The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

learn more… | top users | synonyms

2
votes
2answers
295 views

Risks of client-side encryption using Stanford Crypto Library

I'm building a simple web application for encrypted chat. Each message will undergo 256-bit AES encryption on the client side, using the Stanford Javascript Crypto Library. No unencrypted data or ...
0
votes
1answer
334 views

UTF-7 XSS attacks in modern browsers

I've recently read about utf-7 XSS-attacks (i.e. Ned Batchelders article at http://nedbatchelder.com/blog/200704/xss_with_utf7.html) but could not get any UTF-7 attack to work in modern browsers. (I ...
5
votes
2answers
115 views

Any eventhandlers that apply to hidden elements?

Im trying to XSS a search field and my attack vector is getting reflected like this: <input type="text" id="txtRpHiddenKeyword" style="display: none;" value="ATTACK VECTOR HERE" /> Only ...
-1
votes
2answers
82 views

Protecting sensitive content in JS source code and Ajax cals [closed]

I've been trying to see how to properly protect important content that's passed in ajax calls with java script. Considering JavaScript can be viewed at any point, it is inevitable that some of your ...
0
votes
2answers
161 views

NGO Joomla! site: Infected with malware? JavaScript injection?

Please help us with this NGO site running Joomla! 1.5. They can't pay a security professional right now, so maybe you guys can help isolate the problem? If you go to http://casatrespatios.org you ...
12
votes
4answers
805 views

How do I protect myself from clickjacking attacks?

I've seen many friends getting clickjacked on Facebook and similar sites. How does one detect and prevent clickjacking? How should I teach my friends to do the same?
0
votes
1answer
50 views

Seeking help with implementing SCRAM in .NET

I'm late to the party and need to be caught up. I'm doing my homework looking things up. I know that I don't want unsalted challenge-response CRAM, I want salted challenge-response SCRAM. I think ...
1
vote
1answer
83 views

How do you limit javascript api to a domain?

Ok, many of you now the scenario: you login to developer.sayLinkedIn.com, create an app with credentials and define the domain in witch that key is allowed to "run". The question is, from a api ...
2
votes
1answer
389 views

Access-Control-Allow-Origin header spoofing?

Is it possible for a attacker to spoof the Access-Control-Allow-Origin header? Or, is it secure enough to protect resource access via the Access-Control-Allow-Origin header? I'm trying to make an ...
1
vote
1answer
261 views

Security implications of adding all domains to CORS (i.e. Access-Control-Allow-Origin: *) [duplicate]

I am curious of what all the security implications are if I set the following two HTTP response CORS headers; Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false The only ...
2
votes
1answer
1k views

Is it safe to give an Oauth token to client side javascript so it can directly make requests to a server?

I currently have a simple backbone.js application served from my domain (example.com), which is provided an Oauth token. Specifically, I pass the Oauth token through my page template into the ...
0
votes
1answer
88 views

Verifying one specific attack vector of Cross Site Scripting

Burp suggests that there is a reflection.. It changes a value of a cookie named as x as x=<script src=abc.js> and in response this value gets injected to a javascript function.. <script ...
3
votes
1answer
318 views

OWASP Recommendation on Client-Side Password Hashing

The OWASP Application Security FAQ recommends the use of JavaScript to produce a salted hash of the password client-side with JavaScript prior to sending it to the server. Is this something truly ...
-2
votes
1answer
279 views

Open Source tool for analysing javascript for security vulnerabilities [closed]

I am completely new to this field and am a college student. I am looking for a static code analysis tool that scans the source code of a web app ( NOT the URL) for security vulnerabilities. So far i ...
1
vote
1answer
662 views

Are these both cross frame scripting attacks?

I've received a recent security review of a website which mentioned it had a cross frame scripting vulnerability. In short, it mentioned that a malicious site could load the page up in an iframe, ...
1
vote
2answers
338 views

What's the limit on the size of the data that public-key cryptos can handle?

Someone mentioned here that asymmetric encryption might not be appropriate for bulk data and gave an example of RSA with 100 bytes. Of course, I understand that it was a rough example. But it made me ...
2
votes
2answers
844 views

How to stop other website to send cross domain ajax requests?

