Questions tagged [javascript]

The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

Filter by
Sorted by
Tagged with
0
votes
1answer
32 views

Is it secure to use window.origin with postMessage?

When using postMessage it's important to define a targetOrigin to ensure we don't leak data to other sites. It's equally important to check the origin when receiving a message to prevent other sites ...
0
votes
2answers
70 views

Foxit Reader - disable JavaScript / Safely read PDF

Today I disabled JavaScript in my Foxit Reader settings because I hope to gain better security against malware embedded in PDF books I read. As some sort of simple check I tried to open a PDF with ...
1
vote
0answers
42 views

XSS with Template Literals

I suspect I have a potential XSS vulnerability at a client-side level, however, I'm not able to exploit it successfully. The URL I'm using consists of three parameters that reflect back to the user ...
0
votes
0answers
32 views

Would Indistinguishability obfuscation make Javascript cryptography viable?

I know Javascript Cryptography is considered harmful because: Secure delivery of Javascript to browsers is a chicken-egg problem. Browser Javascript is hostile to cryptography. The "view-source&...
0
votes
0answers
24 views

Android: what attack vectors are introduced by calling native code from the web (JS)?

I work on a large e-commerce project, the app in question is written in Kotlin (legacy code in Java). Recently we got the following question from the web team which instantly triggered my alarm bells: ...
0
votes
0answers
26 views

prevent dom based - xss from js file in mvc

I'm using a free template as a front end in my application and the main javascript file came out as a high risk as it's vulnerable to a dom based cross site scripting.Is there a way to sanitize the ...
0
votes
2answers
38 views

DataURL Browser Cache Security Implications

What are the security implications that come with loading an image in dataURL format <img src="dataURL" />? After signing into my website the browser loads an image in dataURL format ...
3
votes
1answer
232 views

How to avoid crash after successfully run shellcode?

I am a student studying information security. Recently I read this article link and made full exploit code. calc.exe is executed as expected. But after running shellcode, IE just crashed. (because no ...
0
votes
0answers
45 views

How do hackers gain access using malicious websites? [duplicate]

I read somewhere that entering a malicious website can infect your machine without you noticing it at all. When someone wants to infect other's computers he has to pass two challenges (as I see this). ...
7
votes
1answer
1k views

How is this site forcing page reloads with JavaScript disabled? [closed]

I have disabled JavaScript using the Firefox extension uMatrix and yet some websites are still able to force page reloads at an interval referenced by a script on that page. How is this possible ...
2
votes
1answer
77 views

What is the point of having a refresh token if it can be as easily stolen as an access token on client-side/JavaScript applications (SPA/PWA)?

From my understanding, the point of having a refresh token and short lived access tokens is to mitigate the consequences of having the access token stolen. This way, if this happens, the attacker will ...
0
votes
0answers
48 views

Blacklisted Param/Header Names in NodeJS?

I've experienced a behavior where I would specify a header/parameter with a certain name in the request and send it to the Node application (using Postman/BurpSuite), but it doesn't appear in the ...
1
vote
0answers
54 views

Wrapped Key Encryption - Hide AES secret key in Javascript & Java

I need to encrypt some sensitive fields back and forth in browser and server, same goes for decryption, for this I am planning to implement AES algorithm, but the problem here is with secret key which ...
0
votes
2answers
48 views

Does CSP mitigate against client prototype pollution XSS and DOM XSS?

DOM XSS and client prototype pollution-based XSS have one thing in common, we are modifying the pre-existing JavaScript code to popup an alert(1). Will CSP mitigate XSS in this case? Theoretically, ...
0
votes
0answers
41 views

Javascript PDF Brute Forcing

I am trying to learn PDF Brute forcing with javascript. I've read about encryption algorithm of PDF 1.4 documentation here https://www.adobe.com/content/dam/acom/en/devnet/pdf/pdf_reference_archive/...
0
votes
0answers
50 views

It's possible to bypass CSRF protection Referer-Based by spoof the referer in browser victim ? (POST-Based)

It's possible to bypass CSRF protection Referer-Based by spoof the referer in browser victim ? (POST-Based) Hello, i try to bypass a CSRF protection Referer-Based. I know the basic knowledge to bypass ...
0
votes
1answer
82 views

SQL Injection and Hidden parameter modification

A friend of mine gave me a web application for me to test and find vulnerabilities. He told me that this web application can be purposefully modified and then made to run an SQL injection. I have ...
1
vote
0answers
45 views

Can “c:set” cause Cross Site Scripting (XSS) vulnerability?

