Questions tagged [javascript]

The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

Filter by
Sorted by
Tagged with
0 votes
1 answer
22 views

What other methods would an attacker use for making an HTTP request that isn't Fetch() or an XHR or using the DOM?

We are running user-submitted JavaScript, server-side to be executed within a headless browser that doesn't have a DOM or any child of the window or document or location objects - because these are ...
user avatar
  • 46.8k
1 vote
0 answers
26 views

Need for URL encoding in XSS / CORS lab

I am doing one of Portswigger's labs on web security, specifically CORS (cross origin resource sharing). I am having trouble understanding why there is a need for URL encoding certain parts of the XSS ...
user avatar
  • 11
0 votes
0 answers
38 views

How does this script break out of a javascript tag?

How does putting the alert function '-alert(1)-' into a search field, where it ends up inside a script tag actually break out of the script string? Wouldn't this just be interpreted as an empty string ...
user avatar
0 votes
1 answer
36 views

portswigger Lab - Reflected XSS into HTML context with most tags and attributes blocked

I am busy with the portswigger lab studies, doing "Reflected XSS into HTML context with most tags and attributes blocked". I successfully fire the print() on myself and the simulated victim, ...
user avatar
  • 1
0 votes
0 answers
48 views

XSS against jQuery PortSwigger challenge

I am trying to do this jQuery XSS challenge here by PortSwigger. They have a good walkthrough for XSS attacks, however I could not find anything on jQuery, which is also a programming language I have ...
user avatar
1 vote
0 answers
80 views

What is the value of no paste text boxes for bank web sites?

HSBC Bank plc (UK) has a OTP system to confirm online payments via SMS. The 6 figure number is sent to the user who enters it into the website. Sometimes the cards registered email address is ...
user avatar
  • 111
0 votes
1 answer
53 views

Is this SQLi or XSS? (or both/neither)

I'm trying to get the hang of SQLi and XSS, and I am starting to get the hang of it. However: in my lab I made this: ignore'"; UPDATE users SET name=<script>alert('Malicious activity')</...
user avatar
-1 votes
0 answers
37 views

Best way to store user input that has HTML tags and <script> tags and display it on client side as is but still being safe from mainstream attacks

I am new to web security, and I need your help in confirming things. As the title says, I am looking for and researching for a safe way to take in user input that may contain special characters/HTML/...
user avatar
0 votes
0 answers
33 views

Is There Any Security Risk to Opening an Official JavaScript File in Command Prompt?

I was studying how to create a simple app with Vue.js Javascript framework and downloaded the official and latest (as of today) CDN file from https://unpkg.com/vue@3.2.36/dist/vue.global.js. I saved ...
user avatar
  • 77
1 vote
1 answer
173 views

XSS: window.location.href and window.open

I'm working through all issues that the static security analysis tool Fortify found in our internal Angular application. There is one particular issue I'm not confident of how to work with. Please see ...
user avatar
  • 125
0 votes
0 answers
20 views

How to turn a relative path script (js) import to an absolue one with a url for XSS ? (more details below)

I have a parameter whose value is injected in the HTML as the following <script src="/dir1/dir2/dir3/dir4/INJECT_HERE"> </script> I was able to traverse back to just / but when ...
user avatar
0 votes
1 answer
41 views

How to mitigate risk of exploiting open POST endpoints?

I'd like to ask for advice reg. protecting the state-altering HTTP API endpoints of the API that I'm owning (POST etc.). I'm owning a web application that exposes some HTTP endpoints to the world. ...
user avatar
0 votes
0 answers
26 views

How can I inject JavaScript into a url whose contents will be written to the DOM in a way that it could execute?

I'm working with the API for a popular CI/CD app and I found a bug where path variables are being written directly to the DOM without being checked first. The tldr is that to access a project you go ...
user avatar
2 votes
2 answers
98 views

Create a cryptographically secure random string for auth cookie in javascript

I know there are multiple libraries for managing authentication, but I have a hobby project and wanted to create a very simple authentication system. It'd set a cookie in the client's browser with a ...
user avatar
  • 205
0 votes
0 answers
13 views

Threat Assessment Javascript User-controlled Variable Names on Window

I have a requirement to support some external integration to a 3rd party vendor on our site (which is a SaaS site with multiple tenant logins). The vendor requires a script and a global variable to be ...
user avatar
1 vote
0 answers
49 views

Re-populate form with JSON data

I re-populate form with JSON data via javascript (all data has the same origin server) 1 Wen the page load, make a request post ajax 2 The response Ajax is a: Object { primary_ns: {…}, secondary_ns: {…...
user avatar
9 votes
2 answers
2k views

Does the "auto formfill" feature in Chromium-based browsers actually send this to the webpage?

