Questions tagged [json]

JSON (JavaScript Object Notation) is an open standard for encoding data in both human-readable and machine-readable form, usually for transmission to or from a web API. Use this tag for security issues relating to the format itself, or where the fact that the data is json-formatted is core to the question. For questions about web APIs where the security issue does not depend on the data format, please use [api]

Filter by
Sorted by
Tagged with
0
votes
0answers
25 views

API GET Request resulted in a Bitdefender thread alert

This is a very strange occurrence and could be a false alarm. I am testing an API from an advertisement network for my WPF desktop app. I made a GET request to this exact test link (generic sample ...
0
votes
1answer
47 views

Shared Text Content - XSS Safe

I have a bulletin on my site that all valid users have access to (read and write). User input posted to this bulletin is stored in JSON. Because of these qualities there is definitely some concern for ...
1
vote
0answers
43 views

Can input value escape a JSON object?

I am passing value from input filled directly into a script function inside a JSON object. I was thinking, is it possible that this input can escape this object and can lead to XSS or something. <...
0
votes
0answers
49 views

Is unicode character encoding a safe alternative for html encoding when rendering unsafe user input to html?

I am building a web application in which a third party library is used, which transforms the user input into JSON and sends it to an controller action. In this action, we serialize the input using the ...
0
votes
1answer
84 views

Signing HTTP requests with JWS

Looking over the spec for JSON Web Signature (JWS), I realise that it doesn't seem to specify anything that is HTTP-specific in terms of the payload. Specifically, signing HTTP headers and bodies (say,...
0
votes
1answer
89 views

AES encryption (in Java) of different JSON strings always produce same encrypted string as result. Why? [closed]

I have a program written in Java which takes JSON string as argument, encrypts it using AES then encodes it using Base64. JSON string is like: {"a": "b"} or {"a": "n"} or {"a": "k"} I.e related ...
0
votes
0answers
51 views

Google Gruyere - Ajax Json Stored Xss

I was doing the google security challenges here: http://google-gruyere.appspot.com/part2 I don't understand the solution for the Ajax Stored Xss part. So here's the problem summarized: Every user ...
11
votes
4answers
3k views

JSON API response flagged as XSS by vulnerability scanner. Is this a false positive?

When a user attempts to access any URL without authentication (including a non-existent URL), my web service returns an HTTP 401 response. This response is JSON encoded, and the body of this response ...
0
votes
0answers
42 views

Unable to exploit SQL injection in the parameter

During my testing I have found a vulnerable parameter in an API (/api/v1/documents/?direction=desc&limit=30&mode=reports**&page=1**) and its parameter is page=1 at the end. Upon giving the ...
0
votes
0answers
67 views

modest 2.9.2 - response body: transformed: dechunked

I would appreciate if someone can point me to the right way solving this Have a POST for a refresh token and modsec closes the connection(?) -- the browser goes into an endless loop back and forth ; ...
1
vote
1answer
106 views

Json hijacking does not work [duplicate]

I have patched my site to prevent JSON hijacking. During this process, I was interested to see if I could actually exploit this vulnerability. So I created a foo.html, added a script tag which source ...
2
votes
1answer
55 views

Code Change That Resulted in Database Fields and Values Exposed

At my company, we have a new development team that has been completely rewriting all of the code for different parts of the system. I've noticed that with one of the recent changes, you can now see ...
1
vote
1answer
554 views

Storing third party API tokens in a database

Currently I have a Node JS project that uses the Spotify API. The project displays the users top played artists and tracks. I am following the Authorization Code Flow to obtain the access token. This ...
0
votes
0answers
110 views

Method to bypass \n in WAF (\n vulnerability)

I have this application that has an input box where the data is going to be sent in a JSON format. The JSON payload might look like this {“message”: “hello\nmy name is andi”} But the problem is the ...
0
votes
1answer
55 views

Bypassing Access-Control-Allow-Headers header [closed]

What i want to do is access the Content-type header which is placed under the Access-Control-Allow-Headers header as i want to attempt to change json to xml on a web application im working on to check ...
0
votes
0answers
166 views

How to make a HTTPrequest in JSONP callback?