Can this be exploited as XSS vulnerability using urls like localhost/?myVar=<script>alert(document.cookie)</script> or though any other possibility? <c:set var="myVar" value=&...
0
votes
2answers
78 views

What parts of the javascript code can an XSS attack access? [duplicate]

I understand that XSS attacks can access all globals (like cookies, storage, etc) within the context of the running javascript code, but I would like to understand if they could also have access to ...
6
votes
2answers
136 views

What impact does an installed extension have on the browser fingerprint (uniqueness)?

Motivation I want to develop a custom, local Firefox extension and investigate, if its installation has any impact on the browser fingerprint. Background Some time (years?) ago, there were articles ...
0
votes
1answer
38 views

Node.js static file security: What happens if hackers can control my bucket?

I'm new to Node.js and I have Node.js App with Vue. I use AWS S3 to server static JS file like app.XXXX.js manifest.XXXX.js vendor.XXXXX.js So what is the security implication if a hacker can gain ...
0
votes
1answer
74 views

It's possible to trigger a XSS in url context without this following caracter ' : '?

I try to bypass a XSS filter to trigger a XSS in url context. But the problem this following char is blacklist ' :' The site allow the user to use some basic html balise like h1, h2, h3, p, a, u, etc ...
8
votes
2answers
328 views

Solution to the ‘Browser Crypto Chicken-and-Egg Problem’?

From time to time, questions come up in this board concerning web applications that utilize client-side cryptography (or ‘in-browser’ cryptography), where these applications claim to be designed in ...
1
vote
1answer
57 views

XSS in a variable assignment when <>" are escaped

SCENARIO: user input is reflected inside a variable. For example url.com/?a=hello is reflected as shown below var test="hello"; I tried to evade from the variable with payload like hello&...
48
votes
2answers
11k views

Magic hash attack in JavaScript

In PHP a magic hash attack happens when loose type comparisons cause completely different values to be evaluated as equal, causing a password "match" without actually knowing the password. ...
17
votes
1answer
3k views

Why is there no web client for Signal?

I’ve read about E2EE (end to end encryption) of Signal in web clients on a Signal Community discussion forum, and wonder why they say that the browser is insecure for E2EE and native apps are secure. ...
3
votes
2answers
203 views

Can a web page really log keystrokes on a different page shown later on the same tab (or a different tab)?

According to this Reddit comment, an advertisement on one page seems to be able to log a user's keystrokes on a different page (if I understand the comment correctly). Is this really true? Can an ...
0
votes
1answer
184 views

Nodejs-express: file upload vulnerability with txt files?

On nodejs-express, I need a file upload function for my website's bulletin board so that every user can upload and download files for each other. For security reasons, I use npm module 'mmmagic' for ...
1
vote
0answers
69 views

How would you follow all JavaScript calls after a click?

I'm using Google Chrome developer tools. Let's say I'm performing a bug bounty activity. I found an obfuscated JS. I know user data goes into this JS and goes out encrypted. I found a few files called ...
0
votes
1answer
176 views

Can a .exe file scanned and verified safe by many antivirus hack my personal information?

I recently downloaded a .exe file from a person's github. I scanned the file in virustotal.com and it showed none of the antiviruses detected a virus. When I checked its behaviour, it had access to ...
35
votes
3answers
5k views

Can ISPs replace a website's HTML/JavaScript/HTTP headers with something else?

It seems to me that "yes, they can". As I saw it in some countries, entering adult content will simply give a warning message that the site is blocked. Some places even block Facebook ...
0
votes
1answer
91 views

XSS in script tags application/json - possible?

