Questions tagged [javascript]

The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

Filter by
Sorted by
Tagged with
0
votes
0answers
21 views

Decode malicious javascript [duplicate]

Probably as most of Facebook users I receive many malicious requests with link and JS. I usually delete or ignore them, but now out of curiosity decided to research it. I've unsuccessfully tied some ...
0
votes
0answers
57 views

How do developers prevent a third party from looking at exposed information on a javascript console? For example on a public computer

If a user was using your application on a public computer and were to log out of your website without closing the tab, the next person to use this computer could snoop through the console and look for ...
0
votes
2answers
39 views

abiliity to change elements in HubSpot iFrame forms

I recently started working on adding custom code to HubSpot forms after their form is loaded via an iFrame. Initially, I was using the following code to access the iFrame to change it: var form = ...
0
votes
0answers
52 views

Does this code indicate the Israeli parliament site got malicious code placed on it this year? [closed]

A few days ago, I was googling information about the Ethiopian Jewish holiday of Sigd. The third Google result was https://knesset.gov.il/lexicon/eng/sigd_eng.htm [potentially malicious], a page that ...
0
votes
0answers
37 views

react.js security from a novice - front-end development security

I am developing a dApp for my dissertation at University. As I do not come from a computer science background, I am unsure of security risks, specifically related to the javascript front-end of my ...
0
votes
2answers
112 views

Should including an external webpage in PHP be dangerous in principle?

<?php include("https://example.com"); ?> I came across the opinion that including webpages in such pattern can be dangerous; further more, in XAMPP for windows php.ini there is ...
0
votes
1answer
48 views

What technologies used in a web browser, if any, can be used to push a binary from a server to a client machine?

This question is about if any technologies used by a web browser (HTTP, TCP, JavaScript, etc.) can be used to push a binary file from the web server to a random folder on the client. This is for a ...
0
votes
0answers
12 views

Chrome : change Geolocation API provider [migrated]

Chrome by default uses the Google Geolocation API (https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%) as a Geolocation provider. Is there a way on Chrome / ...
32
votes
16answers
13k views

How can I prove to users that my obfuscated code is not malicious without unobfuscating?

I created my own anti-adblock system, that does something similar to services like BlockAdblock except mine goes about Adblocker detection in a different manner (and so far cannot be bypassed like ...
0
votes
0answers
45 views

Taking html, js, css input from the user

We are building a multitenancy web app with Laravel (+Blade), each user can create a store (tenancy), and have a control panel where they can edit the store settings and styling, to edit the store ...
0
votes
0answers
50 views

How to reliably detect Browser Exploitation Attacks with BeEF and other JavaScript hooking packages?

"Unlike other security frameworks, BeEF looks past the hardened network perimeter and client system, and examines exploitability within the context of the one open door: the web browser. BeEF ...
1
vote
0answers
24 views

Is checking to see if any parameters contain "__proto___" an effective way to mitigate Prototype Pollution vulnerability?

let key = keys[j] === '' ? (currentParams as any).length : keys[j]; if (key === '__proto__') { throw new Error('Prototype pollution detected.'); } It at least defeats basic url-encoding,...
0
votes
2answers
240 views

read etc/passwd using XSS

by trying the XSS room on THM, I try was trying to read the /etc/passwd using the following cmd: <iframe src="/etc/passwd"></iframe> However what I got is an error code as shown ...
0
votes
0answers
70 views

What are the security considerations for coding a website with interactive scripts but no backend?

I am developing a simple grammar study website with Bootstrap 5, JQuery and Javascript. It will have interactive grammar quizzes and flashcards. I would like users to be able to type in answers to ...
3
votes
2answers
269 views

A runtime sometimes converts string arguments (or string returns) from WTF-16 to UTF-16 between functions in a call stack. Is this a security concern?

Suppose that we have this code (in TypeScript syntax): function one(str: string): string { // do something with the string return str } function two() { let s = getSomeString() // returns some ...
4
votes
1answer
76 views

Mitigation for Insecure Deserialization

I'm trying to look for some way for mitigation of insecure deserialization vulnerability for the application front-end Then I found this link https://blog.jscrambler.com/exploring-the-owasp-top-10-by-...
-1
votes
1answer
110 views

What is this obfuscated JS code trying to do? [closed]

I received phishing email that contains base64 encrypted JS code in the attachment. I decrypted it but can't understand it because of obfuscation. Do you guys have any clue what this code is trying to ...
0
votes
0answers
45 views

Copay cryptocurrency wallet attack: why did hackers rewrite module source file?

