 101
0
votes
1
answer
99
views
Is this a type of XSS attack?
I have been exploring customer support in a website as part of bug bounty program.
I then started a chat with their customer support and pasted the following in the box:
<!--<img src="-->...
0
votes
1
answer
184
views
Is JSON vulnerability still possible?
I have a bunch of REST APIs which would be consumed by frontend applications created by customers using our product. I have suggested to only use last 2 versions of Chrome for running frontend apps. ...
- 101
0
votes
0
answers
62
views
How to abuse the onerror method to get XSS?
In the book Javascript for hackers, Gareth Heyes overwrites the window.onerror method with eval, used to execute a function.
From my understanding, the following snippet run in a browser console ...
- 133
1
vote
1
answer
86
views
Timing Attack using bcrypt.js
I am using bcrypt.js for basic login. I have found that the below code runs noticeably quicker when no user is found, since it exits immediately, and no check is done on the hash. This could give an ...
- 153
0
votes
0
answers
95
views
Optimal way to securely store password on client with server invalidation but not knowledge
A number of similar questions have been asked about this general topic before (e.g. How to store user credentials in browser securely?), but I wanted to seek some clarification on a specific scenario.
...
- 121
0
votes
0
answers
68
views
What's an example of a good uninjection in Node.js? (mySQL)
I'm hosting a simple MariaDB/mySQL server on my Raspberry Pi. I would like to know whether or not this code is secure enough to reject an injection attempt made by login/signup, etc.
function ...
- 269
0
votes
2
answers
88
views
Why do most examples of CSRF use roundabout ways of executing an API call instead of just using pure Javascript?
When I see examples of CSRF attacks, it is almost always explained with someone entering some external API url in an <img> tag, e.g. <img src="bank.com/transfer?amount=10000?recipient=...
- 1
0
votes
0
answers
37
views
Safe Sinks js confusion
Have some confusion regarding safe sinks in javascript.
The DOMpurify library linked in the OWASP article does not explicitly mention the .files and .valueAsDate of an HTMLInputElement as safe sinks, ...
- 101
0
votes
0
answers
44
views
What can be leaked using a browser extension where one of the extensions loads JavaScript from a remote site?
Can one remotely log my IP, browser history, and saved passwords?
I think the IP should be easily done if one of the extensions load a remote JavaScript to run in my browser. I'm not sure about other ...
- 127
0
votes
0
answers
25
views
i found an inserted script in all my pages and posts [duplicate]
I found this script in all my pages & posts and custom CSS. I want to delete it and prevent regenerating it again. This script stopped me from updating custom css in customize.
please help if you ...
0
votes
1
answer
64
views
Certificate structure for accessing a local device from a web app
I have a pretty standard web app (react client, node server), https-enabled.
I want to add the ability for the web app to access a device on the local LAN. The device has REST APIs and I can install ...
- 101
0
votes
0
answers
86
views
Path-Based Vulnerability on security report on images
We are running Qualys security tests on our angular webapp, and we are getting one issue. Whatever images we are loading in the screens, we are getting "Path-Based Vulnerability" issue for ...
0
votes
1
answer
2k
views
Where to store JWT refresh tokens
Where to store JWT refresh tokens? My idea was to encrypt the refresh token with crypto-js AES and salt, keeping it in an environment variable (.env). Then, the refresh token would be stored in either ...
0
votes
1
answer
98
views
Is <img :src="require`${JSON.parse(string)}`"> in electron vue is safe from XSS?
I am inspecting a client's application written with Vue.js and I found there a following construction.
// Somewhere else in the code
var data = JSON.parse(jsonString);
// In the vue component
<...
- 101
0
votes
0
answers
60
views
Is there a way to prevent/detect DOM Clobbering in the browser?
It is possible to clobber document attributes, e.g.:
<img name="cookie">
...
typeof(document.cookie)
//=> 'object'
Is there any way to prevent this from happening, access the ...
- 1
1
vote
1
answer
446
views
XSS in document.write(location.href)
Let's say a website contains the following <script> tag and does not have a CSP blocking any execution here.
