Questions tagged [javascript]

The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

0
votes
1answer
42 views

Should I use ReCAPTCHA v2 or v3?

I've seen lots of SO posts and other articles on the internet about the differences between Google's ReCAPTCHA v2 and v3, but I'm not sure which one I should use. I'm looking to protect my website's ...
0
votes
1answer
72 views

Why are js libraries designed to be loaded in iframe?

I am developing a JavaScript library which users would include in their website. a common theme across 3rd party libraries is that they are loaded in a n iframe. (ex you tube) . Is there any specific ...
-1
votes
0answers
39 views

How can I execute my JS payload?

So basically, I am trying to get my JavaScript scripts to work but due to the server-side filters such as htmlspecialchars it keeps failing. Our input is placed between this block of code: <div ...
3
votes
1answer
63 views

javascript eval() clarification

I've read this article about eval security issues. I need a clarification about this particular situations: For example, imagine we had a web app with a text field input that we were running eval()...
0
votes
0answers
42 views

Browser to remember Camera selection, without the browser setting but through a cookie set [closed]

I am developing a website, for the employees, they must take a picture of themselves. How can you avoid browser from keep asking whether to allow to access to camera: Even if you change the browser ...
-2
votes
1answer
125 views

How to protect my site from XSS

I own a chat site {https://trixac.com}. It uses BoomChat's code. Recently I banned a troll and now he is back and hes running XSS injections against my site and it's working for some odd reason. I've ...
1
vote
1answer
92 views

CSP: What is script-src-attr and script-src-elem?

script-src-attr and script-src-elem directives are new additions in CSP3. I am not able to understand how are they different from the script-src directive. https://w3c.github.io/webappsec-csp/#...
0
votes
1answer
61 views

java script in link href=“javascript:alert(1)”

In an app I am testing they allow to input a domain name, store it, and when they print it on the browser they concatenate "http://" at the beginning of the domain. So, if you input "google.com", then ...
0
votes
1answer
172 views

Is security by obscurity / obfuscation a valid option, or do the crawlers have JavaScript enabled?

I'm creating a new website, so I am thinking about how to protect my email address and phone number against crawlers, I actually mean email harvesters (most of which I suppose don't have JavaScript ...
0
votes
1answer
44 views

Bypassing valid certificate requirement for websockets

I'm attempting to connect to a websocket server hosted in C# using SuperWebSockets from a page. The issue is that the websocket server generates a self-signed certificate making it difficult to ...
1
vote
4answers
129 views

can XSS attacks be nullified by prepending a backward slash to all external links?

In my website I noticed my developers had set it up so certain form data was past from the URL to the content of the website. E.G ?email="email" The obvious vulnerability means that I can put ?email=...
3
votes
2answers
92 views

How to chain XSS payloads?

I found a parameter on a website that is vulnerable to XSS. The website is a game and the parameter in question is the name of a player team. However, the parameter is limited to only 20 characters. ...
0
votes
1answer
86 views

Do URLs used in JavaScript AJAX GET calls need to be sanitized through Apache when there is no server side scripting or database involved?

I am aware that any data coming into a server from a client should be handled safely (as in sanitized, whitelisted, etc.) but I had slapped together a very simple system that pulled file contents ...
-2
votes
1answer
69 views

Inspect Element Prevention?

I was just actually wondering if there is a permanent way of preventing or disabling inspect element on client-side? Assuming with inspect element you could change values in hidden forms as well as ...
9
votes
1answer
1k views

Sucuri detects malware on wordpress but I can't find the malicious code

Yesterday I got a report asking us to check some wordpress website because the person's antivirus blocked said web. I ran the Sucuri Site Check and it indeed detects malware: "Known javascript ...
1
vote
1answer
105 views

Presistent XSS Filter Bypass Question

I was testing out a stored XSS on a test site I made which is vulnerable so the problem is when I tried executing the usual "><script>alert('XSS')</script> It did not work instead. But ...
2
votes
1answer
72 views

How to deal with prototype pollution attack vulnerability in lodash?