I'm trying an XSS challenge. I found an exploit that breaks CSP by using a JSONP callback. I can get an alert to pop up by putting something like: <script src="https://whitelisted.jsonp?callback=...
0
votes
0answers
113 views

Unsafe deserialization from JSON

Seeking any example of exploitable unsafe deserialiazation where the serialized format is json and not some binary format. Even better would be an example where calling a Java constructor of an ...
0
votes
0answers
82 views

XSS PoC for JSON

When I am requesting for a password reset, it's making a request like this -> {"eval":"uiFormNotify('messageDiv', 'info', 'msg.email_reset_to_existing', 10);Metronic.unblockUI('#forgotPwdForm');$('#...
1
vote
1answer
347 views

Should I report this Google API key disclosure issue or not?

I have been asked to perform a pentest on a website from a company. I was analyzing the javascript files they were using, and I found a link pointing to: https://www.googleapis.com/customsearch/v1/...
0
votes
0answers
161 views

Loading JSON via an unvalidated URL - is this a vulnerability?

I have a webpage that is running some javascript that: Reads in a URL from a URL query param Without validating the URL, makes a request to it Validates the response - ensures that the response is a ...
0
votes
0answers
447 views

JSON-CSRF using Flash SWF Doesn't make POST request

I was trying to recreate a POC where an endpoint didn't have CSRF protection and was exposing a form submission. So, I have read these ( before asking here ): Vimeo hackerone Report by avlidienbrunn ...
7
votes
3answers
3k views

Encoding output in JSON HTTP API

I'm the author of a JSON REST API. This REST API is consumed by various clients, such as HTML/JS-clients, .NET clients (console applications) and Ruby clients. The output of the API is in JSON format, ...
2
votes
3answers
438 views

Returning POST JSON data securely?

I have a webpage (HTTPS encrypted and authorized only via domain credentials) that displays grid information. This grid information is received via a POST request to my server which will send back ...
-1
votes
2answers
2k views

Is it safe to eval JSON?

I know JSON is supposed to be a notation that can otherwise function as direct-code to evaluate Javascript? But is that so? There is a function I know about and use when I must, JSON.parse. It's the ...
2
votes
0answers
91 views

Is Jil vulnerable to Friday The 13th JSON attack?

Is the .NET JSON (de-)serializer Jil vulnerable to Friday The 13th JSON attack when deserializing untrusted input? If this attack is applicable, how can it be prevented? Explanation of the attack: ...
1
vote
1answer
386 views

What are a JSON rest api's responsibilities to prevent XSS? [duplicate]

I'm building a rest API that serves exclusively JSON. It might one day be consumed by a browser based app. Is there anything I should do on my end to prevent XSS attacks?
3
votes
1answer
4k views

Sanitizing JSON deserialization

I'm currently investigating best practices for secure JSON deserialization of untrusted input for object mapping. After researching, it seems like... the default jackson mapper: https://...
0
votes
2answers
2k views

What are the security concerns for base64 encoded JSON files? [closed]

In a REST API, I'd like to receive images as base64 encoded strings in a JSON objects fron user's post and save them to disk using node.js fs module. The request body are objects like: { file: '...
1
vote
1answer
313 views

Is using JSON a secure way of handling sql queries in python?

The question I will try to articulate this as clearly and best I can: Suppose that I have a python program which connects to a database on a server. Next I ask you to consider that this python ...
3
votes
2answers
893 views

Why does “<!--<script>” in a JS string cause a broken page/denial of service for that page?

I was under the impression that all I needed to do to make inline JSON safe was to break any closing </script> tags in strings, e.g. escape the / like <\/script>. However I found a weird ...
0
votes
1answer
123 views

Is there a way to send a password over JSONP (GET) over HTTPS (SSL)? Crypto maybe?

