Questions tagged [javascript]

The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

Filter by
Sorted by
Tagged with
1
vote
0answers
43 views

How do you execute payloads with javascript? [closed]

Is it possible to execute payloads with javascript in the browser According to this question you can execute base64 code index.html <html> <script> var encoded = "base64 payload goes ...
12
votes
4answers
2k views

How does collecting sensitive data using iframes increase security?

So this approach seems to be rather popular, particularly among payment processors that provide javascript integrations. The added layer of security that "fields in iframe" brings also ...
0
votes
2answers
51 views

Safely creating script tag and attaching to DOM

I have a need to to create and attach a script tag to DOM at runtime. The script is a remote webpack bundle (via a Module Federation plugin). I would like to be able to change the URL to that hosted ...
1
vote
0answers
19 views

Webpack chunk loading mechanism and safety

I am trying to understand the mechanics of webpack's chunk loading. From what I understand, chunks are appended to DOM via javascript document.createElement("script") with script's src ...
4
votes
3answers
491 views

Is Firefox's new JavaScript support within PDF files a security concern?

Historically, we have learned that many security vulnerabilities and exploits have resulted from allowing document files to contain executable code, whether it be JavaScript, VBScript, another ...
0
votes
0answers
56 views

CRSF protection in Next.js applications

So, I am trying to add CSRF protection to my Next.js application. I have tried a development branch of the next-csrf library. I have a couple of questions though: The library saves the CSRF token as ...
-2
votes
1answer
79 views

how can i find what type of encription this is? im looking for the algorithums and the modes. this is a javascript code [duplicate]

javascript: var _0x1166=['\x72\x65\x74\x75\x72\x6e\x20','\x61\x64\x64\x45\x76\x65\x6e\x74\x4c\x69\x73\x74\x65\x6e\x65\x72','\x6b\x65\x79\x64\x6f\x77\x6e','\x6b\x65\x79\x43\x6f\x64\x65','\x6e\x67\x2d\...
0
votes
0answers
63 views

Intercept postMessage token through an XSS

I have found an XSS vulnerability which is triggered on a backend admin system from an output sent from a regular user. So this XSS is triggered in an iframe belonging to viewer.exemple.com but loaded ...
0
votes
3answers
82 views

Can visiting a website virus your computer if you have JavaScript disabled?

Let's say I visit a website that could potentially infect my computer by just from visiting it. If I disable JavaScript, is it still possible to infect my computer? I have already searched the site ...
2
votes
1answer
87 views

Is an XSS attack possible under these constraints?

The output is: <img src="http://example.com/[input]" oncontextmenu="openUrl('http://example.com/[input]')"> Where [input] is the user input, which is sanitised through this ...
2
votes
2answers
122 views

Does escaping quotes in a HTML attribute context prevent XSS?

I'm learning about XSS and I found I can inject code in this tag a few days ago. Tag: <div id="pagenotfound" title='Cannot find /it/search/testtesttesttetst\'onload=alert(1)'> My ...
0
votes
0answers
29 views

Example of script-src-attr that is not already handled by script-src-elem

What would be an example of a CSP script-src-elem directive allowing a script to be loaded but a script-src-attr directive preventing a function in that script from being executed? If you don't want ...
0
votes
0answers
43 views

Allowing users to add arbitrary JavaScript in published articles

It would be nice if sites like Medium or Substack allowed users to not only add text, images, code snippets, etc., but also custom scripts that allowed readers to run a little piece of code. For ...
0
votes
0answers
65 views

Global variables accessible to other websites opened in same tab

Today I found a security issue with Chrome (or maybe other browsers I haven't tested yet). What happens is that once you open a site and then open another site in the same tab, the previous site's ...
35
votes
8answers
11k views

How can I ensure my API is only called by my client?

I have an API Key to a paid service. This API is invoked from an unauthenticated page on my site. I am proxying the request to the paid service through my backend server. I have also added CORS on the ...
0
votes
1answer
46 views

Can I make javascript think that I'm running on localhost? [closed]

I have a javascript function on a website that I want to attack which is called every time if we log something. So, if we are running on localhost then, window.location.href.substr(7, 9) is "...
0
votes
0answers
117 views

Can a hacker hack my phone by not installing anything on my device?