I use Vivaldi. I have previously filled in forms where I used a certain name and e-mail. Today I cleared the browser data except for the autofill stuff. Then I went to Stack Exchange to register an ...
user avatar
  • 107
0 votes
0 answers
97 views

XSS - Anyway to bypass double quotes in href of anchor?

I have an anchor that has href attribute populated by my input. I am trying to input javascript, but it always renders it useless since it always appears between double quotes. So far, I have tried ...
user avatar
0 votes
1 answer
43 views

Can javascript from parent page read url of popup window?

Lets say I'll open a third party page from the parent page using window.open(popup method) Now what I want to know is there any way where the parent page(using javascript or any third party library) ...
user avatar
  • 1
0 votes
0 answers
24 views

How to prevent shopping cart alterations in another tab when paymentintent is already created?

Has anyone figured out a solution to this? I seem to have gotten to the same conclusion with no solution. If I were to go the my app's checkout page, the payintent is created in the backend (explained ...
user avatar
0 votes
1 answer
77 views

unknown (malicious?) code and file in public dir (Laravel 5.8, apache/cPanel) [duplicate]

I have a Laravel 5.8 app in a server running Apache/2.4.53 (cPanel) and PHP 7.4 (ea-php74) and i have VPS root WHM/cPanel access there. as any Laravel project, the "public" directory is web ...
user avatar
1 vote
0 answers
28 views

Is PHP json_encode sufficient for HTML data blocks?

I want to access data in a PHP variable from JavaScript code. An (old) OWASP cheat sheet recommends embedding it in HTML before accessing it, an approach like this: <div id="init_data" ...
user avatar
0 votes
1 answer
53 views

Encryption options when one-way secure channel is available

I would like to ask what encryption options are available for the following real scenario: There is an unsecure, full-duplex communication channel between a server and client There is also a secure ...
user avatar
0 votes
0 answers
23 views

Explotation of reload/redirect through javascript

While working on a site (https://website.com/site/site.apexp) the site redirects through a javascript function: <html> <script> function redirectOnLoad() { var escapedHash = ''; ...
user avatar
  • 1
2 votes
1 answer
98 views

Website with embedded PDFs and JavaScript for Acrobat

Context On my website, users can upload their PDF files, and then some, other users can view the uploaded PDF files. I was wondering if this could come with security issues. The uploaded PDF are ...
user avatar
  • 21
0 votes
0 answers
155 views

Where to store token from auth header in React

I am currently working on a medium scale app and am a month into learning React. I got to the part where I need to authenticate users. I have written some code and It is working, but I don't know is ...
user avatar
0 votes
1 answer
57 views

Is this safe from XSS?

I need to allow a user to pass unsafe text into an iframe URL: <iframe src="https://example.com?foo=INPUT"></iframe> Inside the iFrame render code, I have this: <!doctype ...
user avatar
  • 105
0 votes
0 answers
55 views

Best way to encrypt client side data for SaaS inside the web

I am planning a SaaS-solution, where my clients store and save sensitive data on my servers. Security is a big point as it makes a product more trustworthy, so my thought was that the data which I ...
user avatar
0 votes
0 answers
71 views

Why would iexplore.exe run Wscript.exe?

In Windows logs, I found that C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe launched C:\Program Files\Internet Explorer\iexplore.exe" -dualengineadapter... which in turn launched &...
user avatar
15 votes
6 answers
6k views

Preventing users from tampering with input

Let's say that I have a single-page web app written in JavaScript and a server-side API, both changeable by me. The app calculates some values based on user input and POSTs these to the API. The ...
user avatar
  • 315
0 votes
0 answers
60 views

How to perform php post request attack with javascript sanitization?

The following code demonstrates the source code of this challenge and basically, I need to send a post request with arbitrary code to execute on the server. However, after multiple attempts Im unable ...
user avatar
1 vote
0 answers
33 views

How to prevent XS-Leaks while maintaining usability?

The methods presented in https://xsleaks.dev/ are based on the fact that malicious Javascript can use Cross-origin requests to infer data by means of faulty status codes, time required, mime type etc. ...
user avatar
1 vote
1 answer
85 views

Can an attacker mess with a website that doesn't use a back-end server? (and how I can prevent that)

I'm developing a React web app where the user can input a .csv of their transaction data, and the app will output useful analysis that will inform their future purchase decisions. I'm planning to use ...
user avatar
  • 11
0 votes
1 answer
111 views

XSS attack not executing with correct payload

Hello I was testing on a private program where I was able to inject XSS but for some reason it is not popping up when I put the mouse over the input field. <input type="text" onmouseover=&...
user avatar
0 votes
2 answers
125 views

When receiving PDFs from unknown sources, is it sufficient to remove dynamic content (flash, JS, etc.) to minimise attack surface?

