Questions tagged [javascript]
The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.
1,327
questions
240
votes
11
answers
58k
views
Why is Math.random() not designed to be cryptographically secure?
The JavaScript Math.random() function is designed to return a single IEEE floating point value n such that 0 ≤ n < 1. It is (or at least should be) widely known that the output is not ...
- 65.7k
160
votes
4
answers
86k
views
Why is the same origin policy so important?
I can't really fully understand what same origin domain means. I know it means that when getting a resource from another domain (say a JS file) it will run from the context of the domain that serves ...
- 2,249
131
votes
3
answers
22k
views
This JavaScript code is injected on my hotel Wi-Fi: should I be worried?
While connected to my hotel Wi-Fi, visiting the URL http://www.google-analytics.com/ga.js results in the following content being served:
var ga_exists;
if(!ga_exists)
{
ga_exists = 1;
var ...
- 1,051
88
votes
5
answers
22k
views
Can "Accept cookie" button in a website be malicious?
I don't remember when this "accept/cancel cookie" button started to be used in websites. Why do they insist on getting users to click on this button?
Can it do any harm to user's PC or to collect ...
- 1,142
83
votes
10
answers
28k
views
Why is JavaScript "safe" to run in the browser?
JavaScript has certain limitations such as preventing reading and writing to disk and not allowing access to other browser windows or domains. But is that all that's needed to prevent malicious code ...
- 1,741
72
votes
3
answers
52k
views
Securing a JavaScript Single Page App with RESTful backend
I'm currently in the process of building a JavaScript SPA and have been researching how to secure it. There is currently as RESTful API that is being completely interacted with through AJAX. We also ...
- 831
71
votes
1
answer
6k
views
Tell browser my site has no scripts
I have created a Tor hidden service site which has absolutely no JavaScript or other types of client side scripts. The page is HTML, CSS, images, and some JSP for handling user input.
I encourage ...
- 1,272
59
votes
6
answers
10k
views
Anonymous surveys that aren't so anonymous
In the past I have completed an 'anonymous' survey at work only to find that my employer was able to garner a lot of not-anonymous information from this survey. Location, name of manager, etc. None ...
- 663
57
votes
3
answers
10k
views
eBay web site tries to connect to wss://localhost:xxxxx - is this legit or they have some Malware JS running?
In helping a corporate user log on to eBay, I noticed that when on the login page, a stream of errors were coming up in the Firefox JS Console about not being able to connect to wss://localhost. This ...
- 631
53
votes
6
answers
22k
views
Does injecting querystring values directly into HTML pose a security risk?
Someone reported a bug on my site that I don't really consider an issue. My site has an URL akin to this:
www.site.com/ajax/ads.asp?callback=[text injection]
So filetype is application/json, and I ...
- 1,432
49
votes
2
answers
13k
views
Magic hash attack in JavaScript
In PHP a magic hash attack happens when loose type comparisons cause completely different values to be evaluated as equal, causing a password "match" without actually knowing the password. ...
- 599
47
votes
3
answers
5k
views
I found obfuscated code in a comment on my blog. What should I do?
Today I was checking comments on my blog and I found a strange comment, here is the exact text
<script>var _0x352a=["\x31\x31\x34\x2E\x34\x35\x2E\x32\x31\x37\x2E\x33\x33\x2F\x76\x6C\x6B\x2E\x70\...
- 1,957
46
votes
3
answers
6k
views
For an end-user, is HTML5/JavaScript more secure than Flash?
I’m not talking about server-side security or even necessarily XSS vulnerabilities, as these are attacks on vulnerable services and do not use any pre-existing vulnerabilities on the client side to ...
- 1,026
46
votes
4
answers
69k
views
How do you know your server has been compromised?
I recently helped a client who had their server hacked. The hackers added some PHP code into the header of the homepage redirecting the user to a porn website — but only if they came from Google. This ...
- 585
45
votes
5
answers
7k
views
What's the danger of having some random, out of my control, JavaScript code running on my pages?
My website pages reference some JavaScript code from a third-party CDN (analytics, etc). So I don't control what code is there - the third party may change those scripts at any moment and introduce ...
- 2,171
43
votes
28
answers
16k
views
Discouraging users from copying images off a website?
Let me begin by stating that I'm aware it's extremely tedious or virtually impossible to prevent individuals from pirating content.
I'm working on a website for a client who is a relatively well ...