<script type="text/javascript">
document.write(location.href)
</...
- 113
2
votes
1
answer
340
views
Why don't Internet browsers allow me to fetch a JSON file from raw.githubusercontent.com, but they allow me to fetch .psm files from there?
When I was making my PicoBlaze Simulator in JavaScript, I added 6 examples of how to use it. Those examples are on my GitHub profile, they are the .psm (PicoBlaze Assembly) files. I decided not to ...
- 123
0
votes
0
answers
48
views
Are there any html Sanitizer() API configs that allow javascript execution?
I'm talking specifically about the HTML Sanitizer API: https://developer.mozilla.org/en-US/docs/Web/API/HTML_Sanitizer_API
The API allows you to configure the sanitizer with a list of allowed elements ...
- 101
0
votes
1
answer
86
views
What is the best way to validate third-party domains calling an API?
Our business is in the payment processing space and one of our core products is a Payment Gateway API. In terms of security we issue an API Key, Signature and RSA Encryption for sensitive information ...
- 103
0
votes
1
answer
174
views
Feedback wanted regarding how secure this encryption/decryption is
I am creating a Password Manager and I wanted to create a JavaScript function to encrypt/decrypt data in the client-side, then I will be saving the only the encrypted data in MySQL Server. To encrypt/...
- 9
1
vote
2
answers
450
views
Check if javascript in pdf is malicious
I used Didier Stevens's pdfid.py to check a pdf, and it found js and automatic actions associated with the pdf:
How do I check if this is malicious code?
- 23
0
votes
1
answer
69
views
XSS not executing properly
Instead of receiving Alert(XSS) I get [object Object]
The application is expecting a .csv file and the name of the file is being reflected. I put the original .csv file and then I remove it in order ...
- 11
2
votes
2
answers
400
views
When using double submit cookies as protection against csrf, does it matter where the random key is created?
I have a stateless backend and a spa-frontend. Except for the login request, all requests are secured by a jwt in the header.
Additionally the application should now be secured against csrf. Since the ...
- 121
0
votes
1
answer
155
views
Why does it seem like websites can still use JavaScript in Chrome after disabling JavaScript?
I have disabled JavaScript under "Site settings" in Chrome. That is, I selected: "Don't allow sites to use Javascript". After doing so, I encountered a webpage that somehow manages ...
- 1
1
vote
1
answer
106
views
JS bug is stopping my xss payload to exeute
The XSS vector is at the * but the function issue_type is not declared hence my payload is not getting executed.
following is the instance of the vulnerable code:-
<select name="sub_subissues&...
- 13
1
vote
2
answers
369
views
xss: is it possible to continue javascript code execution after a "throw new Error()" line?
there is this javascript file that a can inject code after throw new Error("error string") line. But it seems that after the throw statement, no code can be executed.
throw new Error("...
- 13
1
vote
1
answer
180
views
How is a XSS attack possible in this context?
I'm testing a website, which is vulnerable to XSS.
<input type="hidden" id="referer" name="referer" value="INJECTION_POINT">
<script>
document....
- 11
0
votes
0
answers
76
views
Can WebASM provide JavaScript style interactivity without the same vulnerabilities?
JavaScript is useful for interactivity. However, it is often disabled by security conscious browsers, such as the Tor Browser Bundle, and blocked with plugins such as NoScript.
I was wondering if it ...
- 715
1
vote
0
answers
285
views
force XSS after bypassing Request.Form using URL Encoding
I am testing a cross-site scripting attack on a website, as we all know the Request.Form function validates the input so the user couldn't insert a <script> inside the input.
My focus in this ...
- 11
0
votes
1
answer
136
views
Need help about how to generate the Key and Passphrase to encrypt/decrypt data (JavaScript)
I am developing a public website (with https) where each user is going to register and save confidential data, this data needs to be encrypted/decrypted only by the user. I need help to know how to ...
- 9
1
vote
1
answer
479
views
Storing encrypted password in database but decrypt it on the client side
Language used is Javascript.
