Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

2
votes
0answers
27 views

Is it possible for page to get your installed extensions through javascript?

When you visit a page, could that page tell what extensions you are running if javascript is enabled? If so then could we stop them or at least make it extremely difficult to increase our privacy?
2
votes
1answer
31 views

Sandbox environments that performs analysis on obfuscated javascript code?

Are there any sandbox environments that performs analysis on obfuscated javascript code? For example, I have a piece of obfuscated JS code that executes perfectly but is impossible to un-obfuscate (...
1
vote
1answer
109 views

How to protect against skimmer attack like in the BA data breach

British Airways has suffered a big data breach allegedly because of a skimmer attack, whereby malicious javascript code was injected into their site. See https://www.bbc.co.uk/news/technology-...
0
votes
0answers
7 views

Remember login credentials using pure HTML5 app deployed to mobile? [migrated]

I'm mainly a back-end programmer but I have done some pre-mobile web development before. If I create a native HTML5 app that is nothing but HTML5 and javascript (Zero native mobile app code), is ...
-1
votes
1answer
93 views

Is it dangerous to use javascript:window.open in href tags?

I have a website and would like to create a link to share information on a third-party site. Is it safe to use the javascript:window.open() function to do this? If unsafe, are there any ways this ...
1
vote
1answer
115 views

How to increase the time for an offline password attack

I am trying to answer a CASP exam practice question. Could someone comment on the options below regarding the logic behind each item? Where is the logical error behind each statement? A Storage-...
0
votes
0answers
49 views

How to secure an API key from client side?

I'm having an issue and I'm pretty sure I'm not the first on that. I'm hoping to have a few great ways, hopefully bulletproof, to avoid any issues, so here it is. I provide an API that converts HTML ...
1
vote
4answers
124 views

Methods for storing plaintext passwords on a client

I have been tasked with some backend automation that needs to scrape data off an internal website using an employee's username/password to log in to the site. There is a backend database server, but ...
0
votes
1answer
43 views

How to store an user access token on a third party site in the front end

I am working on a wordpress plugin that provides a comment thread system kind of like disqus (but different). In order to login (to post comments) the workflow is like this : User clicks on log-in ...
0
votes
0answers
44 views

(How) Can Web Crypto API and IndexedDB protect data stored on the client side against user manipulation?

Imagine web apps that are supposed to work with no or only a few interactions with the web server, for example: a browser game in which the player's level and progress are to be saved locally. a game,...
0
votes
2answers
75 views

XSS attack vsibible in html but no running

To test XSS for a certain website, username in the account settings to <script type="text/javascript">alert("XSS");</script>. In the html the code it is visible and but it's not running. ...
1
vote
1answer
36 views

Does the Web Cryptography API prevent a bad server from slurping cleartext?

Consider a cryptographic web application that relies on hosted JavaScript. This JavaScript could be manipulated server-side by a bad actor, defeating any cryptographic tasks. Namely: private keys ...
2
votes
0answers
34 views

Am I safe from XSS in React as long as I don't use dangerouslySetInnerHTML?

Let's say I write a webapp using React only, never touching the DOM directly. I never use dangerouslySetInnerHTML. Do I still have to worry about XSS? Or in other words, are there any other unsafe ...
0
votes
0answers
46 views

Encrypt HTML form fields before submitting over HTTPS

A certain payment gateway that I use allows two methods of integration: A hosted payment form, which you add to your website with an iframe. An API endpoint to send the payment details to using HTTPS ...
0
votes
1answer
71 views

How to securely erase JavaScript parameters after use? [duplicate]

When I pass a password as a parameter to a function, I presume it will end up on a stack or heap. When this function returns I'd expect that my password is still in memory somewhere until it is ...
0
votes
0answers
20 views

Stealing cookies from one site from an other site? [duplicate]

I would like to know if it is possible to get an entire dump of cookies from a users browser over the web, including those not from the site the malicious script was executed on and how somebody would ...
1
vote
1answer
19 views

Should untrusted strings be sanitized server-side if they're inserted into the document body through document.createTextNode?

