The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

learn more… | top users | synonyms

0
votes
0answers
10 views

Meta tag and Script processing inside URL [on hold]

I originally posted this question at http://stackoverflow.com/questions/37016118/meta-tag-and-script-processing-inside-url, and I am posting these here as people that check questions here have more ...
-2
votes
1answer
47 views

How to check out downloaded scripts on backdoor? [on hold]

How to check out downloaded scripts (PHP mostly) on backdoor? Even if there is tool to check out domains, they can be hided and encrypted, and time out for pinging to the hacker's center is maybe ...
-9
votes
2answers
68 views

Noob to tor/tails/darknet…forgot to disable Javascript. What to do now? [on hold]

I am a noob as stated in title. I didn't know how to disable Javascript before visiting some not-so-legit sites. So what can I do? I was using tor, I know this is not enough so I have tails ring a ...
2
votes
1answer
46 views

How and why does case insensitive XSS work, given that JavaScript is case sensitive?

I found a lot of instances where XSS scripts like the following work: <iMg SrC=x OnErRoR=window.location=123> Given that JavaScript is a case sensitive language, how is the browser able to ...
0
votes
0answers
22 views

Executing JS script in Bootstrap popover without “<” and “>” characters (XSS) [duplicate]

In the system that I am working on I have a simple form. In the form there is an input called "ID". The contents of the input is than displayed in a Bootstrap popover (after clicking the "i" icon) ...
1
vote
1answer
151 views

What is the Javascript trying to do/exploit? [duplicate]

I found the following javascript in a .zip attachment to an email. (Said zip file was opened on a new KVM virtual machine with none of my data on it while running an Ubuntu LiveCD session. Just to be ...
1
vote
1answer
50 views

Client-side encryption using public-key

My situation: Login password from a POST request is left in browser memory in clear text as long as cache is not cleared (manually/closing browser). Connection is HTTPS. Possible Solution: ...
13
votes
2answers
477 views

Advertisement on Skype tried to download a file to my computer using Javascript

I usually have Skype running in the background. If you have ever used Skype before, you probably know it has advertisements. One of these advertisements made two windows pop up on my screen, asking to ...
4
votes
3answers
96 views

Recent hack appends to all javascript files

I have about 10 websites hosted on shared server by a2hosting, on apr 20 some of the js files for some of the websites were appended with a function that detects the device and if it is mobile it ...
-5
votes
0answers
8 views

What is i.ipricejs.info script after body tag in my page? [duplicate]

I am running one programe in my localhost. and found below script added automatically. <script ...
3
votes
1answer
90 views

Is it possible for XSS to occur in src attribute?

I'm working on XSS vulnerability and understanding it. I know in following cases cross site script injection happen in Javascript context Inside <script> tag. Inside html tag in event handler ...
2
votes
0answers
37 views

Prevent external script from loading using Burp

I am using free edition of Burp Suite to analyze some requests. Suppose, website is https://www.example.com. Now, there is a javascript file in https://www.example.com/templates/scripts/xyz.js. I ...
-2
votes
1answer
76 views

Clicking a lot of website links in Google Maps, then sent through multiple URL redirects, and lastly to a page that made my laptop start beeping?

I was in Google maps clicking on all the website links listed in the side panel, looking at every website really fast. Note, they were all tattoo parlors. One of the links I clicked bounced me through ...
3
votes
1answer
128 views

Does the use of JavaScript make ProtonMail insecure?

I like the look of ProtonMail. However, what has stopped me from signing up is that JavaScript seems to be used at various points in the site, and for someone to read your email they must click on a ...
-1
votes
1answer
82 views

What is this script supposed to do?

I just got a sketchy email to my University email. There was a zipped folder, containing, a lone js file. It reads: var ...
1
vote
0answers
64 views

Security flaws while storing auto-login token

I must to accomplish auto-login with a token on my website. Token is generated on back-end, on front-end (Single-Page Application) I have to store token in secure way. I'm using secured channels ...
2
votes
2answers
67 views

Security feature: Preventing javascript from closing the window

The latest versions of most web browsers have implemented a feature to prevent javascript from closing current window or tab. Firefox window.close() method This method is only allowed to be ...
6
votes
2answers
188 views

Is this a Javascript virus?