My company allows customers to upload PDFs, JPEGs and PNGs to our servers, which are then viewed by clients. We want to minimise the potential for attack on the clients, and while the image formats ...
user avatar
0 votes
1 answer
69 views

Can POST request be changed in a HTTPS website?

I am trying to develop a website where I grab data using javascript and send it to PHP using ajax post. However, while researching, I found that the POST request can be modified using third-parties ...
user avatar
0 votes
2 answers
116 views

Does the HTTP status code 302 guarantee no other content was served as part of the same HTTP response?

Does receiving the HTTP 302 status code from a domain A guarantee in any shape or form that there was no JavaScript ran or any additional content (external or not) loaded from that domain A? The ...
user avatar
2 votes
2 answers
107 views

Javascript based attacks when not having JIT

Some browsers like Chromium and recently Edge have a flag to disable JIT. What attacks/threats does this protect against and what JS based attacks are not prevented?
user avatar
  • 31
2 votes
1 answer
381 views

Can XSS ever occur in an <img> tag's "src" attribute?

In a scenario where an attacker has control over the src attribute of an img HTML tag, they could easily inject a simple JavaScript XSS payload like the following: <img src="javascript:alert(1)...
user avatar
  • 123
0 votes
1 answer
110 views

COOP and COEP: Is there an advantage to enabling COOP / COEP if I don't need to use the sharedArrayBuffer or other features?

COOP: cross origin opener policy COEP: Cross origin embedder policy Most of the articles on the web, related to COOP / COEP, point to the fact that by enabling COOP / COEP , your web page can use the ...
user avatar
0 votes
1 answer
192 views

HTML Option Tag XSS

Is it possible to inject javascript inside of an HTML option tag? For example, say you have the following html: <select> <option MALISCIOUS_CODE_HERE>Option Description</option> &...
user avatar
0 votes
0 answers
70 views

Values inserted with the JavaScript "value" property are ineffective

Normally if I insert values to an HTML form's input field element via the JavaScript value property and would send the form, the form would be sent just fine, just as if I would fill in the data ...
user avatar
0 votes
0 answers
57 views

Can malicious code running in isolated Electron's renderer process send data to attacker's server?

I'm trying to evaluate if a malicious npm dependency running in Electron's app renderer process (which has sensitive information) could send data from the webpage out to an attacker's server (or trick ...
user avatar
0 votes
1 answer
570 views

Decoding suspicious Javascript

I received a suspicious looking SMS today with a link. I checked out the page source code and came across this script between the <head> tags: <script async="" src="/cdn-cgi/...
user avatar
  • 186
2 votes
1 answer
99 views

Cookies VS localStorage (JavaScript Security)

I know that HTTP requests made by the site get the browser's localStorage for a site, and document.cookie is encrypted for HTTPs websites, but I'm still wondering the risk of storing sensitive ...
user avatar
0 votes
1 answer
131 views

Could this code be vulnerable to XSS?

It seems like exploiting XSS is becoming harder with every browser version update. My question is: Is this code vulnerable to XSS? <script type="text/javascript"> var url = ...
user avatar
0 votes
0 answers
71 views

Constant-Time String-to-Byte Encoding for JavaScript

When dealing with cryptographic secrets (private keys, passwords, etc) it is desirable to not run these secrets through functions that do not run in constant time, in order to avoid the potential for ...
user avatar
0 votes
1 answer
82 views

Is it secure to send messages between a WS Server and the client?

Is it secure to send messages between a WebSocket Server and the Client? An example of sending messages between a (Socket.io) server, is in Node.js: socket.on("myMessage", function(msg) { // ...
user avatar
7 votes
2 answers
3k views

Is "Math.random" the same as "crypto.getRandomValues" (JavaScript security)

This question may be a little off-topic, but is Math.random the same as crypto.getRandomValues? (JavaScript) Here's an example: Math.random(); // 0.11918419514323941 self.crypto.getRandomValues(new ...
user avatar
0 votes
0 answers
70 views

How to secure an API end point when using javascipt

I'm struggling to understand how one can secure an API endpoint using JavaScript. I want to create a copy and paste-able snippet of Javascript that a user can paste in their site. And on page load/s ...
user avatar

1
2 3 4 5
26