Skip to main content
The 2024 Developer Survey results are live! See the results

Questions tagged [json]

JSON (JavaScript Object Notation) is an open standard for encoding data in both human-readable and machine-readable form, usually for transmission to or from a web API. Use this tag for security issues relating to the format itself, or where the fact that the data is json-formatted is core to the question. For questions about web APIs where the security issue does not depend on the data format, please use [api]

Filter by
Sorted by
Tagged with
0 votes
1 answer
85 views

JSON array payload POC for CVE-2022-24999

I'm currently exploring if one legacy project is vulnerable to CVE-2022-24999 I found a very helpful GitHub repo with POCs However, in my case, I need to check if a payload passed in a JSON body to a ...
cis's user avatar
  • 347
6 votes
1 answer
327 views

Why does OWASP recommend to never return JSON arrays not wrapped in objects?

AJAX Security Cheat Sheet § Always return JSON with an Object on the outside says: Always have the outside primitive be an object for JSON strings: Exploitable: [{"object": "inside an ...
gaazkam's user avatar
  • 6,157
2 votes
1 answer
194 views

Secure way to output encoding HTML for insert raw html via javascript

I want to be 100% secure, I create raw html this way: const template = document.createElement('template') template.innerHTML = html_raw const cloned = template.content.cloneNode(true) document....
The nothing's user avatar
2 votes
1 answer
960 views

Is JSON vulnerability still possible?

I have a bunch of REST APIs which would be consumed by frontend applications created by customers using our product. I have suggested to only use last 2 versions of Chrome for running frontend apps. ...
user120947's user avatar
0 votes
1 answer
253 views

CSRF on JSON with origin

I'm testing for CSRF vulnerability, and I have a request like this: Host: www.test.com User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/115.0 Accept: ...
dimas aprilian's user avatar
0 votes
0 answers
447 views

SQLmap custom injection point in JSON

The post request like this: POST /api/test/ HTTP/1.1 Host: example.com Cookie: .ASPXAUTH=5B8094E Content-Type: application/json; charset=utf-8 Connection: close Content-Length: 179 {"Verb":...
TSFH's user avatar
  • 13
1 vote
1 answer
150 views

How to prevent replay attacks with JWE?

I am used to using JWTs so when I needed the same behavior but with no plaintext user data I looked at JWE. JWE is very similar to JWT; however, I did not see the exp, nbf or iat fields which limit ...
Liam Kelly's user avatar
2 votes
2 answers
248 views

Is a user query containing the string "\u0600\u0000bՕR" suspicious/malicious?

Recently, one of my services received a query where the JSON payload contained the string <an-arabic-character>\u0000bՕR. The service handled it gracefully so no real harm was done, but am I ...
blagae's user avatar
  • 131
0 votes
1 answer
280 views

Is it possible to get xss in json body request?

I was doing a VAPT assessment in which I see some JSON body in the request which has orgid deviceid So there any possibility to get XSS in json body?
B3ingN00b's user avatar
1 vote
0 answers
166 views

Re-populate form with JSON data

I re-populate form with JSON data via javascript (all data has the same origin server) 1 Wen the page load, make a request post ajax 2 The response Ajax is a: Object { primary_ns: {…}, secondary_ns: {…...
The nothing's user avatar
0 votes
0 answers
571 views

Storing encrypted data inside a JSON array in MySQL?

I have the following the situation: I have some data structures which look like this: { id: int name: BLOB password: VARCHAR(80) ... } There it is easy to store the encrypted fields ...
JavaForAndroid's user avatar
10 votes
4 answers
4k views

Is a backend API server vulnerable to CSRF?

We recently ran a Veracode SAST scan on our application and discovered that it has a CSRF. However, I wanted to check whether this is really true or it's just a false positive. Our application is a ...
Saif's user avatar
  • 203
0 votes
0 answers
80 views

How does "./" affects signature generation for files, in a PHP based web application?

