Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [javascript]

The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

0
votes
0answers
13 views

Limit access to properties objects when using object[x] accessors

From the OWASP cheat sheet on preventing DOM-based XSS, Guideline #8 reads the following: Limit access to properties objects when using object[x] accessors (Mike Samuel). In other words use a ...
1
vote
2answers
84 views

How to exploit XSS vulnerability through an iframe

Recently, I found a stored cross site scripting vulnerability in a rather large website, but I am not sure if it is dangerous or worth reporting. On this website, there is a resource section that is ...
2
votes
1answer
74 views

Is it safe to let the user name an object key in JavaScript?

Recently I found a piece of code that takes input from the url. The input then get's saved into a javascript object: https://website.com/?foo=bar var x = {"foo": "bar"}; While the value doesn't ...
0
votes
1answer
55 views

Is my checkNumber() function secure?

function checkNumber(number) { event = document.all ? window.event : number; key = document.all ? event.keyCode : event.which; window.event.keyCode if(key<48||key>...
0
votes
0answers
36 views

XSS vulnerability [closed]

I have a html page and a segment of PHP code. I know that is vulnerable to an XSS attack but I don't know how to perform the XSS attack. HTML <!DOCTYPE html> <html> <body> <h1&...
0
votes
0answers
43 views

How to bypass character filtering in XSS?

I am solving XSS challenges. I found difficulty in one that filters the character "o" both uppercase and lowercase. I can run tag. I have to call function "prettyRobot" to complete the cahllenge. But ...
1
vote
1answer
58 views

iframes, user generated content and scripts

Currently, we have a small personal project which is meant to allow people to create 'profiles' in HTML/CSS. We aim to put all this generated content within a sandboxed iframe. The next point in ...
0
votes
0answers
28 views

What are the risks with leaving the offending anchor portion of an URL in a failed client-side XSS attack?

As a simple example, let's assume that I have implemented a key-value lookup within a pre-populated, static JavaScript dictionary. Let's say that the dict is: a = { 'one': 'uno', 'two': 'dos' }; The ...
1
vote
1answer
123 views

Bypass a simple XSS filter that only looks at <

Say, I have a page where the input from the user is taken and is passed through a simple client-side XSS filter. That filter only replaces < characters with ''. in = in.replace(/[<]/g, ''); ...
1
vote
0answers
47 views

Persistent HTML form data across sessions

I'm currently testing an application which appears to have a somewhat persistent HTML form data storage, yet I don't understand how. UserA logs in Fills form with custom data Logs out before sending ...
0
votes
1answer
77 views

Is it possible to bypass this Xss Filter?

Everyone, I was creating this XSS filter for my node plugin and I want to know is it possible to bypass this? function xSSFilter(str) { return str .replace(/&/g, '&amp;') ...
0
votes
0answers
32 views

Finding hidden parameters manually for XSS

I am researching about XSS and Google helped me a lot about learning like how to bypass XSS filters, POST and GET based XSS . I am really curious to know how to find hidden parameters manually for ...
0
votes
2answers
50 views

Is eval() in JavaScript considered self-XSS?

I found eval() in the JavaScript code of a site in HackerOne. I could not find the where the function is called, so to test the vulnerability I went to console in Chrome and wrote the method and a ...
1
vote
2answers
50 views

Text field exploit

If a web application form contain few textbox fields. Among one should accept only 4 digit according to business logic. But it's taking more than 4 digit values. Is there any potential vulnerability ...
0
votes
1answer
59 views

How Hathaway ISP shows renewal reminder in non secure website?

