The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

learn more… | top users | synonyms

5
votes
5answers
275 views

Avoid unauthorized updating of online leaderboard php/sql [duplicate]

I am developing an offline web app (game) for android using cordova (phonegap). The leaderboard of the same is maintained online in my server. Currently this is how the leaderboard is updated Step 1)...
4
votes
1answer
192 views

OneDrive marked unsafe by Google Chrome due to unsafe scripts

The OneDrive user's drive page asks to load the following script (which is typically blocked by Chrome to be unsafe) <html> <head> <title>Bing</title> </head> <...
2
votes
1answer
63 views

Crypto in browser

It's almost 2016 and javascript encryption libraries have been around for a while. My question is, have they improved? Or should we still abandon the idea of having encryption done in our browsers? ...
3
votes
2answers
145 views

WebCrypto algorithms and differences with other crypto libraries

I was looking at the WebCrypto crypto libraries coming form the W3C. Looks like only a few cryptosystems are supported, including AES-CBC, AES-CTR, AES-GCM, and RSA-OAEP. https://developer.mozilla....
26
votes
7answers
4k views

How to replace SSL/TLS?

I have to make a website for a NGO (Non-Governmental Organization), and they have the minimal options from their provider, so they can't have SSL/TLS (barely only HTML/PHP/MySQL/JS) The data that ...
3
votes
2answers
106 views

Can the contents of a web page be protected from modification

We are developing an application sending highly sensitive data over the Internet. For this we use client side encryption so that even if an attacker would get access to our servers, the data could ...
2
votes
0answers
62 views

Bypass an escape function - SQL injection (Educational Purpose) [duplicate]

I am trying to simulate an SQL injection on a VM Apache server. The query I send is being converted into the part of a parameter's value i.e an escape function is restricting me. For example if I ...
1
vote
1answer
89 views

Before an attacker attempts to exploit eval(), how would they suspect that it is being used by a target application?

I am asking the question in the context of XSS RCE/RFI as a result of server-side eval() exploitation. It is often recommended to avoid using it, but it is not clear to me how one would attempt to ...
2
votes
2answers
83 views

How do I prevent extra javascript from being added into HTML kiosk in public space?

I'm planning a project which is to be PCI compliant, but I am stuck on a particular vulnerability and I can't think of a way to protect against it. The scenario is that there is a kiosk installed in ...
6
votes
3answers
251 views

How to convince team mate about using a whitelist?

Context In our development team, we have to build a component. This component is a full client side one written in Javascript. A client web application wishing to embed this component will call it ...
3
votes
2answers
213 views

Javascript injection in email address as username?

Is it possible for a valid email address (something that would work if used send to gmail, for varying definitions of valid (the email would be received not the exploit)) to contain javascript that ...
0
votes
3answers
303 views

JavaScript encryption for websites delivered via IPFS

I would like to encrypt user data in JavaScript in a browser before it gets sent out for storing. I read that this is generally a bad idea but considering the following points at least most of the ...
1
vote
2answers
242 views

Is HTML5/JavaScript more secure than Flash/Java, as the browser becomes more like an OS? [closed]

I have been asked to post this here: I want to focus on the security of the end-user in these two different scenarios: 1) Pre HTML 5 where the applications and so on lived in plug ins outside the ...
45
votes
3answers
4k views

For an end-user, is HTML5/JavaScript more secure than Flash?

I’m not talking about server-side security or even necessarily XSS vulnerabilities, as these are attacks on vulnerable services and do not use any pre-existing vulnerabilities on the client side to ...
3
votes
1answer
170 views

Understanding hack on ecommerce site

I need help in understanding this hack and maybe I can get more information out of it. This script was inserted on our website (maybe through a weak password): eval(atob("string")); the string ...
0
votes
0answers
37 views

Youtube API security

I was playing about with youtube's API yesterday and did some research about its security. Now.. I have a website which I would like to apply Youtube API for it and I just wonder how NON-secure is to ...
1
vote
1answer
56 views

When is CORS applied?