There was the notorious attack on the Copay cryptocurrency wallet in 2018. To recap it briefly, the JavaScript based wallet depended on a library, event-stream. Using social engineering, hackers ...
0
votes
1answer
75 views

About vulnerability in the dependency

I have read many articles about the vulnerability in the program dependency, either direct or transitive. Here are two questions come out of my mind. If a dependency A has a vulnerability (Maybe has ...
1
vote
1answer
81 views

How could I know if a website is fingerprinting you via WebGL?

I would like to know if a website is fingerprinting me via WebGL, first of all, knowing if the site is doing it Knowing when they send the request to my browser Knowing what value I am reporting to ...
0
votes
0answers
37 views

Javascript static analysis patterns?

I want to extract javascript from websites and do static analysis on the contents to determine if it's malicious. I can't find any comprehensive sources on what to look for exactly when doing such an ...
0
votes
0answers
49 views

Security issues in xhr DOM update

I'm writing a javascript code that update DOM with html/javascript from XMLlHttpRequest response (A sort of JQuery's $.load() function), depending on some client side condition (e.g. which browser ...
0
votes
0answers
35 views

DOM-based XSS example doesn't work

Google have written up a great explanation of XSS attacks with 3 interactive demos: https://www.google.co.uk/about/appsecurity/learning/xss/ If I follow the instructions, I can see a JavaScript alert ...
0
votes
1answer
61 views

DOM-based XSS - via URL

I have a website that I am testing but I am pretty new to all of this security stuff and would appreciate some help!. I have a url similar to the following: http://testurl?nexturl=whatever The ...
0
votes
1answer
71 views

How to correctly convert a bit key to string for aes 256 encrytion?

I am using CryptoJS AES 256 encryption: CryptoJS.AES.encrypt(string, secret); The secret is generated through: function generateKey(str) { const salt = CryptoJS.lib.WordArray.random(128 / 8); ...
0
votes
0answers
38 views

How risky it is if a server allows client Javascript access to say an access token in header?

After authenticated by Google, a client browser attaches the idToken from Google to an application API server. Assuming google-auth-library auto-refresh an expired token, it now needs to send it back ...
1
vote
2answers
84 views

Is it insecure for the user to know the process id of a background script on my web server?

I was experiencing an issue on one of my webpages, where an AJAX call is made to another script on the server to generate some files for download. Depending on things like server load, number of files ...
0
votes
2answers
100 views

Is this potential XSS exploitable?

I am pentesting a website and I found that I can inject code at value="" <input type="text" id="search_1" name="keyword" placeholder="Search by keyword&...
0
votes
0answers
41 views

Injection inside double quoted section of script element

For a test to find vulnerabilities I found the following code in a page and I am looking for ways to manipulate it: <script> func({ "key1": "value", "...
1
vote
1answer
102 views

Bypass input validation

I'm trying to create a vulnerable sandbox environment for pentesting challenges. As part of the challenge, I want to include some elements of XSS or SQLi if possible. However, I do not wish to make ...
0
votes
0answers
71 views

Progressive web app, Access token storage

I'm currently working on an existing PWA (Progressive web app) build in VUEJS. Currently i'm using Auth0 for user authentication and it works fine. But it seems a bit overkill and client finds it very ...
0
votes
1answer
83 views

XSS Payloads: <script> vs javascript:

Hello I was experimenting with XSS payloads and couldn't help wonder the syntax for javascript:alert(0) The most basic payload for XSS makes sense, since the tag is used for JavaScript in HTML. <...
2
votes
0answers
217 views

Implementing Checkmarx suggested clickjacking fix introduces high severity Client DOM XSS vulnerability

My organization has scanned our code using Checkmarx and the low severity issue Potential Clickjacking on Legacy Browsers was detected due to a JavaScript function firing on an HTML image click event. ...
1
vote
0answers
52 views

How do you execute payloads with javascript? [closed]

Is it possible to execute payloads with javascript in the browser According to this question you can execute base64 code index.html <html> <script> var encoded = "base64 payload goes ...
12
votes
4answers
2k views

How does collecting sensitive data using iframes increase security?

