Questions tagged [javascript]
The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.
160
questions
23
votes
4
answers
2k
views
Solution to the ‘Browser Crypto Chicken-and-Egg Problem’?
From time to time, questions come up in this board concerning web applications that utilize client-side cryptography (or ‘in-browser’ cryptography), where these applications claim to be designed in ...
- 21.2k
160
votes
4
answers
86k
views
Why is the same origin policy so important?
I can't really fully understand what same origin domain means. I know it means that when getting a resource from another domain (say a JS file) it will run from the context of the domain that serves ...
- 2,249
4
votes
1
answer
5k
views
Do drive-by attacks exist in modern browsers?
Do drive-by attacks actually exist within modern browsers and if yes how do they work?
I’ve heard a lot about getting infected by malware simply by visiting a website. But is this really possible?
I ...
- 83
17
votes
2
answers
14k
views
UTF-7 XSS attacks in modern browsers
I've recently read Ned Batchelders article on UTF-7 XSS-attacks. I tested his examples, but could not get any UTF-7 attack to work in modern browsers. I tried recent versions of Firefox, Chrome and ...
- 365
2
votes
2
answers
1k
views
Hashing Passphrase in Client-Side JavaScript Rather than Server-Side -- Is it Viable?
The oft-mentioned approach for website password-handling is to use a server-side language to employ a suitable hashing algorithm (stretched or otherwise designed to overly-consume computing resources),...
- 463
22
votes
1
answer
7k
views
Does the practice of blocking an off-site "Referer:" HTTP requests improve website security?
Is there any benefit for a security-paranoid website to disallow HTTP requests that have a Referer: from 3rd party sites?
The pitch is that if such a HTTP request were to come in, then certain XSS ...
- 50.5k
16
votes
5
answers
2k
views
What can I do about TLS 1.0 javascript injection vulnerability on my server?
The recent article featured on slashdot http://www.theregister.co.uk/2011/09/19/beast_exploits_paypal_ssl/ says that connections secured with TLS 1.0 are susceptible to man-in-the-middle decryption (...
- 977
10
votes
5
answers
28k
views
Hiding JavaScript source code
In a web-app should one strive to hide as much of the code as possible, for example from view source? In particular I was wondering should JavaScript be hidden, especially ones used for Ajax? I was ...
- 10.1k
240
votes
11
answers
58k
views
Why is Math.random() not designed to be cryptographically secure?
The JavaScript Math.random() function is designed to return a single IEEE floating point value n such that 0 ≤ n < 1. It is (or at least should be) widely known that the output is not ...
- 65.7k
40
votes
3
answers
22k
views
Predicting Math.random() numbers?
I was reading up on the documentation for Math.random() and I found the note:
Math.random() does not provide cryptographically secure random
numbers. Do not use them for anything related to ...
- 8,165
5
votes
1
answer
699
views
De-obfuscation of malicious javascript in spoofed eMail
Two days ago, I received a suspicious email.
The sender was a mailing list, that i am a member of, but it originated from a webhosters subdomain (applegate.dreamhost.com). The content was roughly ...
- 78
46
votes
4
answers
69k
views
How do you know your server has been compromised?
I recently helped a client who had their server hacked. The hackers added some PHP code into the header of the homepage redirecting the user to a porn website — but only if they came from Google. This ...
- 585
23
votes
4
answers
10k
views
Generate cryptographically strong pseudorandom numbers in Javascript?
Is there any good way to generate cryptographically strong pseudorandom (or true random) numbers in Javascript?
The crucial requirement: if a.com's Javascript generates some random numbers, no one ...
- 98.9k
23
votes
6
answers
13k
views
Preventing information disclosure from browser back button/history?
I have sensitive data that will be hosted on a website, and I would like to prevent the data from being exposed in this scenario:
The primary user logs off the application, but does not close the ...
- 50.5k
22
votes
3
answers
5k
views
What’s wrong with in-browser cryptography in 2017?
There are many articles in the internet criticising JavaScript cryptography in the browser:
"What’s wrong with in-browser cryptography?" by Tony Arcieri
"Final post on Javascript crypto" on rdist
"...
- 223
17
votes
5
answers
16k
views
Obfuscating JavaScript code
Some Flash developers are afraid of JavaScript. Their point of view:
Stealing JS source code is effortless, one would just 'view source' and copy it. Yes, you can decompile Flash bytecode, however it ...