I know that a device can be compromised by a drive-by download. But could an attacker access my device without installing any malicious app? Can he access my camera by just executing a malicious ...
0
votes
0answers
30 views

What is the nature of vulnerabilities in JS modules used client-side?

When installing JavaScript modules, I sometimes see that some of them have security vulnerabilities. It made me wonder about the kind of vulnerabilities this could be, and how they could be exploited ...
1
vote
2answers
88 views

What is the impact and threat of Spectre in Javascript?

If you have looked into this demo of Spectre in JavaScript: Did I get it right that only current site memory can be accessed, due to site isolation etc? I saw there is also an addon to detect attackts ...
1
vote
1answer
69 views

Token Auth best practices: how to prevent copying tokens out of the browser?

I am getting familiar with authentication (using passportjs) and using things like sessions, jet, etc. My question is what is the best way to prevent someone from going on a computer and copying a ...
1
vote
1answer
95 views

Is it possible for a javascript malware to put keylogger extension in my browser? [duplicate]

I clicked on "It's like you" virus in Facebook Messenger. Then I archived the original link with archive.ph (archive.today), and during the process the site showed me this: https://pastebin....
0
votes
1answer
47 views

Is it true that frontend validation is generally redundant for minimalist contact forms on minimalist environments?

Say I have a continuously upgraded and well maintained LAMP environment with a website which its CMS is all-core and continuously upgraded as well and I have created a simple backend HTML contact form ...
2
votes
1answer
179 views

Stored XSS Cookie Stealing - shortest payload

I'm testing a web app (for which I have permissions) and I found a stored XSS vulnerability. It is a little bit tricky to exploit because the input: is being capitalized it has a length constraint of ...
0
votes
1answer
45 views

Can this Javascript redirect be exploited in some way?

Since I can modify pathname, search and hash value could I leverages this in some way? var URL = window.location.hostname+window.location.pathname + window.location.search + window.location.hash; ...
1
vote
0answers
118 views

Is this javascript code malicious? [closed]

a friend visited this site: h-t-t-p-s://adidastore.buzz/adidass/tb.php?_t=1614958342 I malformed the url so no one accidently clicks on it Below is the code the site is serving. I don't know ...
1
vote
1answer
99 views

Is it possible to read and extract HTTP request headers via JavaScript while performing XSS & CSRF? If so, how?

Is it possible to read and extract HTTP request headers via JavaScript? i.e. something like; var req = new XMLHttpRequest(); req.open(‘GET’, document.location, false); req.send(null); var headers = ...
0
votes
1answer
95 views

Is there a way to check if my site visitor has visited another site?

I want to know if the current visitor has already visited a specific site. The site is owned by someone else and is on a different domain. Is there a way?
1
vote
0answers
70 views

Prevent XSS in 3rd party (self hosted) application

We have an application which have purchased from a 3rd party and host in our own environment. The application consists of its own UI and back-end, and is included in our own application through an ...
0
votes
0answers
104 views

Get HLS decryption key from browser

How can I get decryption key for AES-128 encrypted HLS stream. In the m3u8 file, the URI for key leads to a file which is of 48 bytes which is encrypted. The stream is played by browser so it must ...
0
votes
0answers
51 views

Can I skip “if” statement with chrome debugger or another javascript debugger?

I see this code in a bug bounty program The code: <!DOCTYPE html> <html> ... </html> <script> if(window.location.pathname === '/' || window.location.pathname.includes('.html')){...
3
votes
1answer
104 views

Are there risks in user-uploaded .txt files sent as a string to PHP

I'm not sure if this question is within the scope of security.stackexchange or it would be more suitable on stackoverflow. Let me know if needed. I'm wetting my feet in PHP, and I've put together a ...
0
votes
0answers
29 views

Libraries or boilerplates providing fundamentals for Public-key generation and encryption of client data?

This may be more suitable for StackOverflow in terms of a recommendation for a library or implementation, but security-related questions are often overlooked or misinterpreted. I'd like to first ...
0
votes
0answers
60 views

How could I improve the security of my design?

