Questions tagged [javascript]

The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

Filter by
Sorted by
Tagged with
0 votes
0 answers
39 views

How to turn a relative path script (js) import to an absolue one with a url for XSS ? (more details below)

I have a parameter whose value is injected in the HTML as the following <script src="/dir1/dir2/dir3/dir4/INJECT_HERE"> </script> I was able to traverse back to just / but when ...
1 vote
2 answers
80 views

How to mitigate risk of exploiting open POST endpoints?

I'd like to ask for advice reg. protecting the state-altering HTTP API endpoints of the API that I'm owning (POST etc.). I'm owning a web application that exposes some HTTP endpoints to the world. ...
  • 11
3 votes
2 answers
1k views

Create a cryptographically secure random string for auth cookie in javascript

I know there are multiple libraries for managing authentication, but I have a hobby project and wanted to create a very simple authentication system. It'd set a cookie in the client's browser with a ...
  • 225
0 votes
0 answers
17 views

Threat Assessment Javascript User-controlled Variable Names on Window

I have a requirement to support some external integration to a 3rd party vendor on our site (which is a SaaS site with multiple tenant logins). The vendor requires a script and a global variable to be ...
1 vote
0 answers
107 views

Re-populate form with JSON data

I re-populate form with JSON data via javascript (all data has the same origin server) 1 Wen the page load, make a request post ajax 2 The response Ajax is a: Object { primary_ns: {…}, secondary_ns: {…...
9 votes
2 answers
2k views

Does the "auto formfill" feature in Chromium-based browsers actually send this to the webpage?

I use Vivaldi. I have previously filled in forms where I used a certain name and e-mail. Today I cleared the browser data except for the autofill stuff. Then I went to Stack Exchange to register an ...
  • 107
1 vote
1 answer
429 views

XSS - Anyway to bypass double quotes in href of anchor?

I have an anchor that has href attribute populated by my input. I am trying to input javascript, but it always renders it useless since it always appears between double quotes. So far, I have tried ...
0 votes
1 answer
406 views

Can javascript from parent page read url of popup window?

Lets say I'll open a third party page from the parent page using window.open(popup method) Now what I want to know is there any way where the parent page(using javascript or any third party library) ...
  • 1
1 vote
1 answer
91 views

How to prevent shopping cart alterations in another tab when paymentintent is already created?

Has anyone figured out a solution to this? I seem to have gotten to the same conclusion with no solution. If I were to go the my app's checkout page, the payintent is created in the backend (explained ...
0 votes
1 answer
332 views

unknown (malicious?) code and file in public dir (Laravel 5.8, apache/cPanel) [duplicate]

I have a Laravel 5.8 app in a server running Apache/2.4.53 (cPanel) and PHP 7.4 (ea-php74) and i have VPS root WHM/cPanel access there. as any Laravel project, the "public" directory is web ...
2 votes
1 answer
456 views

Is PHP json_encode sufficient for HTML data blocks?

I want to access data in a PHP variable from JavaScript code. An (old) OWASP cheat sheet recommends embedding it in HTML before accessing it, an approach like this: <div id="init_data" ...
0 votes
1 answer
68 views

Encryption options when one-way secure channel is available

I would like to ask what encryption options are available for the following real scenario: There is an unsecure, full-duplex communication channel between a server and client There is also a secure ...
0 votes
0 answers
84 views

Explotation of reload/redirect through javascript

While working on a site (https://website.com/site/site.apexp) the site redirects through a javascript function: <html> <script> function redirectOnLoad() { var escapedHash = ''; ...
  • 1
2 votes
1 answer
254 views

Website with embedded PDFs and JavaScript for Acrobat

Context On my website, users can upload their PDF files, and then some, other users can view the uploaded PDF files. I was wondering if this could come with security issues. The uploaded PDF are ...
  • 21
0 votes
0 answers
3k views

Where to store token from auth header in React

I am currently working on a medium scale app and am a month into learning React. I got to the part where I need to authenticate users. I have written some code and It is working, but I don't know is ...
0 votes
1 answer
120 views

Is this safe from XSS?

I need to allow a user to pass unsafe text into an iframe URL: <iframe src="https://example.com?foo=INPUT"></iframe> Inside the iFrame render code, I have this: <!doctype ...
  • 105
0 votes
0 answers
188 views

Best way to encrypt client side data for SaaS inside the web

I am planning a SaaS-solution, where my clients store and save sensitive data on my servers. Security is a big point as it makes a product more trustworthy, so my thought was that the data which I ...
0 votes
0 answers
170 views

Why would iexplore.exe run Wscript.exe?