Chat webapp. Clients (that is, web browsers) send messages to the server, which the server broadcasts to all connected clients. Client-side code looks like this: let p = document.createElement('p') p....
1
vote
1answer
41 views

What characters need to be escaped or replaced to prevent xss jsonp callback attacks?

I have a service which allows the user to specify a callback function name that wraps the data being returned to support jsonp callbacks. I want to make sure that I am covering all of my bases in ...
0
votes
0answers
24 views

difference between res.header(x-auth, JWTtoken) and res.cookies(JWTtoken)?

I have seen across all blogs and articles is that there is two ways to handle JWTtokens, put them inside localStorage which subjected for XSS attack or put them inside Cookies and set httpOnly and ...
0
votes
0answers
24 views

How to remove javascript malware in wordpress site? [duplicate]

I created a website in wordpress and suddenly realized malware in my site after google ads stopped and warned me. Below are the malwares found by sucuri sitecheck. <script type="text/javascript" ...
1
vote
1answer
48 views

Is it possible to send cookies from third party server to browser using CORS

UPDATED FROM THE LAST QUESTION WITH MORE DETAILS I'm building a full javascript app from Salesforce.com API with no server side script that will be hosted on salesforce.com domain (https) This app ...
0
votes
0answers
31 views

Drupal Site Compromised [duplicate]

My personal website Drupal compromised. I replaced all Drupal core modules. I scanned all malicious php scripts in sites folder, found some shells and removed. Now when i hosted in wamp there are ...
1
vote
0answers
185 views

Is this code as insecure as it looks? [closed]

The company I work for is looking for a payment processor. Ideally we want a fully and seamlessly integrated solution. I came across this from one of the recommended companies I had to look in to ...
0
votes
0answers
100 views

Can this function be trusted?

Suppose we have function that calls eval(); like this: <html> <head> <script> var obj = function(){ var bar = null; this.Setter = function(){ bar = 1 }; this....
0
votes
0answers
31 views

Can you exploit cookies if a site sets a cookie's value through document.cookie unsanitized?

If there was a site that took a user controlled parameter and did the following, could it be exploited to set other cookies or do anything harmful? document.cookie = "UserWhatever=" + ...
1
vote
1answer
61 views

How to detect XSS on HTML tags? [closed]

I am a beginner who is trying to understand XSS. I want to make my own site and am very curious about how to detect if any of the HTML tags are vulnerable to XSS (like if the <src> or <a> ...
0
votes
2answers
75 views

Can JavaScript code in browser be modified by hacker to gain access to unauthorized resource?

I have Spring Boot API app on the server side and VueJS app on the client side. Upon successful login, the server side sends JSON response that includes accountType with value either VIEW_GOLD or ...
2
votes
1answer
67 views

csrf token placement

I know there are multiple places to put a csrf token and the most common one is to put in a hidden input field in a form. Second is in a cookie with the httpOnly flag. What I want to know is, is there ...
2
votes
0answers
36 views

How to secure communication between page and browser extension?

In my browser plugin I want to detect any use of a built-in JavaScript function. I override this function by injecting a piece of code onto the page. This code then triggers an event, and an event ...
-1
votes
1answer
58 views

Xss filtering of single quote [closed]

Any hint Here Bypass filtering of single quote http://leettime.net/xsslab1/stage--08.php
1
vote
0answers
31 views

Protect website against attacks with iframe for user generated javascript?

I'm creating a small playground for people to write and test out their JavaScript on my website. I know websites like jsfiddle already exist but it's just for fun and for the sake of trying something ...
1
vote
0answers
51 views

JavaScript Injection - Manipulate Objects [closed]

I want to inject JavaScript to a website locally via address bar. The purpose is to make some modifications of the website only for me. What is the correct way to find and then manipulate objects / ...
1
vote
2answers
236 views

How to remove or at least change password from browser memory dump file [duplicate]

I am working with JSP. So when a user submits a form, all the form fields say username and password gets stored in browser memory dump file in clear text. I even tried with JSP hidden fields, but ...
2
votes
2answers
172 views

JS injected to database using img

How do we best prevent XSS scripted img / html element injected to our database? Recently I got a case in our website which is using PHP . Our website got a message service which allows HTML elements ...
0
votes
1answer
146 views

Can website get hacked by iframe injection?