I am solving a lab related to serialization vulnerabilities. It deals with retrieving files based on the signature. The theory of the lab states as quoted, "Adding ./ will still give you the same ...
ThinkTank's user avatar
0 votes
1 answer
247 views

JWT to prevent others from using video in their iframes

I just recently discovered JWT to secure my live stream and have done successful token on server and player but I think it still can be stolen. How I can use it to only have the domains I choose to be ...
Brax's user avatar
  • 1
0 votes
2 answers
595 views

CSRF attack when form data isn't parsed

How can you do a CRSF attack on express if it only accepts JSON? Sample Node app: const express = require('express'); const app = express(); app.use(express.json()); app.post('/item', (req, res, ...
Dashiell Rose Bark-Huss's user avatar
0 votes
1 answer
402 views

Purpose of two-way encryption of JWE

If we look at encryption format and standards of JWE following RFC-7516, we can see that it uses a 2 way encryption method. So what are the benefits of this compared to just using RSA? Are computation ...
Yan Bo Pei's user avatar
0 votes
1 answer
126 views

Shared Text Content - XSS Safe

I have a bulletin on my site that all valid users have access to (read and write). User input posted to this bulletin is stored in JSON. Because of these qualities there is definitely some concern for ...
Newb 4 You BB's user avatar
1 vote
0 answers
254 views

Can input value escape a JSON object?

I am passing value from input filled directly into a script function inside a JSON object. I was thinking, is it possible that this input can escape this object and can lead to XSS or something. <...
parvesh's user avatar
  • 136
0 votes
1 answer
1k views

Signing HTTP requests with JWS

Looking over the spec for JSON Web Signature (JWS), I realise that it doesn't seem to specify anything that is HTTP-specific in terms of the payload. Specifically, signing HTTP headers and bodies (say,...
Michal Charemza's user avatar
0 votes
1 answer
1k views

AES encryption (in Java) of different JSON strings always produce same encrypted string as result. Why? [closed]

I have a program written in Java which takes JSON string as argument, encrypts it using AES then encodes it using Base64. JSON string is like: {"a": "b"} or {"a": "n"} or {"a": "k"} I.e related ...
Yuriy N.'s user avatar
  • 101
11 votes
4 answers
9k views

JSON API response flagged as XSS by vulnerability scanner. Is this a false positive?

When a user attempts to access any URL without authentication (including a non-existent URL), my web service returns an HTTP 401 response. This response is JSON encoded, and the body of this response ...
Josh P's user avatar
  • 213
0 votes
0 answers
392 views

Unable to exploit SQL injection in the parameter

During my testing I have found a vulnerable parameter in an API (/api/v1/documents/?direction=desc&limit=30&mode=reports**&page=1**) and its parameter is page=1 at the end. Upon giving the ...
Mike Vonar's user avatar
2 votes
1 answer
402 views

Json hijacking does not work [duplicate]

I have patched my site to prevent JSON hijacking. During this process, I was interested to see if I could actually exploit this vulnerability. So I created a foo.html, added a script tag which source ...
HelloWorld's user avatar
2 votes
1 answer
129 views

Code Change That Resulted in Database Fields and Values Exposed

At my company, we have a new development team that has been completely rewriting all of the code for different parts of the system. I've noticed that with one of the recent changes, you can now see ...
THE DOCTOR's user avatar
1 vote
1 answer
4k views

Storing third party API tokens in a database

Currently I have a Node JS project that uses the Spotify API. The project displays the users top played artists and tracks. I am following the Authorization Code Flow to obtain the access token. This ...
rsuresh27's user avatar
0 votes
0 answers
680 views

Method to bypass \n in WAF (\n vulnerability)

I have this application that has an input box where the data is going to be sent in a JSON format. The JSON payload might look like this {“message”: “hello\nmy name is andi”} But the problem is the ...
Andi Perkaa's user avatar
0 votes
1 answer
203 views

Bypassing Access-Control-Allow-Headers header [closed]

What i want to do is access the Content-type header which is placed under the Access-Control-Allow-Headers header as i want to attempt to change json to xml on a web application im working on to check ...
sheppard's user avatar
0 votes
0 answers
393 views

How to make a HTTPrequest in JSONP callback?

I'm trying an XSS challenge. I found an exploit that breaks CSP by using a JSONP callback. I can get an alert to pop up by putting something like: <script src="https://whitelisted.jsonp?callback=...
Alex's user avatar
  • 1
0 votes
0 answers
224 views

Unsafe deserialization from JSON

Seeking any example of exploitable unsafe deserialiazation where the serialized format is json and not some binary format. Even better would be an example where calling a Java constructor of an ...
Meir Maor's user avatar
  • 1,682
0 votes
0 answers
295 views

XSS PoC for JSON

When I am requesting for a password reset, it's making a request like this -> {"eval":"uiFormNotify('messageDiv', 'info', 'msg.email_reset_to_existing', 10);Metronic.unblockUI('#forgotPwdForm');$('#...
LUs3r's user avatar
  • 1
1 vote
1 answer
946 views

Should I report this Google API key disclosure issue or not?

