The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

learn more… | top users | synonyms

0
votes
0answers
12 views

From a credential flow perspective, whats the difference between FIDO UAF and FIDO 2.0 Web Services?

The FIDO Standard allows for devices and authentication schemes to be certified as UAF or U2F. This allows for flexible unified authentication, and optional second factor enrollment and registration. ...
0
votes
1answer
48 views

How trivial is identifying a Tor user with JavaScript enabled/ 'allow scrips globally'?

I was browsing using Tor, with Javascript enabled/ 'allow scripts globally'. I made an automated take-down request for something posted on a website, and the next day went back to check if the item ...
-5
votes
1answer
41 views

Is possible to get password with stored XSS? [on hold]

Is it possible to get password from a site with stored XSS? I have a forum where I can put JavaScript not directly but inside HTML (like <div onclick="alert()">CLICK</div>). Is it possible ...
1
vote
2answers
76 views

Bypass CAPTCHA form made with 100% JavaScript?

There is a website I have found where the JavaScript handles the response of the CAPTCHA and then proceeds to fire what I believe is an AJAX request. So the flow is as follows: Button -> ...
1
vote
0answers
31 views

JavaScript variable evasion when quote is escaped, but not newline

I'm searching a way to properly evade from a JavaScript variable to perform XSS. A normal user input will give var a='<b>user input</b>'. a isn't eval anywhere and is not usable. ...
-7
votes
0answers
63 views

How to spoof browser fingerprint? [on hold]

I need some JavaScript code to spoof the following browser information to make a fake fingerprint: Limited supercookie test Hash of canvas fingerprint Screen Size and Color Depth Browser ...
1
vote
1answer
48 views

XSS Page Cannot be Displayed

When I try XSS on various websites, such as inserting " onmouseover="alert(1) in a search box, I either get a message saying You don't have permission to access this page or This page cannot be ...
-4
votes
0answers
41 views

Explain this jQuery in simple terms [closed]

What does this line of code mean? jQuery("#HiddenReferral").val(jQuery(location).attr('href'));
1
vote
1answer
41 views

DOM based XSS: jQuery(“#HiddenReferral”).val(jQuery(location).attr('href'));

DOM based XSS has been reported by Burp Suite and showed this query as vulnerable: The application may be vulnerable to DOM-based cross-site scripting. Data is read from location and passed to ...
3
votes
2answers
96 views

Is it possible to trick a person into going to a website, and running JavaScript, without them knowing? (no iframes)

My website is W. If you make a GET request to my website, it gives you JavaScript, and if you execute the JS, then you do some action (if you are logged in and have a session cookie). Can someone ...
0
votes
1answer
38 views

XSS to overcome HTML entities

In a search box (<input value=" *insert search term here* "...>), when I input " onmouseover="alert(1), the double quotes are converted to their entities, so it's not possible to break out of ...
4
votes
2answers
79 views

Is this codes usage of document.location.toString() a DOM based XSS vulnerability?

I have come across the following JS code in multiple web applications. I think the reason for the popularity of this code snippet is this accepted answer on SO. Developers seem to be using this code a ...
3
votes
1answer
60 views

Revising Phising Email & it's payload… did I do this right?

Recently my company got a widespread phishing email sent to them, thankfully no one clicked the link (which is great!) Since I'm a student and a current intern working in IT Security I wanted to see ...
-4
votes
1answer
59 views

No SSL: Web Application Security using html fragment identifier (#)

I am currently running my website in shared hosting, and I am not able to register TLS/SSL for my website. However, I implemented jsencrypt [A Javascript library to perform OpenSSL RSA Encryption, ...
1
vote
0answers
19 views

Is it safe to use DOMParser to parse client side XML files

Some javascript frameworks or libraries use the DOMParser API to parse XML files from the client. Is it safe to do this. Malicious code can easily be embedded into the XML file (in either the ...
-1
votes
1answer
51 views

Svg width element XSS

I'm working on a svg image generator. Now I want to set the user width and height value. Can a user exploit this element tags? And what should I do to make this secure? <?php $user_input = ...
0
votes
1answer
40 views

Is it secure to get auth TOKEN from server with javascript?