- 273
15
votes
3
answers
7k
views
How serious are XSS attacks
A website I visit allows this kind of attack, to be implemented with GET in the URL
<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
Along with many others on this page: http://ha.ckers....
- 259
14
votes
4
answers
7k
views
Challenging challenge: client-side password hashing and server-side password verification
We have a website where users need to log in to access privileged information. Obviously we are using SSL, but I also want to avoid plaintext passwords from accidently ending up in server logs, or ...
- 1,571
11
votes
2
answers
2k
views
User-specific Subdomains : JavaScript security
If I provide a public-facing website for users on my website at their own subdomain (e.g. bob.myapp.com) under their own control, can I allow them to execute arbitrary JavaScript without putting my ...
Brandon
10
votes
3
answers
17k
views
Javascript Malware: How does it work, and how can it be mitigated?
I am wondering how malware gets served through Javascript. I've noticed a few illegitimate pop-ups while visiting some financial websites. I wonder how malware exploits work against the application ...
- 1,131
7
votes
3
answers
1k
views
Are CSRF Attacks Really Blind
I'm new to CSRF attacks but don't see how they are always blind.
Let's say we are dealing with a site where the asset we need to protect is the HTTP response. Something like one's medical history. ...
- 173
1
vote
2
answers
836
views
Preventing malicious usage from users with access tokens
So I have a web page running a JavaScript application, and a web service that the application makes HTTP PUT requests against. The service uses access tokens to verify the user’s identity, but now I’m ...
- 13
131
votes
3
answers
22k
views
This JavaScript code is injected on my hotel Wi-Fi: should I be worried?
While connected to my hotel Wi-Fi, visiting the URL http://www.google-analytics.com/ga.js results in the following content being served:
var ga_exists;
if(!ga_exists)
{
ga_exists = 1;
var ...
- 1,051
43
votes
28
answers
16k
views
Discouraging users from copying images off a website?
Let me begin by stating that I'm aware it's extremely tedious or virtually impossible to prevent individuals from pirating content.
I'm working on a website for a client who is a relatively well ...
- 573
34
votes
3
answers
2k
views
What risks should I be aware of before allowing advertisements being placed on my website?
The thought of having a 3rd party send javascript, and images to end users seems to be a scary thought, but that is exactly what we are doing when I place advertisements onto my site.
Does serving ...
- 50.5k
31
votes
3
answers
6k
views
How to deobfuscate suspicious JavaScript code? [duplicate]
I'm a sysadmin and one of my users just told me that he opened a JavaScript received by mail. Apparently there is no impact but since I don't know this language well, especially when its obfuscated, I ...
- 313
27
votes
9
answers
4k
views
Why do some people really hate security via client-side?
For instance, lets look at a common login system for a website
HTTPS connection is made
User submits credentials via POST
Server-side code hashes the password and looks if it matches the user name
...
- 5,224
15
votes
3
answers
3k
views
How secure is aSSL (javascript)? Does it effectively mimic SSL?
Some of you may be familiar with the aSSL project, which uses AJAX/PHP to mimic the SSL protocol. It uses RSA 512 or 1024 for the keys, and AES for the actual data. It looks impressive to me in ...
- 151
10
votes
2
answers
20k
views
Why are scripts injected through innerHTML not executed whilst onerror and other on<event> attributes on elements are? - Google XSS Challenge 2
SPOILER ALERT : Do not continue if you do not want to be spoiled
I am currently doing the Google XSS Challenge Level 2 .
I am injecting XSS code that is inserted into the document using element....
- 2,401
9
votes
1
answer
1k
views
How can Google search change the location in a URL tooltip?
When hovering over a website link in Google search the tooltip says the link of the website (stackoverflow.com). But when I click it it goes to some Google page and then StackOverflow. But now if I go ...
- 477
8
votes
4
answers
1k
views
Security attacks on PHP web applications
I know about following security attacks on php applications (html,php,js).
XSS
SQL Injection
CSFR
Session Hijacking /Fixation
Code Injection
Remote file injection
Should i know about any other ...
- 413
8
votes
1
answer
2k
views
Child iFrame hash verification of parent iFrame content
Consider the following scenario:
Alice wishes to browse Victor's website while on the job at Initech. Victor's website is hosted on an alternative domain name system to which Initech's DNS does not ...
- 852
6
votes
2
answers
977
views
Should the Keygen element be used to create a certificate for mutual auth TLS? What alternatives are there?
I'm interested in using mutual auth TLS to improve the security of my javascript based webservices . I've looked at the Keygen element and given all its issues, not sure if this can even be used for ...