For context, I am making a password manager where users can store different accounts of service and their passwords. The idea was to store multiple encrypted passwords in ...
- 11
1
vote
0
answers
412
views
Client-side Javascript injection by assinging the output of window.location.href.substr to a variable
Sample code:
function winLoad() {
var sessionId = '';
if (window.location == window.top.location) {
var semicolonIndex = window.location.href.indexOf(';');
if (semicolonIndex !=...
- 11
2
votes
2
answers
606
views
Can a client script (running within a webpage) provide to the browser a certificate to accept in a wss:// connection?
Can a client script provide to the browser a certificate to accept in a wss:// connection? The WebSocket constructor does not seem to have many options.
(I am designing an IoT server that lets the ...
- 379
1
vote
1
answer
64
views
javascript: how to apply block cipher to byte stream
I am writing browser javascript that has a pre-shared key with nonce, and creates a binary websocket connection. How can I apply block encryption-authentication such as AES-GCM to the messages?
Is it ...
- 379
1
vote
1
answer
60
views
Javascript: How to check SHA of fetched script before executing
To save money and/or reduce system complexity, I am hosting a script on a server that I don't fully trust. My trust issue might be with the server itself, or the PKI setup on it. The reason doesn't ...
- 379
1
vote
1
answer
179
views
How vulnerable are secrets kept in browser javascript variables?
Suppose my website handles sensitive data in the user's browser using Javascript:
let secret = decrypt (thing, ask_user("Password?")); // Global, or reachable via a global
EDIT: the secret ...
- 315
0
votes
1
answer
149
views
XSS in location.hash.match() function
I was solving a CTF. Just reading the source code of the web page, I found a vulnerable piece of code:
var r4c='(.*?)';
var results = location.hash.match('token\\('+r4c+'\\);');
I am unable to ...
1
vote
3
answers
266
views
How to build a PSK website
Pre-Shared Key (PSK) with simple symmetric encryption is a popular way of solving both client and server authentication when SSL cannot be used for some reason (for example, can't trust or deal with ...
- 379
2
votes
3
answers
212
views
Is Chrome's view-source dangerous when visiting malicious sites? [duplicate]
What are the risks of viewing the source code of malicious pages on Google Chrome?
I want to go directly to view-source:https://example-site.com to visit the sites without rendering anything malicious ...
1
vote
0
answers
142
views
Is this a LFI vulnerability?
I'm playing with uploads, so I'm wondering if this route is safe to use, because if you somehow break off from the md5 function path, then you can control the path (if in TypeScript null byte is a ...
- 13
0
votes
2
answers
205
views
Security vulnerabilities from storing anti CSRF token in global JS variable?
What are the security vulnerabilities arising from storing anti CSRF token as a global JS variable and use it for every requests made which need CSRF protection?
If there are any vulnerabilities what ...
2
votes
1
answer
198
views
What does COEP do that CSP doesn't already do?
Both Cross-Origin-Embedder-Policy and Content-Security-Policy seem to do pretty similar things: they restrict the document from loading certain types of subresources (e.g. cross-origin subresources). ...
0
votes
1
answer
261
views
Dom Clobbering methods on the document object
I'm struggling to understand how this flavor of dom clobbering actually works.
The green box at the top of this section of the HTML spec makes it pretty clear why I can access HTML elements as global ...
- 101
2
votes
2
answers
234
views
What could go wrong with this inlined javascript variable initialization in ASP?
I am currently reviewing an ASP application where this javascript initialization is used all over the place:
const someValue = "<% get_some_value() %>";
And this pattern is actually ...
-2
votes
3
answers
70
views
Does the SE login page need hardening against third party javascript?
Closely related to the Meta question
Can Google and Cloudflare find my SE password?
In short the SE login page loads javascript from Google and
Cloudfare.
I believe the javascript has full access to ...
- 105
1
vote
0
answers
39
views
Can the data between Express.js middleware be manipulated/tampered in any way?
In the node.js express.js framework there is middleware support. Let's assume I have two middleware - the first one, which verifies whether the JWT token is legit and not tampered with and the second ...
- 244