Is it secure to manipulate with auth token inside client side javascript over https ? I want to pass that token to websocket after login. $.getJSON( $SCRIPT_ROOT + '/jscript_get_auth_token', {}, ...
2
votes
1answer
94 views

How to identify coded content in a phishing page [closed]

First of all, I'm a completely dummy in information security. Today morning I've received an email that make me curious. It was a kind of phishing page which was not detected by the Gmail's spam ...
0
votes
1answer
36 views

Site stores cookie name and user id in script tag after login. Is this an issue for either xss or session highjack?

Upfront I will say that this is not my website and that I am simply doing a general audit (for non security issues), but ran across this in the source after logging in. Another script tag for ...
0
votes
1answer
79 views

Why would I need to use the PRIVATE key to verify a file signature?

I use JavaScript to open CAPICOM store to choose certificate. After that I export selected certificate, public key and private key of that certificate and put them in three hidden fields. var ...
40
votes
28answers
13k views

Discouraging users from copying images off a website?

Let me begin by stating that I'm aware it's extremely tedious or virtually impossible to prevent individuals from pirating content. I'm working on a website for a client who is a relatively well ...
1
vote
1answer
27 views

Serving javascript from an API and having that execute on the client

I have been proposed a solution where our API serves up some JavaScript which will be executed on the client. The code will render some HTML on the client and provide some functionality such as ...
4
votes
1answer
85 views

Risks of HTML/JavaScript window.opener security flaw?

I do not know if you are aware of this flaw, but here is a basic example: somepage.html (pointing to malicious.html): <!DOCTYPE html> <html> <head> <meta charset="utf-8"> ...
1
vote
0answers
48 views

Compilations of PoC of JavaScript vulnerabilities?

I am a researcher looking for some proof-of-concept JavaScript vulnerabilities like XSS that exists in some website or JavaScript libraries in the past. Are there any compilations of them?
1
vote
1answer
65 views

How can I get infected by computer viruses? [duplicate]

I would call my self a security aware computers professional, and I was asking my self for a long time now allready. How can it be that male-ware gets onto my computer wihtout me actively playing it ...
-4
votes
2answers
43 views

Forcing javascript on to a server [closed]

this might be on the edge, but the purpose is not illegal. I want to edit a javascript on a server and feed it to the server with a change. Is this possible? To either edit it within the server and ...
-9
votes
2answers
104 views

Noob to tor/tails/darknet…forgot to disable Javascript. What to do now? [closed]

I am a noob as stated in title. I didn't know how to disable Javascript before visiting some not-so-legit sites. So what can I do? I was using tor, I know this is not enough so I have tails ring a ...
2
votes
1answer
57 views

How and why does case insensitive XSS work, given that JavaScript is case sensitive?

I found a lot of instances where XSS scripts like the following work: <iMg SrC=x OnErRoR=window.location=123> Given that JavaScript is a case sensitive language, how is the browser able to ...
0
votes
0answers
27 views

Executing JS script in Bootstrap popover without “<” and “>” characters (XSS) [duplicate]

In the system that I am working on I have a simple form. In the form there is an input called "ID". The contents of the input is than displayed in a Bootstrap popover (after clicking the "i" icon) ...
1
vote
1answer
153 views

What is the Javascript trying to do/exploit? [duplicate]

I found the following javascript in a .zip attachment to an email. (Said zip file was opened on a new KVM virtual machine with none of my data on it while running an Ubuntu LiveCD session. Just to be ...
1
vote
1answer
63 views

Client-side encryption using public-key

My situation: Login password from a POST request is left in browser memory in clear text as long as cache is not cleared (manually/closing browser). Connection is HTTPS. Possible Solution: ...
13
votes
2answers
656 views

Advertisement on Skype tried to download a file to my computer using Javascript

I usually have Skype running in the background. If you have ever used Skype before, you probably know it has advertisements. One of these advertisements made two windows pop up on my screen, asking to ...
4
votes
3answers
136 views

Recent hack appends to all javascript files

I have about 10 websites hosted on shared server by a2hosting, on apr 20 some of the js files for some of the websites were appended with a function that detects the device and if it is mobile it ...
3
votes
1answer
94 views

Is it possible for XSS to occur in src attribute?