I am using prepaid broadband plan of Hathaway (in India). Few more days are left for the plan to get expired and I observed the below screenshot. This popup comes only when I visit any non-secure ...
-1
votes
0answers
69 views

Deobfuscation Malicious Javascript Codes

I want to deobfuscate malicious code where they are embedded in the URL. I have these URLs downloaded from here, where the URLs are embedded with malicious JavaScript. URL
1
vote
0answers
55 views

Reduce form spam without external dependencies or false positives

I'm working on a Java Spring with a team and have been facing form spam issues. We are seeing a large number of requests that use generated & falsified information (ie everyone's names are generic,...
1
vote
1answer
46 views

Stealing page source via Clickjacking [closed]

I am learning Javascript. Also researching web based vulnerabilitys to learn. I just wondering how Javascript can be used to steal view page source or any text or any tokens leaking on the page via ...
-1
votes
1answer
96 views

Can running javascript from the console be considered as XSS?

I did it from the console. Is this a security issues?
0
votes
1answer
49 views

DNS Spoofing Detection with JavaScript

I've came across an interesting question today - how can a JavaScript detect that a DNS Spoofing attack has been made against the client its running upon? Scenario: Edit: wrong scenario was ...
0
votes
1answer
28 views

How to filter HTML Event in Native PHP7

i want to creating xss filter for my own project, this is for html event filtering preg_replace("/ on\w+='[^']*'/i", '', preg_replace('/ on\w+="[^"]*"/i', '', $framed)); but considering to more ...
0
votes
1answer
196 views

Random Chrome Notifications and Strange Source Code

My elderly parents are receiving chrome notifications from a strange URL on their iMac: (https://s1.snc.com.ru:443) Example Messages • Pending Payment: Paypal Has Sent You $65,900 • Clean your mac....
1
vote
0answers
78 views

XSS and CSRF Protection in a SPA with session cookies and auth in sub-domain (confused)

The problem is, that the more I read about XSS and CSRF and the protection against these attacks for my website, the more I get confused what would be the right strategy. Setup: SPA (Reactjs and ...
1
vote
1answer
45 views

XSS using SVG: Is AllowScriptAccess attribute ignored?

I was experimenting with some Anti-XSS solutions, and during my research, I found following the XSS vector in a cheatsheet: <EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH ...
1
vote
1answer
74 views

Content Security Policy: postMessage into foreign iframe

Assume we have a webpage with sensitive data. The page uses a marketing partner advertisingpartner.com which collects data via third-party cookies in a foreign iframe. We have applied a relatively ...
2
votes
0answers
58 views

Sandboxing untrusted JavaScript execution by redeclaring variables

Some irrelevant background (read only if you want to say "no, just use an iframe") Scenario Suppose that I downloaded a string jsCode containing arbitrary JavaScript code from a (potentially ...
0
votes
1answer
54 views

Custom JavaScript injection allowed in DOM of other origins [closed]

I am performing a security research on a development framework for thick client & mobile applications. The framework allows developers to inject custom JavaScript in the DOM of any origin. This ...
0
votes
0answers
37 views

Javascript code instead of requested page

I am trying to access a third party website. For one of the requests, the browser displays some source code instead of rendering the response. Does this come under security issue? The source code has ...
35
votes
4answers
9k views

What is formjacking?

I just heard a very confused news broadcast about Symantec warning the world about the dangers of formjacking. The newsreader said it involved “hacking the form, not the website” whatever that means. ...
1
vote
0answers
53 views

How to start with javascript engine exploitation [closed]

I am beginner in exploit development. My experience is developing buffer overflow exploits and shellcoding. Now I want to begin with javascript engine exploitation. 1.What are five papers, books, ...
2
votes
1answer
58 views

What's stopping attackers from using our API keys to spam our logging services?

We're logging user events using Javascript and a third-party logging service. The API key is hardcoded in JS. The logging service restricts the API key to our domain. I'm assuming it looks at the ...
1
vote
1answer
83 views

Does CSP block javascript in <a href> tags?

I recently discovered that its possible to run javascript from an <a> tag like this <a href="javascript:alert('test')"> and this gets run on the current page when clicked. It also seems ...
0
votes
0answers
84 views

Is this script vulnerable to xss? If yes, how can i get an alert box?

I think this code may be vulnerable to dom based xss but i wasn't able to get an alert box. I am able to control the userTitle field, i tried using </script> but it get changed to u003c/...
0
votes
0answers
25 views

JS window.confirm cross domain security?