So I got a random email saying this. Looks very automated: "How are things? I was visting your website on 4/9/2016 and I'm very interested. I'm currently looking for work either full time or ...
0
votes
3answers
53 views

Typical 'search box' XSS attack

When I develop a site, I'm always conscious of security flaws, but I'm struggling to see how a search box could ever be used to inject script that could be ran on a page of mine. So I understand ...
0
votes
2answers
60 views

What are the possible security issues when making a checkout system in Javascript?

I'm pretty new to JS and I am currently making a simple step-wise checkout system using purely JS and some Ajax and PHP. I have been wondering about the possible security issues that might pose with ...
1
vote
0answers
45 views

How to remember the trusted machine in an application

We need to remember trusted devices in our application. I have done some R&D for this and found out that Facebook achieves this using cookies. But, if I see Google, they don't use cookies, I ...
2
votes
1answer
62 views

Is JavaScript needed for browser code execution vulnerabilities?

Does JavaScript VM have to enabled in a vulnerable browser to exploit an arbitrary code execution bug? There is a number of bugs in borwsers that don't seem to involve JavaScript. For example, ...
1
vote
0answers
24 views

Authenticate with ADFS without Javascript?

I'm trying to allow a search engine that doesn't support javascript to crawl content protected by ADFS. Is there a way to allow clients that don't support javascript to authenticate to an ADFS ...
21
votes
2answers
3k views

Can javascript execution from address bar cause any harm to client's machine?

Given the fact that modern browsers these days prohibit JavaScript from having access to any resources on the client's machine, does JavaScript execution from the address bar pose any threat at all to ...
0
votes
1answer
88 views

What are these links that have been sent to me multiple times on facebook?

2 friends of mine have sent me very suspicious links on facebook, which ask me for credentials on an external site. Entering hello@example.com in the username, and 1234 for the password let me in, and ...
0
votes
1answer
44 views

Malicious tracking script being served from google server to circumvent block lists

I've found some bad JS that tries to open pop-unders and even deliver a likely malicious SWF file for a flash exploit. Thing is, its stored on a google server in a directory it really shouldnt be. ...
-3
votes
2answers
65 views

How to find Use-After-Free vulnerbilities? [closed]

I followed a lot of tutorials about the exploitation of UAF vulnerabilities, but there was never explained how to find and detect uaf vulnerabilities in javascript or html (i.e. with a static analysis ...
0
votes
2answers
45 views

Is there a server/website specific malware scanner? [closed]

I have multiple Linux CentOS servers that are scanned with the Google Webmaster Tools, and when it finds some malicious code on my servers(shared/dedicated), the ranking of those site drops. What I am ...
3
votes
3answers
234 views

How To Prove That Client Side Javascript Is Secure?

Imagine that you have a web application that encrypts the user's data, such as a note or spreadsheet, on both the server and client. The normal process for a user using this web application is ...
3
votes
1answer
171 views

How to get TOTP password with hmac sha 512 as hashing function?

ive never learned about javascript and network security before, but lately ive taken on some programming challange but i have to send my project link via http post request, and i have to figure the ...
4
votes
2answers
107 views

Why are cookies considered more secure against XSS?

This article discusses storing session tokens in a cookie vs in localStorage: https://stormpath.com/blog/where-to-store-your-jwts-cookies-vs-html5-web-storage/ The article states: Cookies, when ...
57
votes
6answers
9k views

Anonymous surveys that aren't so anonymous

In the past I have completed an 'anonymous' survey at work only to find that my employer was able to garner a lot of not-anonymous information from this survey. Location, name of manager, etc. None ...
0
votes
2answers
49 views

Can I safely store my admin scripts in a publicly available script file?

On a project I am working on I have all javascripts mixed together in all.js. I have a separate file, admin.js that contains scripts used on the admin section of the project. This file is only ...
4
votes
4answers
74 views

Would an official <disablescripts> HTML (6?) element/wrapper combat XSS effectively?