I understand sending passwords in the clear over GET is not considered secure because the query string can be logged by multiple eavesdroppers. However if I REALLY need to use JSONP to submit a ...
0
votes
3answers
10k views

SQL Injection on POST JSON request

I have a web application vulnerable to SQL injections. I'm using BurpSuite to intercept the requests. More specifically, the data variable below is vulnerable. I added my own data to aggregates and ...
1
vote
1answer
342 views

How to exploit escapable JSON parameters

I have an HTML page with this bit of code in it: <div> <div id="login-container" class="login-container"> <login-page params="{&quot;redacted&quot;:&quot;redacted&...
5
votes
3answers
5k views

XSS breaking out of JSON.parse and href attribute

I have a pretty complicated case where I try to perform a stored XSS attack when uploading a jpg file with malicious filename. Whitespace is being filtered but it seems single and double quotes along ...
-1
votes
1answer
2k views

AES-CBC then SHA vs AES-GCM for encrypting and authenticating a web token

I am trying to have something like JWT but kinda ad hoc and encrypted. The token itself is simply a stringified JSON that contains the user id and unix timestamp. Now, I tried to use AES-128-GCM, ...
46
votes
4answers
77k views

Why would I ever use AES-256-CBC if AES-256-GCM is more secure?

I guess the gist of my question is: Are there cases in which CBC is better than GCM? The reason I'm asking is that from reading this post by Matthew Green, and this question on cryptography stack ...
1
vote
1answer
1k views

Provide json post data in form based authentification

ZAP provides a way to turn a login (POST) request into a logging pattern (through the "mark as ..." in context menu). When the data is something like "user=toto&psswd=t@T°", it will translate it ...
1
vote
2answers
569 views

How can I use a MitM attack to modify intercepted contents on the fly? (educational)

I'm trying to start learning about pentesting, and for my first self-learning project, I want to intercept communication between a client (Laptop) and a server (Ubuntu). They are communicating through ...
2
votes
3answers
616 views

How do I prevent XSS in direct access to AJAX/JSON APIs?

In my rich client, I escape user-provided data before rendering to prevent XSS. The data comes from the server unescaped. That is necessary for application logic, e.g., avoiding situations where I ...
22
votes
4answers
8k views

What is the difference between JWT and encrypting some json manually with AES?

What is the difference between using a JSON Web Token (JWT) and simply having an AES key and sending and receiving encrypted JSON from the client? For example, this could be sent to the client: ...
5
votes
0answers
46 views

Is there a good way to store OAuth2 tokens for a native application?

Currently I have a native PC application that builds and uploads a configuration to an embedded Linux device (i.e. the client). This device connects to Google Calendar via their OAuth2 API. The ...
7
votes
1answer
2k views

Passing PHP code directly into JavaScript in HTML5

I want to pass a PHP string directly to a JavaScript variable and keep the load on the server to a minimum. I have the following JavaScript in an PHP file for doing this: <!DOCTYPE html> <...
30
votes
2answers
9k views

Important data can be modified from the developer console. What should I do?

Scenario: I have a to-do list that is generated with JavaScript using JSON that was encoded on the server side. I put the todo item id in the HTML id attribute. So the process goes like this: Server ...
0
votes
1answer
596 views

Content-Type for a JWE Compact Serialization payload

The scenario is that the same code library is used by both client and server to encrypt/decrypt messages. The server application uses the library's encryption function to encrypt some content (that ...
5
votes
1answer
3k views

Preventing replay attacks with JWT

I am currently building a RESTful API that will be used for a web and mobile app. Authentication to the API will be done using JSON Web Tokens. When using JWT, we can use the exp claim to expire the ...
0
votes
2answers
332 views

Are JSON web services vulnerable to CORF attacks?

Is a web service vulnerable to CSRF attack if the following are true? GET/OPTIONS Requests are Rejected Token is used for Authentication, Without token we cant access the application Access-...
1
vote
0answers
117 views

Are JSON key names vulnerable to alternate encoding (CAPEC-267) attacks?

It's sometimes possible to use an alternate encoding to get around security checks (CAPEC-267). While the JSON spec may be strict on what is valid, popular parsers don't necessarily conform perfectly [...
15
votes
3answers
22k views

CSRF with JSON POST when Content-Type must be application/json

I am testing web application for which business actions are done by sending JSON requests like for example: POST /dataRequest HTTP/1.1 Host: test.com User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; ...
1
vote
1answer
1k views

How to prevent JSONP injection?

Recently, I came across many web applications that are using callback parameters to retrieve JSON formatted data. This makes web application vulnerable to JSONP injection attacks. What is the ...
3
votes
1answer
2k views

Is JSON Hijacking different than JSONP injection?

I am quite confused while understanding these two vulnerabilities. How are JSONP-related vulnerabilities different from JSON Hijacking?