Is there way to execute alert box if " is not correctly escaped and can be injected in example below? <script type="application/json">{"requests":{"postClicked"...
0
votes
1answer
257 views

How to prevent XSS attack on selected window.location in javascript

This is my code where i have a userId in a method SwitchUser_Click. I need to prevent or somehow encode the return value from the switchUser_Click as it includes the UserId of a user vulnerable to ...
1
vote
1answer
55 views

XSS Prevention Code [closed]

I was just wondering if this code is enough to prevent XSS vulnerability in my web app? /** * Escape HTML string to prevent XSS. */ export const escapeHtml = (string: string): string => { if (...
2
votes
1answer
119 views

Is javascript fingerprinting becoming obsolete?

Okta recently sent out an email to admins about changes to their new device detection strategy. According to them: Due to browser advancements in anonymous web browsing, JavaScript fingerprinting ...
0
votes
0answers
46 views

XSS injection into javascript string

Is XSS attack possible in this scenario? As you can see I am able to inject JS by not properly escaped backslash. <script type="text/javascript">(function () { random.random(); random....
1
vote
0answers
43 views

Can input value escape a JSON object?

I am passing value from input filled directly into a script function inside a JSON object. I was thinking, is it possible that this input can escape this object and can lead to XSS or something. <...
0
votes
2answers
63 views

What attack vectors does arbitrary JS on a user profile allow?

Consider a site for frontend devs/designers to host their portfolio apps - pages with arbitrary JS, each hosted on a user's separate profile. What attack vectors would that enable against the site? ...
0
votes
0answers
51 views

Manipulate auto execution of Javascript since Burp can only see HTTP Requests/responses

There a javascript that is executing in my browser and it is generating session token. (This was a design requirement to the dev team Sesion token is generated on the client side - don't ask me why ...
0
votes
0answers
52 views

Can we know which client side script is performing a particular action on a website?

Recently in an website I had noticed that the data which is received from the server is not the data that is being displayed.I think it would have been modified on client-side. So, Is there any way by ...
0
votes
0answers
41 views

CORS response received in burp but not in browser console

NOTE: I am authorized to test this I was able to find a CORS vulnerability while intercepting it with burp, but cannot exploit it using browser. The request I sent in burp was: POST /xy/ HTTP/1.1 ...
1
vote
0answers
46 views

DVWA file upload background

I've just started in penetration testing with metasploitable and currently trying to learn file upload vulnerability present in DVWA module. I know that somehow upload is preventing files other than ...
1
vote
0answers
133 views

Suspicious behavior by Google when verifying users via nodejs

I'm building a user authentication system in Nodejs and use a confirmation email to verify a new account is real. The user creates an account, which prompts him/her to check the email for a URL that ...
3
votes
1answer
108 views

Are Javascript closures a useful technique to limit exposing data to XSS?

I'm wondering if using Javascript closures is a useful technique to limit exposing data to XSS? I realize it wouldn't prevent an attack, but would it reliably make an attack more difficult to execute, ...
0
votes
1answer
28 views

Can you set a custom x-forwarded-host header in a CSRF form page?

Can you set a custom x-forwarded-host header in a CSRF form page (not xhr)?
2
votes
1answer
32 views

CSRF: GET request with POST data?

I have stumbled upon a vulnerability in a web application and was wondering if it was exploitable / worth reporting. The bug is a CSRF which would allow an attacker to send friend requests to himself ...
0
votes
0answers
95 views

Are web worker / service worker secure environments to store a password, credit card information, access tokens?

If there is a case where I wish to store sensitive data like a password, credit card information, or access tokens: Are web workers / service workers a secure environment, where such data can not be ...
1
vote
1answer
297 views

Local file inclusion in JS app [closed]

I am working on a project which requires the name of the page as a query parameter 'path'. The app stores path variable as res.query.path. My manager asked me to pay attention to LFI, so I'm concerned ...
2
votes
2answers
166 views

Popup alert even when a site deletes the alert function?

A website fully filter the alert function from his website, and replace it with an empty string, but I want to bypass it and still popup an alert, I am trying to solve an XSS challenge, and I figure ...
2
votes
3answers
90 views

How to secure a price passed to a payment gateway on client?

Using Javascript, say a customer buy a product that cost 10$. Many payment gateways, like PayPal and Stripe, offer a client side Form where you input the sale data (price, amount, buyer address, etc), ...

1
2 3 4 5
24