Would it not be possible to use such a method to wrap areas where user input/output is expected (eg. comment boxes), so that even if a script is successfully injected through regex evasion, the script ...
1
vote
0answers
101 views

Securing a JavaScript Single Page App with SAML

I would like to secure a JavaScript Single Page App with SAML. My server is powered using Node.js and serves a RESTful API. What are my options? Details: I have worked with OAuth2 in the past, but I ...
2
votes
2answers
54 views

Javascript videoplayer attack vectors [closed]

My team is building a Javascript-based video player for our own platform, instead of relying on other already available options like video.js. I'm wondering which attack vectors should I take into ...
0
votes
1answer
36 views

Is it possible to use CSP for a Javascript-based video player?

Some of my workmates are developing a video player using Javascript. AFAIK, we are not going to have any website. The clients will connect to the server, download the javascript code and then render ...
0
votes
1answer
16 views

Disabling post-pageload http requests to account for XSS

I have a website where JavaScript is used to process sensitive data (chat messages) on the client side. No communication is done with the server or any other service after the initial page load. It's ...
41
votes
5answers
5k views

What's the danger of having some random, out of my control, JavaScript code running on my pages?

My website pages reference some JavaScript code from a third-party CDN (analytics, etc). So I don't control what code is there - the third party may change those scripts at any moment and introduce ...
-4
votes
1answer
97 views

How to decrypt this javascript code [closed]

I can't decrypt it. Please advise me. javascript code var ...
3
votes
1answer
103 views

JS snippets on my live project do not appear in my code residing on my production server

I have a Django website project that is live (let's call it example.com). It's a forum where users can submit comments and reply to them. It has a Postgresql database, and gunicorn + nginx reverse ...
0
votes
1answer
77 views

xss bypass for javascript elements filtered as [removed]

If we write test ">script>alert(1)/script>, application is filtering the JavaScript with test">[removed]alert(1)[removed]. And payloads like onmouseover,onmouseout are skipping. In this ...
0
votes
0answers
39 views

Encoding payloads for GWT version 7

I'm auditing a website built with Google Web Toolkit. It uses serialization version 7, so the tools from GDS Security won't work (they only work till version 5). Using this technique I got all ...
0
votes
0answers
41 views

Should javascript and css “.map” source maps be included on production servers?

Source maps are a convenient way to work with directly with code that has been obfuscated and/or minified, yet trace errors back to the original "pretty" code. My understanding is that obfuscating ...
0
votes
1answer
232 views

Accesssing cookies of another domain using Iframes and Javascript

Using Iframe we can embed webpages of another domain provided the X-Frame-Options isn't set to SAMEORIGIN. This also loads the cookie inside the iframe. Now, one can access this cookie if it's in the ...
-1
votes
2answers
33 views

Considerations for a Web Based Secure Questionnaire System

I am about the start working with my degree project, which is related to Secure Questionnaires. I am currently doing research about how to develop a web based system which requires the users to login ...
2
votes
1answer
70 views

Break out of JavaScript data context to perform XSS when backslash and quotes are replaced?

Suppose I have a this on my site: <script> var x = "<? echo unsafe_data; ?>"; </script> This is obviously vulnerable to XSS. Now suppose I "clean" the unsafe data by replacing \ ...
1
vote
8answers
3k views

How to avoid reveal password in a form?

I've recently discover that if you use inspect element to see the source code of the Html, you can change this <input type="password"/> to <input type="text"/> then you can see the ...
5
votes
1answer
89 views

Does prefetching/preloading in web browsers pose a security risk?

Today I googled the name of a domain that was reportedly serving up malware. My search results came up (with the compromised domain at the top of the list) and within seconds my AV gave an alert ...
1
vote
3answers
53 views

Security implications of FileExists() from javascript in browser

What would the security implications be if JavaScript, in a browser, could perform a typical FileExists() operation with normal file paths (win and/or mac)? Something like Node's fs.existsSync(path) ...