Questions tagged [javascript]

The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

Filter by
Sorted by
Tagged with
1
vote
1answer
53 views

XSS Prevention Code [closed]

I was just wondering if this code is enough to prevent XSS vulnerability in my web app? /** * Escape HTML string to prevent XSS. */ export const escapeHtml = (string: string): string => { if (...
-1
votes
0answers
43 views

How to patch security issues on package-lock.json? [closed]

I have a security issue on my codes.I will just bring one of the issues as an example. Secure Codes Scanner detected that I should NOT use lodash 4.17.11 I opened up package-lock.json, I saw package-...
2
votes
1answer
107 views

Is javascript fingerprinting becoming obsolete?

Okta recently sent out an email to admins about changes to their new device detection strategy. According to them: Due to browser advancements in anonymous web browsing, JavaScript fingerprinting ...
0
votes
0answers
40 views

XSS injection into javascript string

Is XSS attack possible in this scenario? As you can see I am able to inject JS by not properly escaped backslash. <script type="text/javascript">(function () { random.random(); random....
1
vote
0answers
39 views

Can input value escape a JSON object?

I am passing value from input filled directly into a script function inside a JSON object. I was thinking, is it possible that this input can escape this object and can lead to XSS or something. <...
0
votes
2answers
62 views

What attack vectors does arbitrary JS on a user profile allow?

Consider a site for frontend devs/designers to host their portfolio apps - pages with arbitrary JS, each hosted on a user's separate profile. What attack vectors would that enable against the site? ...
0
votes
0answers
41 views

Manipulate auto execution of Javascript since Burp can only see HTTP Requests/responses

There a javascript that is executing in my browser and it is generating session token. (This was a design requirement to the dev team Sesion token is generated on the client side - don't ask me why ...
0
votes
0answers
52 views

Can we know which client side script is performing a particular action on a website?

Recently in an website I had noticed that the data which is received from the server is not the data that is being displayed.I think it would have been modified on client-side. So, Is there any way by ...
0
votes
0answers
31 views

CORS response received in burp but not in browser console

NOTE: I am authorized to test this I was able to find a CORS vulnerability while intercepting it with burp, but cannot exploit it using browser. The request I sent in burp was: POST /xy/ HTTP/1.1 ...
1
vote
0answers
40 views

DVWA file upload background

I've just started in penetration testing with metasploitable and currently trying to learn file upload vulnerability present in DVWA module. I know that somehow upload is preventing files other than ...
1
vote
0answers
122 views

Suspicious behavior by Google when verifying users via nodejs

I'm building a user authentication system in Nodejs and use a confirmation email to verify a new account is real. The user creates an account, which prompts him/her to check the email for a URL that ...
2
votes
1answer
87 views

Are Javascript closures a useful technique to limit exposing data to XSS?

I'm wondering if using Javascript closures is a useful technique to limit exposing data to XSS? I realize it wouldn't prevent an attack, but would it reliably make an attack more difficult to execute, ...
0
votes
1answer
24 views

Can you set a custom x-forwarded-host header in a CSRF form page?

Can you set a custom x-forwarded-host header in a CSRF form page (not xhr)?
2
votes
1answer
29 views

CSRF: GET request with POST data?

I have stumbled upon a vulnerability in a web application and was wondering if it was exploitable / worth reporting. The bug is a CSRF which would allow an attacker to send friend requests to himself ...
0
votes
0answers
66 views

Are web worker / service worker secure environments to store a password, credit card information, access tokens?

If there is a case where I wish to store sensitive data like a password, credit card information, or access tokens: Are web workers / service workers a secure environment, where such data can not be ...
1
vote
1answer
122 views

Local file inclusion in JS app [closed]

I am working on a project which requires the name of the page as a query parameter 'path'. The app stores path variable as res.query.path. My manager asked me to pay attention to LFI, so I'm concerned ...
2
votes
2answers
158 views

Popup alert even when a site deletes the alert function?

A website fully filter the alert function from his website, and replace it with an empty string, but I want to bypass it and still popup an alert, I am trying to solve an XSS challenge, and I figure ...
2
votes
3answers
81 views

How to secure a price passed to a payment gateway on client?