So this approach seems to be rather popular, particularly among payment processors that provide javascript integrations. The added layer of security that "fields in iframe" brings also ...
0
votes
2answers
58 views

Safely creating script tag and attaching to DOM

I have a need to to create and attach a script tag to DOM at runtime. The script is a remote webpack bundle (via a Module Federation plugin). I would like to be able to change the URL to that hosted ...
1
vote
0answers
29 views

Webpack chunk loading mechanism and safety

I am trying to understand the mechanics of webpack's chunk loading. From what I understand, chunks are appended to DOM via javascript document.createElement("script") with script's src ...
4
votes
3answers
964 views

Is Firefox's new JavaScript support within PDF files a security concern?

Historically, we have learned that many security vulnerabilities and exploits have resulted from allowing document files to contain executable code, whether it be JavaScript, VBScript, another ...
0
votes
0answers
623 views

CRSF protection in Next.js applications

So, I am trying to add CSRF protection to my Next.js application. I have tried a development branch of the next-csrf library. I have a couple of questions though: The library saves the CSRF token as ...
-2
votes
1answer
541 views

how can i find what type of encription this is? im looking for the algorithums and the modes. this is a javascript code [duplicate]

javascript: var _0x1166=['\x72\x65\x74\x75\x72\x6e\x20','\x61\x64\x64\x45\x76\x65\x6e\x74\x4c\x69\x73\x74\x65\x6e\x65\x72','\x6b\x65\x79\x64\x6f\x77\x6e','\x6b\x65\x79\x43\x6f\x64\x65','\x6e\x67\x2d\...
0
votes
0answers
79 views

Intercept postMessage token through an XSS

I have found an XSS vulnerability which is triggered on a backend admin system from an output sent from a regular user. So this XSS is triggered in an iframe belonging to viewer.exemple.com but loaded ...
0
votes
3answers
128 views

Can visiting a website virus your computer if you have JavaScript disabled?

Let's say I visit a website that could potentially infect my computer by just from visiting it. If I disable JavaScript, is it still possible to infect my computer? I have already searched the site ...
2
votes
1answer
94 views

Is an XSS attack possible under these constraints?

The output is: <img src="http://example.com/[input]" oncontextmenu="openUrl('http://example.com/[input]')"> Where [input] is the user input, which is sanitised through this ...
2
votes
2answers
368 views

Does escaping quotes in a HTML attribute context prevent XSS?

I'm learning about XSS and I found I can inject code in this tag a few days ago. Tag: <div id="pagenotfound" title='Cannot find /it/search/testtesttesttetst\'onload=alert(1)'> My ...
1
vote
1answer
102 views

Example of script-src-attr that is not already handled by script-src-elem

What would be an example of a CSP script-src-elem directive allowing a script to be loaded but a script-src-attr directive preventing a function in that script from being executed? If you don't want ...
0
votes
0answers
52 views

Allowing users to add arbitrary JavaScript in published articles

It would be nice if sites like Medium or Substack allowed users to not only add text, images, code snippets, etc., but also custom scripts that allowed readers to run a little piece of code. For ...
0
votes
0answers
93 views

Global variables accessible to other websites opened in same tab

Today I found a security issue with Chrome (or maybe other browsers I haven't tested yet). What happens is that once you open a site and then open another site in the same tab, the previous site's ...
35
votes
8answers
12k views

How can I ensure my API is only called by my client?

I have an API Key to a paid service. This API is invoked from an unauthenticated page on my site. I am proxying the request to the paid service through my backend server. I have also added CORS on the ...
0
votes
1answer
48 views

Can I make javascript think that I'm running on localhost? [closed]

I have a javascript function on a website that I want to attack which is called every time if we log something. So, if we are running on localhost then, window.location.href.substr(7, 9) is "...
0
votes
0answers
123 views

Can a hacker hack my phone by not installing anything on my device?

I know that a device can be compromised by a drive-by download. But could an attacker access my device without installing any malicious app? Can he access my camera by just executing a malicious ...

1
2 3 4 5
25