In Windows logs, I found that C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe launched C:\Program Files\Internet Explorer\iexplore.exe" -dualengineadapter... which in turn launched &...
15 votes
6 answers
6k views

Preventing users from tampering with input

Let's say that I have a single-page web app written in JavaScript and a server-side API, both changeable by me. The app calculates some values based on user input and POSTs these to the API. The ...
  • 315
0 votes
0 answers
109 views

How to perform php post request attack with javascript sanitization?

The following code demonstrates the source code of this challenge and basically, I need to send a post request with arbitrary code to execute on the server. However, after multiple attempts Im unable ...
1 vote
0 answers
36 views

How to prevent XS-Leaks while maintaining usability?

The methods presented in https://xsleaks.dev/ are based on the fact that malicious Javascript can use Cross-origin requests to infer data by means of faulty status codes, time required, mime type etc. ...
1 vote
1 answer
89 views

Can an attacker mess with a website that doesn't use a back-end server? (and how I can prevent that)

I'm developing a React web app where the user can input a .csv of their transaction data, and the app will output useful analysis that will inform their future purchase decisions. I'm planning to use ...
  • 11
0 votes
1 answer
384 views

XSS attack not executing with correct payload

Hello I was testing on a private program where I was able to inject XSS but for some reason it is not popping up when I put the mouse over the input field. <input type="text" onmouseover=&...
0 votes
2 answers
167 views

When receiving PDFs from unknown sources, is it sufficient to remove dynamic content (flash, JS, etc.) to minimise attack surface?

My company allows customers to upload PDFs, JPEGs and PNGs to our servers, which are then viewed by clients. We want to minimise the potential for attack on the clients, and while the image formats ...
0 votes
1 answer
231 views

Can POST request be changed in a HTTPS website?

I am trying to develop a website where I grab data using javascript and send it to PHP using ajax post. However, while researching, I found that the POST request can be modified using third-parties ...
0 votes
2 answers
371 views

Does the HTTP status code 302 guarantee no other content was served as part of the same HTTP response?

Does receiving the HTTP 302 status code from a domain A guarantee in any shape or form that there was no JavaScript ran or any additional content (external or not) loaded from that domain A? The ...
2 votes
2 answers
355 views

Javascript based attacks when not having JIT

Some browsers like Chromium and recently Edge have a flag to disable JIT. What attacks/threats does this protect against and what JS based attacks are not prevented?
  • 31
2 votes
1 answer
1k views

Can XSS ever occur in an <img> tag's "src" attribute?

In a scenario where an attacker has control over the src attribute of an img HTML tag, they could easily inject a simple JavaScript XSS payload like the following: <img src="javascript:alert(1)...
  • 123
0 votes
1 answer
367 views

COOP and COEP: Is there an advantage to enabling COOP / COEP if I don't need to use the sharedArrayBuffer or other features?

COOP: cross origin opener policy COEP: Cross origin embedder policy Most of the articles on the web, related to COOP / COEP, point to the fact that by enabling COOP / COEP , your web page can use the ...
0 votes
1 answer
445 views

HTML Option Tag XSS

Is it possible to inject javascript inside of an HTML option tag? For example, say you have the following html: <select> <option MALISCIOUS_CODE_HERE>Option Description</option> &...
0 votes
0 answers
73 views

Values inserted with the JavaScript "value" property are ineffective

Normally if I insert values to an HTML form's input field element via the JavaScript value property and would send the form, the form would be sent just fine, just as if I would fill in the data ...
0 votes
1 answer
2k views

Decoding suspicious Javascript

I received a suspicious looking SMS today with a link. I checked out the page source code and came across this script between the <head> tags: <script async="" src="/cdn-cgi/...
  • 176
3 votes
1 answer
249 views

Cookies VS localStorage (JavaScript Security)

I know that HTTP requests made by the site get the browser's localStorage for a site, and document.cookie is encrypted for HTTPs websites, but I'm still wondering the risk of storing sensitive ...
0 votes
1 answer
233 views

Could this code be vulnerable to XSS?