I'm working on XSS vulnerability and understanding it. I know in following cases cross site script injection happen in Javascript context Inside <script> tag. Inside html tag in event handler ...
2
votes
0answers
44 views

Prevent external script from loading using Burp

I am using free edition of Burp Suite to analyze some requests. Suppose, website is https://www.example.com. Now, there is a javascript file in https://www.example.com/templates/scripts/xyz.js. I ...
-2
votes
1answer
79 views

Clicking a lot of website links in Google Maps, then sent through multiple URL redirects, and lastly to a page that made my laptop start beeping?

I was in Google maps clicking on all the website links listed in the side panel, looking at every website really fast. Note, they were all tattoo parlors. One of the links I clicked bounced me through ...
3
votes
1answer
145 views

Does the use of JavaScript make ProtonMail insecure?

I like the look of ProtonMail. However, what has stopped me from signing up is that JavaScript seems to be used at various points in the site, and for someone to read your email they must click on a ...
-1
votes
1answer
83 views

What is this script supposed to do?

I just got a sketchy email to my University email. There was a zipped folder, containing, a lone js file. It reads: var ...
1
vote
0answers
69 views

Security flaws while storing auto-login token

I must to accomplish auto-login with a token on my website. Token is generated on back-end, on front-end (Single-Page Application) I have to store token in secure way. I'm using secured channels ...
2
votes
2answers
89 views

Security feature: Preventing javascript from closing the window

The latest versions of most web browsers have implemented a feature to prevent javascript from closing current window or tab. Firefox window.close() method This method is only allowed to be ...
6
votes
2answers
204 views

Is this a Javascript virus?

So I got a random email saying this. Looks very automated: "How are things? I was visting your website on 4/9/2016 and I'm very interested. I'm currently looking for work either full time or ...
0
votes
3answers
59 views

Typical 'search box' XSS attack

When I develop a site, I'm always conscious of security flaws, but I'm struggling to see how a search box could ever be used to inject script that could be ran on a page of mine. So I understand ...
0
votes
2answers
70 views

What are the possible security issues when making a checkout system in Javascript?

I'm pretty new to JS and I am currently making a simple step-wise checkout system using purely JS and some Ajax and PHP. I have been wondering about the possible security issues that might pose with ...
1
vote
0answers
47 views

How to remember the trusted machine in an application

We need to remember trusted devices in our application. I have done some R&D for this and found out that Facebook achieves this using cookies. But, if I see Google, they don't use cookies, I ...
2
votes
1answer
68 views

Is JavaScript needed for browser code execution vulnerabilities?

Does JavaScript VM have to enabled in a vulnerable browser to exploit an arbitrary code execution bug? There is a number of bugs in borwsers that don't seem to involve JavaScript. For example, ...
1
vote
0answers
30 views

Authenticate with ADFS without Javascript?

I'm trying to allow a search engine that doesn't support javascript to crawl content protected by ADFS. Is there a way to allow clients that don't support javascript to authenticate to an ADFS ...
21
votes
2answers
3k views

Can javascript execution from address bar cause any harm to client's machine?

Given the fact that modern browsers these days prohibit JavaScript from having access to any resources on the client's machine, does JavaScript execution from the address bar pose any threat at all to ...
0
votes
1answer
89 views

What are these links that have been sent to me multiple times on facebook?

2 friends of mine have sent me very suspicious links on facebook, which ask me for credentials on an external site. Entering hello@example.com in the username, and 1234 for the password let me in, and ...
0
votes
1answer
47 views

Malicious tracking script being served from google server to circumvent block lists

I've found some bad JS that tries to open pop-unders and even deliver a likely malicious SWF file for a flash exploit. Thing is, its stored on a google server in a directory it really shouldnt be. ...
-3
votes
2answers
96 views

How to find Use-After-Free vulnerbilities? [closed]

I followed a lot of tutorials about the exploitation of UAF vulnerabilities, but there was never explained how to find and detect uaf vulnerabilities in javascript or html (i.e. with a static analysis ...