Using Javascript, say a customer buy a product that cost 10$. Many payment gateways, like PayPal and Stripe, offer a client side Form where you input the sale data (price, amount, buyer address, etc), ...
1
vote
1answer
59 views

What are the potential vulnerabilities of sending HTML/JS to the browser from the database?

An in-house team is creating a new framework and I'm not so sure it's as secure as they're letting on. I'm not super well versed in security so I wanted to ask for opinions. A demo web app was ...
1
vote
1answer
57 views

Is this considered DOM-XSS or self-XSS or both?

SCENARIO: A web page shows an error login page using these javascript lines <script> let queryParams = new URLSearchParams(window.location.search); document.getElementById("message")....
0
votes
1answer
109 views

How a website knows if a video has been watched or downloaded?

There's a video lecture streaming on a university platform that runs javascript. Can the system detect if I'm downloading the video (via IDM) rather than just watching it? In other words, how can a ...
0
votes
0answers
21 views

How do i produce keypairs for my users while implementing json web token

I want to check the integrity of my user information; that the information which my website server receives was indeed sent by them. From what I understand, json web tokens (jwt) is the way to go. I ...
0
votes
0answers
22 views

Regenerating CSFR token in AJAX requests

I would like to create a new token for each request and would like to us the following template- <script> var current_token=<?php echo $_SESSION['csrf_token']; ?> $....
0
votes
1answer
84 views

DOM-Based cross-site scripting on window.location.pathname

A scan with Burp has identified a DOM-Based cross-site scripting vulnerability. The only script with a sink is the following. Do you think it's a false positive? (Can I make it more secure in some ...
57
votes
3answers
9k views

eBay web site tries to connect to wss://localhost:xxxxx - is this legit or they have some Malware JS running?

In helping a corporate user log on to eBay, I noticed that when on the login page, a stream of errors were coming up in the Firefox JS Console about not being able to connect to wss://localhost. This ...
2
votes
1answer
45 views

Is possible to implement a Web Cryptography API custom provider?

I'm reading some basic info about Web Cryptography API and I'm wondering if is possible to implement some crypto provider (C/C++ library or something) with some extra algorithms or is mandatory to use ...
0
votes
0answers
30 views

Google Gruyere - Ajax Json Stored Xss

I was doing the google security challenges here: http://google-gruyere.appspot.com/part2 I don't understand the solution for the Ajax Stored Xss part. So here's the problem summarized: Every user ...
1
vote
1answer
62 views

Why *is* PKCE recommended for single page JavaScript apps?

This question is essentially the opposite of Why isn't PKCE encouraged for Single-Page Apps?. In recent years, most OAuth API vendors seem to be have become unanimous in recommending that ...
-1
votes
1answer
49 views

How authenticate a login with javascript

I want to authenticate a user using a username and password in a web app running javascript interfacing to a non node js or php server. In a normal desktop app I could use bcrypt or an hmac or ??. ...
6
votes
1answer
175 views

DOM Based XSS and Adding HTML Elements

So as a rule of thumb I once learned that adding or removing HTML with JavaScript/JQuery (.html(),.append(), etc) leaves yourself wide open for DOM Based XSS Attacks. It is now my understanding that ...
1
vote
1answer
53 views

IFrame Vulnerability Classification

I was participating in a bug bounty on a website we will call example.com, when I ran into a very strange edge case which I am not sure I should report. The website uses ads and tracking similar to ...
3
votes
1answer
125 views

Can a PDF embed a tracking image?

I know that PDFs can contain embedded images and Javascript. Can a PDF contain something that tracks you? For instance, can it contain a remote image that, when the PDF is opened, will fetch that ...
0
votes
0answers
38 views

Can we keep Pusher API keys public?