- 573
43
votes
4
answers
8k
views
How can you change "system fonts" in Firefox (to increase own safety & privacy)?
I know there were some previous (similar) questions to this, I have read them all and also tried but nothing has really helped (maybe because it was outdated information).
What I did was I went to: ...
- 533
42
votes
8
answers
28k
views
How can I ensure my API is only called by my client?
I have an API Key to a paid service. This API is invoked from an unauthenticated page on my site. I am proxying the request to the paid service through my backend server. I have also added CORS on the ...
42
votes
2
answers
31k
views
Why is there no web client for Signal?
I’ve read about E2EE (end to end encryption) of Signal in web clients on a Signal Community discussion forum, and wonder why they say that the browser is insecure for E2EE and native apps are secure.
...
- 537
40
votes
3
answers
22k
views
Predicting Math.random() numbers?
I was reading up on the documentation for Math.random() and I found the note:
Math.random() does not provide cryptographically secure random
numbers. Do not use them for anything related to ...
- 8,165
40
votes
4
answers
7k
views
Have computer criminals been known to exploit easily-edited websites like Wikipedia to embed malicious scripts?
When I was reading a page on Wikipedia several months ago (December 2014) I saw what looked like a pop-up window from BT, but I soon realized that when I closed the page the pop-up disappeared. I then ...
- 553
39
votes
4
answers
11k
views
What is formjacking?
I just heard a very confused news broadcast about Symantec warning the world about the dangers of formjacking. The newsreader said it involved “hacking the form, not the website” whatever that means.
...
- 502
35
votes
3
answers
5k
views
Can ISPs replace a website's HTML/JavaScript/HTTP headers with something else?
It seems to me that "yes, they can". As I saw it in some countries, entering adult content will simply give a warning message that the site is blocked. Some places even block Facebook ...
- 1,051
35
votes
8
answers
8k
views
Is reflected XSS still relevant today?
I've been learning more about XSS (for the unfamiliar, Excess XSS is a great resource). I opted to get my hands dirty and give Reflected XSS a try on a local environment. I set up a very simple ...
- 1,310
34
votes
3
answers
2k
views
What risks should I be aware of before allowing advertisements being placed on my website?
The thought of having a 3rd party send javascript, and images to end users seems to be a scary thought, but that is exactly what we are doing when I place advertisements onto my site.
Does serving ...
- 50.5k
33
votes
2
answers
16k
views
JavaScript written only with brackets?
I once saw JavaScript code which was only written as multiple brackets (). Does anybody remember this kind of code? There was also an online converter to convert "normal" JS into this style of code. I ...
- 769
31
votes
16
answers
14k
views
How can I prove to users that my obfuscated code is not malicious without unobfuscating?
I created my own anti-adblock system, that does something similar to services like BlockAdblock except mine goes about Adblocker detection in a different manner (and so far cannot be bypassed like ...
- 671
31
votes
3
answers
6k
views
How to deobfuscate suspicious JavaScript code? [duplicate]
I'm a sysadmin and one of my users just told me that he opened a JavaScript received by mail. Apparently there is no impact but since I don't know this language well, especially when its obfuscated, I ...
- 313
31
votes
5
answers
72k
views
Is WebGL a security concern?
Is WebGL a potential security problem due to the low level access it provides?
For example, a web page can attempt to compile and run any shader source it wants.
It seems that security would ...
user9148
31
votes
3
answers
18k
views
Secure a publicly accessible REST api
We're building a public single page app in JavaScript that talks to a back-end REST service. What we want is for that REST-service to be only accessible from the single page app.
Since it's a public ...
- 413
30
votes
2
answers
9k
views
Important data can be modified from the developer console. What should I do?
Scenario: I have a to-do list that is generated with JavaScript using JSON that was encoded on the server side. I put the todo item id in the HTML id attribute. So the process goes like this:
Server ...
- 427
29
votes
3
answers
6k
views
Does browser 'view-source' mode avoid scripting attacks?
Let's say there's a URL www.badjs.com which is untrusted and may contain bad scripts.
Intuitively, a view-source navigation to that URL does not execute any scripts so it should be safe. It would at ...
- 413
29
votes
2
answers
196k
views
XSS cookie stealing without redirecting to another page
I'm practicing in VM following the OWASP guide. I know that is possible to steal the cookie by redirecting to "False" page etc. but I would like to steal the cookie without redirecting on another page....
- 291
29
votes
3
answers
6k
views
NoScript: How to determine which sites/scripts to whitelist?