lodash has been reported to be vulnerable to the so called prototype pollution attack in versions up to (excluding) 4.17.5 See https://nvd.nist.gov/vuln/detail/CVE-2018-3721 Now lodash is the most ...
1
vote
1answer
85 views

Can this be turned into dom xss? [closed]

I am testing a bug bounty website and i reached a support ticket creation functionality. I registered with email address {{15*15}}@testemail.com. I created a ticket but when i try to open the ticket i ...
0
votes
0answers
28 views

Implementing OAuth 2 refresh token rotation on web clients

I'm looking to implement refresh token rotation for unauthenticated clients of my OAuth 2 provider. Things are all implemented on the server side, but I'm concerned that web clients will be unable to ...
1
vote
1answer
94 views

How Recaptcha Detect Fake User-Agent

I'm trying to understand how can recaptcha__en.js detect fake User-Agent, for the test you can try the demo here with addon User-Agent switcher installed, for logged in user it will get score 0.9 no ...
0
votes
2answers
88 views

Cross Site Scripting href=/\evil

I've seen <base href=/\evil> and <base href=//0> as a vector to use XSS. Could someone make an example using these vectors and explain me if "/\" is the same as http:// or has some ...
1
vote
1answer
48 views

Why is not checking the origin of postMessage insecure?

Typically, within the onmessage handler, you would have something like this: window.onmessage = function(e) { if (e.origin != "www.example.com") return; //Do stuff }; The check for e....
0
votes
0answers
40 views

jQuery-1.11.0 xss p0c

I have a web application at the workshop that uses the old jQuery-1.11.0 library, where jQuery.globalEval (text); hence every text/javascript responses gets executed, and in my case it looks like: &...
1
vote
1answer
83 views

How to hide my platform from a browser to keep my privacy? [duplicate]

I just visited https://amiunique.org/fp in order to try to understand what makes a web page realize what platform it is running on, aside from User-Agent request header. So I learned about window....
6
votes
1answer
137 views

Information obtained from executing Javascript math functions in browser

I came across interesting piece of javascript across few sites. It's executing Javascript math functions such as abs, acos, random etc. thousands of times - or four thousand times in my case, though ...
0
votes
0answers
82 views

JS keylogger listening to what is being typed in an iframe?

Having discovered the X-Frame-Options sameorigin that stops a website from being shown in a iframe, I am trying to understand how far not having this header can go. What I am not sure about is if it'...
-1
votes
2answers
85 views

Why do so many websites use third-party sites for hosting JavaScripts?

Why do so many websites serve JavaScripts from ajax.googleapis.com and other third-party sites? Wouldn't it be securer for these sites to host these scripts themselves?
0
votes
2answers
123 views

How hackers manage to run javascript code in webform

How hackers manage to input malicious code into web applications and most websites? I'd like to say that it is rare of websites to have the JavaScript function eval() on their website's code.
0
votes
0answers
31 views

secure deployment of react application

Im trying to deploy an application build using react and i wanted to know what all security measures i need to take while pushing to production. I ran npm run build command and i got the build folder ...
0
votes
1answer
110 views

Is stealing the HTTP Basic Authenication header possible via CSRF?

Recently I've been trying to find a way to steal HTTP Basic Authentication credentials via CSRF. For example, if a site is using basic authentication is it possible for an attacker to grab the ...
2
votes
1answer
83 views

Is it possible to fake the data sent to an analytics server?

Let's assume I have a google analytics server tracking the users on my website. Is it possible, for a user to send fake data through the analytics? To be clear, I'm not asking whether we can detect ...
0
votes
2answers
130 views

XSS in HTML class tag with only double quotes escaped

I am currently testing XSS filter and I wonder, whether it is possible to demonstrate XSS attack on class tag attribute in HTML, when only double quotes are escaped. Other characters (<, >, ') are ...
0
votes
0answers
66 views

Server Side Template Injection for EJS template in NodeJS

I'd like to create a Web-App with Server-Side Template Injection vulnerability in NodeJS. The template used in the Application is EJS with Express-Framework. Below are the code bits: index.js (...
0
votes
0answers
32 views