It seems like exploiting XSS is becoming harder with every browser version update. My question is: Is this code vulnerable to XSS? <script type="text/javascript"> var url = ...
0 votes
0 answers
95 views

Constant-Time String-to-Byte Encoding for JavaScript

When dealing with cryptographic secrets (private keys, passwords, etc) it is desirable to not run these secrets through functions that do not run in constant time, in order to avoid the potential for ...
0 votes
1 answer
142 views

Is it secure to send messages between a WS Server and the client?

Is it secure to send messages between a WebSocket Server and the Client? An example of sending messages between a (Socket.io) server, is in Node.js: socket.on("myMessage", function(msg) { // ...
9 votes
2 answers
4k views

Is "Math.random" the same as "crypto.getRandomValues" (JavaScript security)

This question may be a little off-topic, but is Math.random the same as crypto.getRandomValues? (JavaScript) Here's an example: Math.random(); // 0.11918419514323941 self.crypto.getRandomValues(new ...
0 votes
0 answers
75 views

How to secure an API end point when using javascipt

I'm struggling to understand how one can secure an API endpoint using JavaScript. I want to create a copy and paste-able snippet of Javascript that a user can paste in their site. And on page load/s ...
0 votes
2 answers
400 views

XSS payloads getting filtered but HTML tags are getting rendered. Can we exploit this? [duplicate]

I was trying to test a potential XSS vulnerability on a website. On the search bar I can see the filtering process happening i.e if I type script> (not with starting <) I can see the same in the ...
0 votes
2 answers
741 views

Keep encryption password in javascript file hidden from browser debug tool

I'm sort of new to Frontend programming. I'm trying to build a PWA, it stores data (client data i.e: address, name, phones) to be ready in an offline state, for which I'm using localForage. I've ...
0 votes
0 answers
157 views

Selective frame busting without HTTP headers

Why... Just Why... Due to Shopify being unwilling to modify security headers further then removing them, the Cloudflare "Orange-to-Orange" problem (since Shopify uses Cloudflare as well), ...
  • 21
1 vote
1 answer
350 views

Does enabling SharedArrayBuffers via service worker headers create Spectre vulnerability?

In browsers, use of SharedArrayBuffer is restricted to sites with the following HTTP headers because otherwise it exposes vulnerabilities to Spectre and Meltdown. Cross-Origin-Embedder-Policy: require-...
2 votes
1 answer
419 views

XSS inside of a javascript string, with unusual filter

While making a website I made an interesting mistake, and I'm wondering if this could be used to achieve XSS. I've come very close, but not quite. I can put my user input into a string inside of a <...
  • 123
0 votes
0 answers
161 views

How do developers prevent a third party from looking at exposed information on a javascript console? For example on a public computer

If a user was using your application on a public computer and were to log out of your website without closing the tab, the next person to use this computer could snoop through the console and look for ...
1 vote
2 answers
259 views

abiliity to change elements in HubSpot iFrame forms

I recently started working on adding custom code to HubSpot forms after their form is loaded via an iFrame. Initially, I was using the following code to access the iFrame to change it: var form = ...
  • 113
0 votes
2 answers
202 views

Should including an external webpage in PHP be dangerous in principle?

<?php include("https://example.com"); ?> I came across the opinion that including webpages in such pattern can be dangerous; further more, in XAMPP for windows php.ini there is ...
  • 3
0 votes
1 answer
181 views

What technologies used in a web browser, if any, can be used to push a binary from a server to a client machine?

This question is about if any technologies used by a web browser (HTTP, TCP, JavaScript, etc.) can be used to push a binary file from the web server to a random folder on the client. This is for a ...
user avatar
31 votes
16 answers
14k views

How can I prove to users that my obfuscated code is not malicious without unobfuscating?

I created my own anti-adblock system, that does something similar to services like BlockAdblock except mine goes about Adblocker detection in a different manner (and so far cannot be bypassed like ...
0 votes
0 answers
87 views

Taking html, js, css input from the user

We are building a multitenancy web app with Laravel (+Blade), each user can create a store (tenancy), and have a control panel where they can edit the store settings and styling, to edit the store ...
  • 101
0 votes
0 answers
1k views

How to reliably detect Browser Exploitation Attacks with BeEF and other JavaScript hooking packages?

"Unlike other security frameworks, BeEF looks past the hardened network perimeter and client system, and examines exploitability within the context of the one open door: the web browser. BeEF ...
user avatar

1
2
3 4 5
27