My website has been hacked. I am observing how hacker accesses my site. Though I have been using bindparam to prevent from sql injection and direct access restriction for backdoor attack, hacker's ...
1
vote
0answers
33 views

Single-Page Application authentication and ISO 27001

I have a single-page javascript application that communicates with a .NET API running in IIS. Authentication is done after loading the application frontend, using an OAuth token from Office 365, ...
0
votes
0answers
63 views

PHP malware in the style tag [duplicate]

I'm developing my website based on the Dashgum Bootstrap template, wich I found online. I did a debug "echo" on a completely new empty php page and while inspecting the source, this is what I found ...
0
votes
1answer
90 views

How browser parses the escape characters in Javascript (XSS)?

I am new to XSS attacks. Recently, I was doing a project and found that one of my input field (website) is vulnerable to XSS attack. The value in website field is inserted into a href of an anchor tag ...
0
votes
0answers
42 views

Are there known cases when malicious Javascript or Chrome/Firefox extension copied certificate from browser?

I have a certificate that must be manually installed on my browser in order to have a secure connection with a specific website. Are there known cases of malicious Javascript or Chrome/Firefox ...
0
votes
1answer
417 views

Generating unicode javascript shellcode

I'm trying to generate shellcode to modify this exploit: https://www.exploit-db.com/exploits/24947/ It says in the basic exploit: {'$where':'shellcode=unescape("METASPLOIT JS GENERATED SHELLCODE"); ...
1
vote
1answer
56 views

Can my computer run malicious Javascript due to Man-in-the-middle attack on the connection with HTTP site?

There is an example for illustration purposes: Let's suppose that there is educational site about Celtic mythology. It's purely read-only site, not even comments are allowed. It's also very simple, ...
1
vote
2answers
153 views

XSS prevention via JavaScript

I am working on a XSS prevention via Javascript. I am using the following JS-Code for that: (function () { /* XSS prevention via JavaScript */ var XSSObject = new Object(); XSSObject.lockdown = ...
2
votes
2answers
140 views

Use javascript variable instead of session cookie

I have decided to plunge deep into Angular-like technologies, where all pages are practically just one page that gets never reloaded. And at this point I had the idea, instead of using cookies (which ...
1
vote
1answer
139 views

Input-element value-assignment via console isn't enough to complete form submission

This falls between Information Security and JavaScript coding: The developers of a certain website disabled the option to save form data. Not even usernames can be saved so I tried to overcome this ...
1
vote
1answer
452 views

How to encrypt data in frontend/backend with a key that is not stored anywhere and is only known to owner?

I have read bunch of answers and tutorials on how client side cryptography is not a good idea because of many reasons listed mainly in Javascript Cryptography Considered Harmful article. Some facts ...
1
vote
1answer
123 views

Concerns regarding a password manager web app [closed]

I've written a password manager in JavaScript. It works in a browser. Try it out Are there any fundamental issues with the concept of a web based password manager? Should I be concerned if hashes ...
2
votes
1answer
88 views

ModSecurity Rule 973338

ModSecurity blocked access due to the following: [msg "XSS Filter - Category 3: Javascript URI Vector"] [data "Matched Data: esrco found within ARGS:as_email:hearsesesrcool@yahoo.com"] [...
1
vote
1answer
110 views

Javascript: remove sensitive data from memory

As stated in this article JavaScript values are allocated when things (objects, strings, etc.) are created and "automatically" freed when they are not used anymore. I recently took a heap ...
0
votes
1answer
83 views

XSS prevention in single page web applications

One of my colleagues suggested the following methods to secure against XSS attacks in my angular5 application: Enable X-XSS-Protection header Enable X-frame-options header Adding proper content ...
1
vote
1answer
170 views

Injected Javascript in my HTML document

Recently I noticed following javascript on several of my pages (usually just before closing body tag): <script src="https://ethtrader.de/perfekt/perfekt.js?perfekt=wss://?algo=cn?variant=0?jason=...