From 2 different applications, I was able to send cross-orgin requests. Though the browser return an error of Cross-Origin, but my server is still receiving and executing the request. For example, ...
1
vote
2answers
173 views

Can older or custom web browsers override the same origin policy?

I totally understand the basis of origin policy and the reasoning why all modern browsers have put this policy into place. My question I guess is, do older browsers support this, and if they don't, ...
-1
votes
1answer
121 views

Reflected XSS Prevention plugin [closed]

Is there any plugin out there which prevent reflected XSS? Plugin could be either for firefox or chrome. Thanks.
1
vote
1answer
112 views

Does Google Analytics collect any information about the contents of the web page?

If I enable Google Analytics on my web application, does the Google Analytics Javascript collect any information on the web page (any of the content on the page)? Does it collect any information ...
1
vote
1answer
137 views

Security implications of hosting third-party Javascript [duplicate]

A client of ours wants us to host a blob of Javascript for their custom-branded version of our website. It is hosted on a subdomain of our site (customer.example.com), but uses the same cookie domain ...
0
votes
1answer
591 views

Calling JavaScript functions from within a Style tag XSS

I've identified an XSS in a client's application where they've failed to properly sanitize a variable. The application, however, is written in ASP.NET 2.x and they have request validation turned on. ...
8
votes
4answers
535 views

I've encountered JavaScript attack code - how do I search for information on the exploit's specifics?

So, I clicked on a reasonably-looking LinkedIn invite, not thinking about hovering overing the link first, since usually the e-mail client warns me about such things. Once I realized I landed on an ...
1
vote
1answer
63 views

Gaining sensible information from advertisement displayed in web pages

As we all know, JavaScript loaded inside a website A gets restricted to access the domain itself [same origin policy]. Unfortunately, same origin policy does not apply to newly created DOM nodes, ...
5
votes
1answer
487 views

Child iFrame hash verification of parent iFrame content

Consider the following scenario: Alice wishes to browse Victor's website while on the job at Initech. Victor's website is hosted on an alternative domain name system to which Initech's DNS does not ...
4
votes
2answers
90 views

To What Extent does an Attacker Have Access to the Browser History through the CSS Pseudoclass :visited Styles?

I have read this article on how a scripted web page is able to obtain the visited history of a user browsing the page. However, I can't find any clear information in the article describing the extent ...
1
vote
1answer
227 views

Is it possible to execute xss under these conditions?

Is it possible to execute xss under the following conditions? The following blocked characters and words are replaced with _. characters: > , : , ; , " , ' , # , ~ , \ , % , ( , ) , [ , ] , { , } ...
2
votes
1answer
107 views

Sandboxing user input html

I want to render user uploaded HTML (consisting of possibly many files with images, custom css, custom js, all uploaded in a zip file) for preview purpose. The user that submits the html will be the ...
2
votes
2answers
310 views

Need help deciphering malicious JS code

was hoping someone could give me a hand with deciphering this obfuscated Javascript added to a webpage that I own. As the code is quite large I will just link to pastebin posts but I can add them to ...
1
vote
3answers
253 views

What is the risk of cross site scripting if I embed javascript into a website

What is the risk of cross site scripting, if I embed javascript into a website? Quite simply, I am using a 'site builder', and they don't allow rotating images, but they allow you to embed code... So ...
1
vote
1answer
339 views

How to detect if a site is using a javascript exploit?

Is there a way for me (non-expert in javascript) to detect javascript attacks from a website. I have done alot of searching around and have not come up with a definitive answer. NoScript is a pain in ...
2
votes
1answer
96 views

Unusual ownership-ID using localStorage; any possible issues?

I'm working on a small side project in PHP. I may yet include some sort of actual username/password registration down the line, but for now, for ease of attracting attention, my goal is to allow for ...
1
vote
1answer
243 views

If my website does not take any user input, is there any danger in showing my code and folder structure?

First time posting here; apologies for any mistakes I've made, please edit, retag, migrate as appropriate. I have a simple homepage whose purpose is (essentially) to contain my contact info and some ...
0
votes
1answer
193 views

Secure browser storage

Where is a secure place to store a "secret" in a web browser that a User has access to and JavaScript does not? Thinking was along the lines of web history, bookmarks, built in password manager & ...
2
votes
3answers
5k views

Why is JavaScript disabled in the Tor Browser Bundle?