I'm including some RUM (Real User Monitoring) JavaScript on a client's website that beacons back performance info. I was expecting to run into CORS issues but it seems to be working without any ...
2
votes
1answer
106 views

Is this a secure way to handle a JSONP response?

I am working on a non-critical script which will be run periodically - it's really just for the entertainment of the dev team. Because it's for fun, it does not really matter if it crashes sometimes (...
1
vote
2answers
112 views

How to encrypt data in email body sent by (offline) app and decrypt on server

I've build an (offline)app (HTML/JS). The app allows the user to write a report (event when he is offline). The data from the report is sent via the body of an email to the companies special email ...
-1
votes
1answer
155 views

XSS display cookie of another website

Trying to practice XSS on dummy website. My end goal is to display the victim's cookies on my "attacker" site. Currently what I have is that when the user enters my site, it will pop up the dummy ...
0
votes
1answer
115 views

Techniques for accessing hidden content on a web page [closed]

If content is hidden on a web page using a CSS hidden directive (consider this example of hiding the Sharepoint 2013 Share button with CSS). What techniques allow the user to circumvent that and ...
2
votes
1answer
756 views

HTML iframe security exploit

Can somebody explain if there's something malicious in this HTML, The width and height of the iframe ares set to 1 and it's out of the view with top: -100px; statement. I believe it takes some some ...
2
votes
1answer
99 views

Handling Authentication without a unique username or password

Working on a project and I have to authenticate a user that does not have a username ( '' ) or a password ( '' ). There are users and guest_users, but a guest_user won't have to explicitly log-in, ...
1
vote
2answers
41 views

Access LAN services through malicious web page

Suppose that a user on a corporate network has access to a private FTP server, or intranet site, that's only available on the Local Area Network, available at http://internal.example.com. If an ...
-7
votes
1answer
111 views

making a login server [closed]

please can someone explain to me how I would go about making a login service? I know the basic steps: Get the username, store it somewhere Get the password, translate to MD5 and store somewhere End.....
0
votes
1answer
106 views

Can you do a client and server side encryption [duplicate]

I am creating a PHP website where users, among other things, can login and do administrative stuff. For their passwords i use password_hash($password) and to later verify with it, I use ...
5
votes
2answers
122 views

What to use as 'state' in OAuth2 Authorization Code Grant workflow

I'm using csrf protection in my web app. Now I'm planning to trigger a OAuth2 Authorization Code Grant workflow, starting with a static template opened in a new browser window using window.open(...
3
votes
1answer
180 views

Uncontrolled Format String Vulnerability in JavaScript

I have been working on input validation vulnerabilities and very new to Uncontrolled Format String Vulnerabilities, as I learned so far its usually exploited through printf functions with "%". I ...
4
votes
3answers
229 views

HOW is the malicious URL/payload is delivered to the user on a DOM based XSS attack?

Testing for DOM based XSS at OWASP reads: The first hypothetical example uses the following client side code: <script> document.write("Site is at: " + document.location.href + "."); </...
6
votes
1answer
130 views

Random Oracle in Javascript for password generation and recall

I use a lot of different sites, and my number one security issue is to never reuse a password. As it seems that every company out there like TalkTalk is as leaky as a sieve, I figure that's the right ...
4
votes
2answers
419 views

Stopping webpage compromise by preventing frame-busting

My website offers rich content to users. I often subscribe to third party vendors whose content I embed in my pages. How can I safely embed external domain's content on my webpage in an iframe without ...
1
vote
2answers
99 views

What would typically be considered an acceptable string entropy for passwords?

I have gained interest in creating a way to check password strength (think password strength meters - yes - another one). I've found many ways to award a score on a policy driven approach (one capital,...
0
votes
0answers
107 views

Adobe Flash-based site's UI misbehaves when it's accessed through a VPN. Is it leaking my real ip address?