I have wrote an assignment for a course I am studying regarding social plugins like what you get with Facebook/Twitter, etc. With these platforms the user is directed to a seperate tab/window to ...
0
votes
2answers
421 views

Prevent javascript cross-origin redirect by window.location.href

Following this question, is there a way to prevent this code from redirecting users to domains not whitelisted? const form = document.getElementsByTagName('form')[0]; form.addEventListener('submit', ...
0
votes
1answer
105 views

Do I correctly understand how CORS proxy works?

There are a lot of CORS proxy servers like this one: https://cors-anywhere.herokuapp.com/ This allows us to send requests from different origins. For example I can send request from my client's ...
0
votes
0answers
31 views

Best way to take javascript code as input from customer and use them on site

I am working on a SAAS app with multiple customers, on their admin panel they have option to add code to add in header. This is a textarea which can take javascript code as input and then this code ...
-1
votes
2answers
94 views

Can the following hash technique be reversed? If so, would it be difficult?

I was wondering if the following hashing technique can easily be reversed? If someone got hold of the hashed value, can he/she reverse it? Partiuclarly I'm talking about the following code: ...
0
votes
1answer
57 views

Password managers, how do they get the credentials when you press enter?

I was wondering how password managers (most of the at least) automatically prompt to save my username and password credentials after inserting them into any site. I mean I am not first putting them ...
2
votes
3answers
118 views

Returning POST JSON data securely?

I have a webpage (HTTPS encrypted and authorized only via domain credentials) that displays grid information. This grid information is received via a POST request to my server which will send back ...
0
votes
1answer
38 views

How are these transaction fingerprints colored?

For those unfamiliar, blockchains have two main types of data structures propagated in their networks: blocks and transactions. Each block and transaction has a hash, just like key fingerprints. The ...
1
vote
1answer
97 views

How can CSRF POST happen?

I realise this is a newbie question but when it comes to this im clearly that. On a browser, assuming one received a cookie from site A. Then a different site B makes a call to site A through it's ...
1
vote
0answers
53 views

How can user send malware code via input=file

After the file is uploaded via input=file it is converted to b64 standard. But what is the exact path the file is going through and where in javascript code we can catch that uploaded file. And if I ...
0
votes
1answer
42 views

How do JavaScript (and mobile) APIs keep user data clean?

Let's say we're running Google Analytics, and we're tracking user specific data (or displaying contents based on that data, such as most recently viewed pages) -- we add a pixel, and then we pass the ...
3
votes
3answers
180 views

Are jQuery vulnerabilities exposed by the file being served from the server of by usage of the vulnerable code?

I've recently been asked to update a legacy web application, installed on numerous client servers, to use the current version of jQuery 3.3.1, rather than 1.10.2 which has a number of vulnerabilities. ...
1
vote
2answers
85 views

Why do browsers disallow accessing files from local file system even if the HTML document is also on the local file system?

Many browsers do not allow you to access files on the local filesystem with JavaScript (even if the HTML document is also on the local filesystem). (source) Yes I know that the solution is to "...
-1
votes
2answers
272 views

Is it safe to eval JSON?

I know JSON is supposed to be a notation that can otherwise function as direct-code to evaluate Javascript? But is that so? There is a function I know about and use when I must, JSON.parse. It's the ...
1
vote
2answers
61 views

How to make Location header invalid, on 3xx redirect resulting in showing HTML

I came accross vulnerability where i can breakout in html body on 3xx redirect, my problem is that Location header is executed first means that html body is ignored. <a href="https://example.com/"[...
0
votes
1answer
246 views

XSS code not fetching back script

I am doing a XSS challenge on HTB and have run into an issue. I have the unvalidated field that is vulnerable to XSS and so far I have got the below line to successfully call back to a python server ...
1
vote
0answers
181 views

Android WebView JavaScript Enabled

I recently found an Android application, which uses a WebView with enabled JavaScript. In this webview I am able to browse from their provided FAQ page to twitter, and from twitter basically ...