- 50.5k
5
votes
3
answers
834
views
Recent hack appends to all javascript files
I have about 10 websites hosted on shared server by a2hosting, on apr 20 some of the js files for some of the websites were appended with a function that detects the device and if it is mobile it ...
5
votes
3
answers
22k
views
Why is JavaScript disabled in the Tor Browser Bundle?
Didn't Tor create a local socks proxy? Why doesn't all the Web traffic go over this local socks proxy and why is JavaScript disabled in the Tor Browser bundle?
If you would connect with firefox for ...
- 53
1
vote
3
answers
6k
views
Reflective XSS in script codes with Content Type "text/javascript"
I have a webpage that returns raw script code with the headerContent-Type: text/javascript. However I found that there is a reflective xss in one of the parameters passed to the url which is copied ...
- 111
1
vote
1
answer
790
views
Bypass a simple XSS filter that only looks at <
Say, I have a page where the input from the user is taken and is passed through a simple client-side XSS filter. That filter only replaces < characters with ''.
in = in.replace(/[<]/g, '');
...
- 223
0
votes
1
answer
3k
views
XSS to overcome HTML entities
In a search box (<input value=" *insert search term here* "...>), when I input " onmouseover="alert(1), the double quotes are converted to their entities, so it's not possible to break out of ...
- 123
72
votes
3
answers
52k
views
Securing a JavaScript Single Page App with RESTful backend
I'm currently in the process of building a JavaScript SPA and have been researching how to secure it. There is currently as RESTful API that is being completely interacted with through AJAX. We also ...
- 831
57
votes
3
answers
10k
views
eBay web site tries to connect to wss://localhost:xxxxx - is this legit or they have some Malware JS running?
In helping a corporate user log on to eBay, I noticed that when on the login page, a stream of errors were coming up in the Firefox JS Console about not being able to connect to wss://localhost. This ...
- 631
42
votes
2
answers
31k
views
Why is there no web client for Signal?
I’ve read about E2EE (end to end encryption) of Signal in web clients on a Signal Community discussion forum, and wonder why they say that the browser is insecure for E2EE and native apps are secure.
...
- 537
29
votes
3
answers
6k
views
NoScript: How to determine which sites/scripts to whitelist?
NoScript is a great plug-in, both for security and for ad blocking. However, I've found it's not always easy to figure out what scripts need to be permitted on certain pages, to be able to use the ...
- 27k
22
votes
5
answers
46k
views
How to scan Javascript for malicious code?
We're planning to give the possibility to write community-driven extensions in javascript for our public webapp and let people to customize their instances of the application. The problem is to ...
- 587
22
votes
1
answer
3k
views
How can SharedArrayBuffer be used for timing attacks?
Since this new class of attacks involves measuring precise time intervals, as a partial, short-term, mitigation we are disabling or reducing the precision of several time sources in Firefox. The ...
- 361
21
votes
3
answers
7k
views
What are the risks of using a CDN to speed up my website? How do I avoid them? [duplicate]
Content Delivery Networks (CDNs) are well known to speed up the performance of a website, but they create the obvious security risks if someone were to change the code that resides on the CDN.
What ...
- 50.5k
19
votes
5
answers
55k
views
How to do client side hashing of password using BCrypt? [duplicate]
I am migrating an old application which used MD5 hashing to Spring Security with BCrypt encoding of passwords. I want to encode the password on new user creation page, change password page and on ...
- 301
16
votes
2
answers
8k
views
Why are cookies considered more secure against XSS?
This article discusses storing session tokens in a cookie vs in localStorage: https://stormpath.com/blog/where-to-store-your-jwts-cookies-vs-html5-web-storage/
The article states:
Cookies, when ...
- 303
16
votes
6
answers
6k
views
Solution to allow JavaScript input but prevent XSS
We have a simple Blog system that allows users to input html and JavaScript to build a blog page. I'm aware that allowing javascript open up the door to xss attacks. We do however need to allow users ...
- 263
14
votes
5
answers
11k
views
CSRF protection with Session Id
To protect against CSRF, couldn't my page javascript just dynamically insert the session id from the cookie into the body of each HTTP request right before it's sent?
The server would then just ...
- 411
12
votes
5
answers
3k
views
Data needed for why not to load third party JavaScript on web page with credit card form
My company makes a JavaScript widget that e-commerce sites can embed on their pages. Our current instructions to our customers tell them to load our JS on every page of their site and most follow this ...
- 221