Here is a setup: A Linux/Windows VM at home (will call it "hidden VM" from now on) which is placed into an isolated environment (it's located in its own isolated virtual network, and the only way ...
3
votes
1answer
39 views

Solution for Enterprise SW Eng. with Github and NPM [closed]

Can anyone share an architecture or framework that supports the use of Open Source software in enterprise software development environments? I'm seeking solutions to manage and mitigate the risk of ...
1
vote
1answer
191 views

Security of cross-origin XMLHttpRequest Javascript

I am building a Chrome extension that will be making cross origin "get" and "post" requests to a few third party websites. I have been researching this process for hours and I am becoming increasingly ...
2
votes
2answers
104 views

which encryption is used in this JS Variables

Which encryption method is used for these variable names: var g_license_info var g_server_time_obj Respectfully encrypted to: var ago05b4e111efe149737a67a177f00ffad2 var ...
22
votes
4answers
5k views

Suspicious JavaScript in website header

I am not sure if this is the correct place to ask a questions such as this, apologies if it isn't. I have found the below code in the header of one of my wordPress websites, I am pretty sure it is ...
8
votes
2answers
999 views

How does BeEF work and how can it be persistent

BeEF - the browser exploitation framework. I think (thought) I had a basic working understanding of how it works. Recently, though, I was watching, this DEFCON talk, where a hacker used a man-in-the-...
2
votes
1answer
120 views

Mitigating reflected XSS in node/express requests for static assets

I've asked this on Stack Overflow because it is related to a programming problem (how to mititgate vulnerabilities in code) but I do have some broader questions, and a lack of understanding about how ...
0
votes
0answers
33 views

XSS script syntax problem

I have a server running on port 4444 on localhost that just echoes messages it receives. I have a JS script embedded in a message that is supposed to send the cookies of whoever looks at it. Here ...
2
votes
1answer
242 views

OAuth 2.0 client side redirect instead of HTTP redirect

I'm implementing an OAuth 2.0 authorisation server using the Authorization Code flow (i.e. users will authorise client apps to connect to our server). The auth server is the same as the resource ...
1
vote
2answers
1k views

can web application disable browser's password manager's remember feature for that application?

Is there anything a website code do to prevent any browser from remembering your password? I am aware that from browser's options, users can change setting to ask to remember password or not. But can ...
-1
votes
2answers
242 views

Things to look for a backdoor in web application source code (.PHP, .JS, etc files) [closed]

I am in the process of adding functionality to a web application and I will be receiving some source files (PHP, JS, and CSS) from a hired external developer. These files are not obfuscated or ...
0
votes
0answers
42 views

Widget to client web encryption on an uncontrolled LAN

I asked a broader question related to this on serverfault, but I think probably the specific case I'm thinking of might be best considered here. My basic problem is this: I am providing physical ...
2
votes
1answer
354 views

Hashing user passwords via Javascript client-side versus server-side hashing? [duplicate]

I got into a discussion with one of our senior developers over password hashing/transmission best practices and it left me curious as to what the industry standard best practice is. In the previous/...
-1
votes
3answers
1k views

Why no support for TCP Sockets in JavaScript [closed]

I know there are now WebSockets, but what is the issue with providing a socket API to allow interacting with existing protocols? I mean, after all, I can use a hidden flash object to do the same ...
2
votes
2answers
2k views

If using htmlentities or htmlspecialchars functions is enough for block XSS attack

I know this question was discussed on net various times. and people give some example how to bypass these functions through passing some code. But here one issue, All example of htmlentities/...
1
vote
2answers
218 views

CSRF by manipulating HTTP headers from client side using JavaScript

I am trying to do CSRF vulnerability analysis for my website. My website uses an anti-CSRF-token which is sent by the server to the client with the session cookie and then Javascript in the client ...
1
vote
2answers
683 views

With javascript in the browser, how can I sign some data without directly manipulating a private key?

With JavaScript in the browser, I need to digitally sign some data. I'm looking at the new Crypto.Subtle api, specifically the sign() and importKey() methods. I want, very reasonably I feel, to ...
1
vote
2answers
425 views

Is this sanitizer vulnerable to XSS?

To have a simple and secure editor for text fields of a django app, I have this snippet to sanitize input html into django code: from bs4 import BeautifulSoup def sanitize_html(value): ...