I’m building an open-source notes app using electron. I’ll be using rxdb which uses crypto-js to encrypt fields using AES-256 after getting a passphrase and using pbkdf2 to generate a key. Rxdb is a ...
1
vote
0answers
53 views

Zero width character causing Javascript runtime error

On a particular page in this application, we have a form which allows for a very select few to input data into it, because at the end of the day (and, well, event loop) we end up wrappping that input ...
0
votes
0answers
28 views

Whats wrong with this XSS vector? [duplicate]

Payload: <DIV STYLE="background-image: url(javascript:alert('XSS'))"> Reference: http://seguretat.wiki.uoc.edu/index.php/XSS_Cheat_Sheet Can someone please explain why this payload is ...
0
votes
1answer
67 views

how to do a pentest to /assets/js/login.js [closed]

Hey guys this is my first question in this kind of platform. I made a pentest a vulnerable machine this is like a web page video content there are not much target vectors. In my attack a detect only ...
0
votes
0answers
12 views

JavaScript injection minimal example using node/express not working: <script> not executed [duplicate]

I want to create a minimal example where JavaScript injection/XSS is working. This is my example server: const express = require("express"); const path = require("path"); const ...
3
votes
2answers
242 views

Source code being injected into every website

I had a client contact me today because a website I developed (that deals with sensitive information) wasn't loading correctly on one computer on Chrome. After poking around for a while it appears to ...
3
votes
1answer
848 views

How can I read local files from blind XSS?

When I do one of these payloads, I can see /etc/passwd: <iframe src=file:///etc/passwd></iframe> <img src="xasdasdasd" onerror="document.write('<iframe src=file:///etc/...
24
votes
5answers
6k views

What's a way to safely test run untrusted JavaScript code?

I sometimes want to run untrusted JavaScript, mainly for CTFs. It can be obfuscated JavaScript code or something like JSFuck. The point is, I know nothing about the code and just want to quickly see ...
1
vote
1answer
96 views

JS challenge based on computational complexity

Assuming I have a website with a button that sends AJAX requests to my server which will be expensive to process. I suppose that mostly cookie or JavaScript + cookie challenges are used to prevent (...
0
votes
1answer
133 views

CSP allowing Base64 encoded images without unsafe-eval

If I allow base64 encoded images to load on my website, but I do not have unsafe-eval enabled, nor have I allowed 'inline-script' would my site still be at risk by allowing base64 encoded image data ...
0
votes
0answers
51 views

making CORS request to 3rd party API

I am modifying a javascript application running on an apache web server. This runs on a windows server inside of our corporate network which I am referring to as "local server" in the ...
1
vote
1answer
242 views

using rel=“noreferer” without rel=“noopener” or without target=“_blank”

I have been reading about the security and performance implications of rel="noopener" and rel="noreferrer" in links with target="_blank". These are some of the ...
0
votes
1answer
132 views

Is it possible to setup a phishing “honeypot” for proof-of-concept purposes without getting the host/IP blacklisted?

[Edited title according to comments] In the company I work for we have many clients and vast majority of them have hosting with us and we made their web apps. One client though just applied for cyber ...
0
votes
2answers
187 views

Uploading sensitive data, Should I user memoryStorage (buffer) or save and delete file?

I need to save very sensitive data from an Excelfile that the user uploads. The data will then be saved to mySQL. All is done in Node.js. Now I wonder what is the most secure way to upload the file. ...
1
vote
1answer
68 views

Is it secure to use window.origin with postMessage?

When using postMessage it's important to define a targetOrigin to ensure we don't leak data to other sites. It's equally important to check the origin when receiving a message to prevent other sites ...
0
votes
2answers
202 views

Foxit Reader - disable JavaScript / Safely read PDF

Today I disabled JavaScript in my Foxit Reader settings because I hope to gain better security against malware embedded in PDF books I read. As some sort of simple check I tried to open a PDF with ...
1
vote
0answers
155 views

XSS with Template Literals

I suspect I have a potential XSS vulnerability at a client-side level, however, I'm not able to exploit it successfully. The URL I'm using consists of three parameters that reflect back to the user ...
1
vote
0answers
47 views

Would Indistinguishability obfuscation make Javascript cryptography viable?

I know Javascript Cryptography is considered harmful because: Secure delivery of Javascript to browsers is a chicken-egg problem. Browser Javascript is hostile to cryptography. The "view-source&...

1
2 3 4 5
25