Limit access to properties objects when using object[x] accessors

From the OWASP cheat sheet on preventing DOM-based XSS, Guideline #8 reads the following: Limit access to properties objects when using object[x] accessors (Mike Samuel). In other words use a ...
1
vote
2answers
278 views

How to exploit XSS vulnerability through an iframe

Recently, I found a stored cross site scripting vulnerability in a rather large website, but I am not sure if it is dangerous or worth reporting. On this website, there is a resource section that is ...
2
votes
1answer
100 views

Is it safe to let the user name an object key in JavaScript?

Recently I found a piece of code that takes input from the url. The input then get's saved into a javascript object: https://website.com/?foo=bar var x = {"foo": "bar"}; While the value doesn't ...
0
votes
1answer
65 views

Is my checkNumber() function secure?

function checkNumber(number) { event = document.all ? window.event : number; key = document.all ? event.keyCode : event.which; window.event.keyCode if(key<48||key>...
0
votes
0answers
93 views

How to bypass character filtering in XSS?

I am solving XSS challenges. I found difficulty in one that filters the character "o" both uppercase and lowercase. I can run tag. I have to call function "prettyRobot" to complete the cahllenge. But ...
1
vote
1answer
90 views

iframes, user generated content and scripts

Currently, we have a small personal project which is meant to allow people to create 'profiles' in HTML/CSS. We aim to put all this generated content within a sandboxed iframe. The next point in ...
0
votes
0answers
29 views

What are the risks with leaving the offending anchor portion of an URL in a failed client-side XSS attack?

As a simple example, let's assume that I have implemented a key-value lookup within a pre-populated, static JavaScript dictionary. Let's say that the dict is: a = { 'one': 'uno', 'two': 'dos' }; The ...
1
vote
1answer
272 views

Bypass a simple XSS filter that only looks at <

Say, I have a page where the input from the user is taken and is passed through a simple client-side XSS filter. That filter only replaces < characters with ''. in = in.replace(/[<]/g, ''); ...
2
votes
0answers
65 views

Persistent HTML form data across sessions

I'm currently testing an application which appears to have a somewhat persistent HTML form data storage, yet I don't understand how. UserA logs in Fills form with custom data Logs out before sending ...
0
votes
2answers
128 views

Is it possible to bypass this Xss Filter?

Everyone, I was creating this XSS filter for my node plugin and I want to know is it possible to bypass this? function xSSFilter(str) { return str .replace(/&/g, '&amp;') ...
0
votes
0answers
46 views

Finding hidden parameters manually for XSS

I am researching about XSS and Google helped me a lot about learning like how to bypass XSS filters, POST and GET based XSS . I am really curious to know how to find hidden parameters manually for ...
0
votes
2answers
91 views

Is eval() in JavaScript considered self-XSS?

I found eval() in the JavaScript code of a site in HackerOne. I could not find the where the function is called, so to test the vulnerability I went to console in Chrome and wrote the method and a ...
1
vote
2answers
66 views

Text field exploit

If a web application form contain few textbox fields. Among one should accept only 4 digit according to business logic. But it's taking more than 4 digit values. Is there any potential vulnerability ...
0
votes
1answer
78 views

How Hathaway ISP shows renewal reminder in non secure website?

I am using prepaid broadband plan of Hathaway (in India). Few more days are left for the plan to get expired and I observed the below screenshot. This popup comes only when I visit any non-secure ...
1
vote
0answers
57 views

Reduce form spam without external dependencies or false positives

I'm working on a Java Spring with a team and have been facing form spam issues. We are seeing a large number of requests that use generated & falsified information (ie everyone's names are generic,...
1
vote
1answer
51 views

Stealing page source via Clickjacking [closed]

I am learning Javascript. Also researching web based vulnerabilitys to learn. I just wondering how Javascript can be used to steal view page source or any text or any tokens leaking on the page via ...
-1
votes
1answer
137 views

Can running javascript from the console be considered as XSS?

I did it from the console. Is this a security issues?