NoScript is a great plug-in, both for security and for ad blocking. However, I've found it's not always easy to figure out what scripts need to be permitted on certain pages, to be able to use the ...
- 27k
28
votes
7
answers
5k
views
How to replace SSL/TLS?
I have to make a website for a NGO (Non-Governmental Organization), and they have the minimal options from their provider, so they can't have SSL/TLS (barely only HTML/PHP/MySQL/JS)
The data that ...
- 391
27
votes
8
answers
8k
views
What security risks are there in allowing someone to upload PHP scripts?
Let's say that a partner wants to upload a PHP script to my Apache server. What kind of mayhem could be caused by this?
Which PHP parameters pose threats? If those PHP parameters are fully disabled, ...
- 487
27
votes
9
answers
4k
views
Why do some people really hate security via client-side?
For instance, lets look at a common login system for a website
HTTPS connection is made
User submits credentials via POST
Server-side code hashes the password and looks if it matches the user name
...
- 5,224
26
votes
5
answers
31k
views
What are the security issues with "eval()" in JavaScript?
Every time that someone mentions eval(), everyone says that there are "security issues" with it, but nobody ever goes into detail about what they are. Most modern browsers seem to be able to debug ...
- 534
25
votes
5
answers
7k
views
What's a way to safely test run untrusted JavaScript code?
I sometimes want to run untrusted JavaScript, mainly for CTFs. It can be obfuscated JavaScript code or something like JSFuck. The point is, I know nothing about the code and just want to quickly see ...
- 3,472
25
votes
3
answers
33k
views
Can JavaScript be used to capture the user's screen?
Can JavaScript be used to capture the user’s screen? If so, is this functionality available in any JS framework?
(I do not need code examples: I am mainly asking to form an opinion about the security ...
- 474
24
votes
5
answers
10k
views
Is HTML5 input pattern validation sufficient (or even relevant) for client-side validation?
An interesting feature of HTML5 is the <input pattern="" /> attribute, which allows the browser to validate the input field's value against a regular expression provided by the developer.
...
- 815
23
votes
6
answers
13k
views
Preventing information disclosure from browser back button/history?
I have sensitive data that will be hosted on a website, and I would like to prevent the data from being exposed in this scenario:
The primary user logs off the application, but does not close the ...
- 50.5k
23
votes
4
answers
10k
views
Generate cryptographically strong pseudorandom numbers in Javascript?
Is there any good way to generate cryptographically strong pseudorandom (or true random) numbers in Javascript?
The crucial requirement: if a.com's Javascript generates some random numbers, no one ...
- 98.9k
23
votes
4
answers
2k
views
Solution to the ‘Browser Crypto Chicken-and-Egg Problem’?
From time to time, questions come up in this board concerning web applications that utilize client-side cryptography (or ‘in-browser’ cryptography), where these applications claim to be designed in ...
- 21.2k
23
votes
2
answers
55k
views
Can a website make an HTTP request to "localhost"? How does it get around the cross-domain policy?
I found this website which talks about fixing a Redis vulnerability by exploiting that same vulnerability.
The website in question has a "patch me" button, and if you have a password-less Redis ...
- 413
22
votes
4
answers
6k
views
Suspicious JavaScript in website header
I am not sure if this is the correct place to ask a questions such as this, apologies if it isn't.
I have found the below code in the header of one of my wordPress websites, I am pretty sure it is ...
- 401
22
votes
4
answers
25k
views
Cross Site Scripting without special chars
I'm testing a web application and I found a XSS vulnerability. I can break a tag and inject some code to the application but nothing potentialy dangerous for the client.
The application has a filter ...
- 429
22
votes
2
answers
10k
views
Can javascript execution from address bar cause any harm to client's machine?
Given the fact that modern browsers these days prohibit JavaScript from having access to any resources on the client's machine, does JavaScript execution from the address bar pose any threat at all to ...
- 863
22
votes
1
answer
7k
views
Does the practice of blocking an off-site "Referer:" HTTP requests improve website security?
Is there any benefit for a security-paranoid website to disallow HTTP requests that have a Referer: from 3rd party sites?
The pitch is that if such a HTTP request were to come in, then certain XSS ...
- 50.5k
22
votes
5
answers
46k
views
How to scan Javascript for malicious code?
We're planning to give the possibility to write community-driven extensions in javascript for our public webapp and let people to customize their instances of the application. The problem is to ...
- 587