I was looking at my company site and I saw Pusher API keys are exposed. Should it be kept public?
0
votes
0answers
65 views

DOM XSS via JQuery function init()

Burp reported potential DOM XSS. Data is read from location and passed to the 'init()' function of JQuery via: var table = location['table'] || location['sysparm_table']; snPresence.init(table, ...
1
vote
0answers
42 views

Dom based Cross-Site Scripting (XSS) sources

Which are still relevant sources for Dom-based Cross-Site Scripting (XSS) in 2020? Had a list of those: document.URL, document.documentURI, document.location, location, location.href, location....
0
votes
1answer
40 views

Is it possible to bypass escape() when document.getElementByName gets the value?

Say I have the following script var a = document.getElementById('in').value; escape(a); Is it possible to bypass the escape function to do some XSS? I have tried );alert(1); to no avail. I have ...
0
votes
0answers
17 views

How to bypass filter which blocks < charachter? [duplicate]

I am practicing reflected xss .I found a page in my lab which gives back the input in response of the request.But the application is sanitizing anything which comes after a < character because of ...
0
votes
0answers
48 views

Is document.write(window.location.hash.substr(1)) still exploitable for DOM XSS? [duplicate]

I stumbled upon Google's firing range for DOM XSS testing, and this case caught my eye: <script> var payload = window.location.hash.substr(1);document.write(payload); </script> As far ...
0
votes
0answers
42 views

Is “*.googleusercontent.com” used for internal services?

I am a bug bounty hunter. While searching for vulnerabilities in a private program, I saw a functionality that allows me to enter any code I want and it will execute them. Then I was thinking about ...
0
votes
0answers
21 views

Need some clarification on fetch API Request.mode in conjunction with cookies

Quoting the MDN docs for the fetch API: fetch() won’t send cookies, unless you set the credentials init option. Alright I guess. Including { credentials: 'include' } should do the trick. Though ...
2
votes
1answer
62 views

How Create string in Java Script without single or double quote?

I participate in a CTF and I had to steal Admin's cookies. And quotes (single and double) were encoded. I needed to use document.location=URL for steal cookie, but I can't pass URL using quotes. So ...
0
votes
1answer
95 views

“/> <script>alert('xss')</script> <br class=” doesn't reflect in input tag [closed]

I've my this webapp running on localhost. I've been trying to reflect XSS through this input tag but it's not working for some reason. could someone please tell how to have it reflected? the payload ...
3
votes
1answer
284 views

Effect of Script tag inside HTML comment

I recently participated in a CTF and solution of that CTF is based on this weird behavior of browser. In First case when I am including script tag inside an HTML comment and without closing that ...
1
vote
2answers
71 views

using reflected xss to get the cookie from a test user

My school has provided us with a private server (HTTP) for each student that we can test reflected XSS attack we are asked create a test user. Create a url with malicious parameter and send it to the ...
1
vote
0answers
37 views

Generate new AccessToken each time user update his Information

im building a PWA app , where i implemented jwt token to auth users. i have 2 main architecture problems ,but let me introduce you what im building . i'm Building application that is all about dog ...
0
votes
1answer
77 views

Triggering an XSS through a shortened URL?

I have this piece of HTML: <img src="image src" alt="{injectable}" title="{injectable}" border="0"> where {injectable} values correspond to the same input value that has to be 32 characters ...
2
votes
1answer
216 views

Reflected XSS in a JavaScript URL with some characters blocked

I am new to the field of Web Security and am practising labs from Portswigger Web Security Academy. In this lab, we have to call the alert function with 1337 as the parameter. The solution given on ...
2
votes
1answer
134 views

XSS payload explanation with x:x/

I am trying to understand exactly how JavaScript XSS (cross-site scripting) payloads found across the internet work and I would like your help for the following: <img src=`xx:xx`onerror=alert(1)&...
3
votes
1answer
89 views

Retrieving CSRF token from third party website form using XHR (JavaScript)

I know they say CSRF tokens are the most secure way to prevent CSRF attacks but what if someone uses XHR to retrieve the page containing the csrf token along with the form and then use that token for ...
1
vote
1answer
74 views

Is it a security risk to strore item IDs in sessionStorage?

I've been working on an eCommerce store for people to be able to buy items. I want to implement a basket system for this store. Looking at lots of other posts, it is clear to me that there are ...

1
2 3 4 5
23