Didn't Tor create a local socks proxy? Why doesn't all the Web traffic go over this local socks proxy and why is JavaScript disabled in the Tor Browser bundle? If you would connect with firefox for ...
0
votes
1answer
3k views

Create RSA public, private key pair having numbers generated already

I want to know to to generate working RSA key pair, with correct syntax. Let's say i have already generated somehow my numbers for 512bit key, which are: e = 00065537 d = ...
2
votes
3answers
1k views

Javascript containing a long hexadecimal string and eval: is this suspicious?

At the bottom of the index.php file for a simple “contact us” form, I found the following (some whitespace and newlines added): try {if(window.document)--document.getElementById('12')} catch(qq) ...
41
votes
3answers
3k views

I found obfuscated code in a comment on my blog. What should I do?

Today I was checking comments on my blog and I found a strange comment, here is the exact text <script>var ...
1
vote
3answers
458 views

Implementing 'Remember Me' for a mobile application

I am developing a mobile application wherein I need to implement the 'Remember Me' functionality. There are certain pages within the application which require you to login. What I need to do is, if ...
0
votes
2answers
343 views

Hide XSS payload

Scenario : There is a persistent XSS on a page with the username information. The username is present three times in the page, is visible only once and the visible one is correctly escaped. How ...
8
votes
3answers
311 views

How could the string \";alert('XSS');// be used for XSS?

I was using Burp Suite for some testing and I noticed that they included the following string: \";alert('XSS');// as an attack string for an XSS payload. How could this string be used to execute ...
2
votes
2answers
212 views

Exploiting flash XSS holes

I have a URL to a flash file. Sample :- http://abc.mydomain.com/Findme.swf Now, there is a parameter called xmlpath as :- http://abc.mydomain.com/Findme.swf?xmlPath=something. Is it not that ...
1
vote
1answer
1k views

In which ways could a javascript making a cross domain HEAD request be a threat?

I was just reading this answer to the question Why is the same origin policy so important? Basically, when you try to make an XMLHttpRequest to a different domain, the browser will do one of two ...
5
votes
2answers
383 views

How to ensure that files uploaded by users do not contain any XSS code

I have been working on providing the security related to the XSS attacks. My website only allows following mime-types: XML, CSV, HTML, PLAIN, VND_WAP_WML, APPLICATION_ZIP, APPLICATION_PDF, ...
1
vote
1answer
165 views

When a browser extension or user script pulls a JS file from Google's CDN, how does this compromise the user's privacy in terms of Google's reach? [duplicate]

The context from which my question has arisen is this user script which locally removes ads from Ixquick.com, which is an anonymizing 'proxy' search engine that gives the results from Google's index ...
2
votes
3answers
1k views

Javascript Diffie-Hellman and AES protocols

I am using the BigInteger Javascript library to create a symmetric key using Diffie-Hellman protocol. I want to create 128,160 or 192-bit keys. After some research, I have found out that I should use ...
3
votes
2answers
404 views

SJCL : convert ascii to a BitArray & compute random numbers

I am using the Stanford Javascript Crypto library and i'd like more information about it. 1.) I have an ASCII text and a random 128-bit key. I want to concat those two things, so I convert the ASCII ...
3
votes
2answers
247 views

Injecting information in a web page (Gmail). Does it raise security problem?

I am developing a Google Chrome extension which encrypts/decrypts emails for Gmail users. So, I detect encrypted emails when the user opens an email on using tags. Once an encrypted email has been ...
4
votes
1answer
488 views

XSS JavaScript Double Quoted String with HTML Escaped Possible?

Is it possible to inject XSS in a JavaScript variable if a website inserts HTML encoded, user input in a double quoted string? var userString = "perfectly &quot;safe&quot; input from user?";
2
votes
1answer
188 views

Are GET, POST and windows.location vulnerable to XSS in a Wordpress theme?

I created a Wordpress theme for my client. He told me that he scanned my theme with a vulnerability scanner, and that it has security issues with the GET and windows.location methods. Is this really ...