I have been asked to perform a pentest on a website from a company. I was analyzing the javascript files they were using, and I found a link pointing to: https://www.googleapis.com/customsearch/v1/...
stack ups's user avatar
0 votes
0 answers
377 views

Loading JSON via an unvalidated URL - is this a vulnerability?

I have a webpage that is running some javascript that: Reads in a URL from a URL query param Without validating the URL, makes a request to it Validates the response - ensures that the response is a ...
Buffalo5ix's user avatar
  • 2,726
0 votes
0 answers
673 views

JSON-CSRF using Flash SWF Doesn't make POST request

I was trying to recreate a POC where an endpoint didn't have CSRF protection and was exposing a form submission. So, I have read these ( before asking here ): Vimeo hackerone Report by avlidienbrunn ...
temporarya's user avatar
8 votes
3 answers
7k views

Encoding output in JSON HTTP API

I'm the author of a JSON REST API. This REST API is consumed by various clients, such as HTML/JS-clients, .NET clients (console applications) and Ruby clients. The output of the API is in JSON format, ...
Nitradamus's user avatar
2 votes
3 answers
2k views

Returning POST JSON data securely?

I have a webpage (HTTPS encrypted and authorized only via domain credentials) that displays grid information. This grid information is received via a POST request to my server which will send back ...
R. StackUser's user avatar
0 votes
2 answers
4k views

Is it safe to eval JSON?

I know JSON is supposed to be a notation that can otherwise function as direct-code to evaluate Javascript? But is that so? There is a function I know about and use when I must, JSON.parse. It's the ...
Evan Carroll's user avatar
  • 2,955
2 votes
0 answers
174 views

Is Jil vulnerable to Friday The 13th JSON attack?

Is the .NET JSON (de-)serializer Jil vulnerable to Friday The 13th JSON attack when deserializing untrusted input? If this attack is applicable, how can it be prevented? Explanation of the attack: ...
goluhaque's user avatar
  • 131
1 vote
1 answer
747 views

What are a JSON rest api's responsibilities to prevent XSS? [duplicate]

I'm building a rest API that serves exclusively JSON. It might one day be consumed by a browser based app. Is there anything I should do on my end to prevent XSS attacks?
user1710019's user avatar
3 votes
1 answer
7k views

Sanitizing JSON deserialization

I'm currently investigating best practices for secure JSON deserialization of untrusted input for object mapping. After researching, it seems like... the default jackson mapper: https://...
Frostbyte's user avatar
0 votes
2 answers
6k views

What are the security concerns for base64 encoded JSON files? [closed]

In a REST API, I'd like to receive images as base64 encoded strings in a JSON objects fron user's post and save them to disk using node.js fs module. The request body are objects like: { file: '...
Karlom's user avatar
  • 145
1 vote
1 answer
688 views

Is using JSON a secure way of handling sql queries in python?

The question I will try to articulate this as clearly and best I can: Suppose that I have a python program which connects to a database on a server. Next I ask you to consider that this python ...
Ranch Mayonaise's user avatar
4 votes
2 answers
2k views

Why does "<!--<script>" in a JS string cause a broken page/denial of service for that page?

I was under the impression that all I needed to do to make inline JSON safe was to break any closing </script> tags in strings, e.g. escape the / like <\/script>. However I found a weird ...
Adam A's user avatar
  • 203
0 votes
1 answer
219 views

Is there a way to send a password over JSONP (GET) over HTTPS (SSL)? Crypto maybe?

I understand sending passwords in the clear over GET is not considered secure because the query string can be logged by multiple eavesdroppers. However if I REALLY need to use JSONP to submit a ...
Emilio's user avatar
  • 101
1 vote
3 answers
26k views

SQL Injection on POST JSON request

I have a web application vulnerable to SQL injections. I'm using BurpSuite to intercept the requests. More specifically, the data variable below is vulnerable. I added my own data to aggregates and ...
Hernan Duran's user avatar
1 vote
1 answer
761 views

How to exploit escapable JSON parameters

I have an HTML page with this bit of code in it: <div> <div id="login-container" class="login-container"> <login-page params="{&quot;redacted&quot;:&quot;redacted&...
Jack's user avatar
  • 501
5 votes
3 answers
13k views

XSS breaking out of JSON.parse and href attribute

I have a pretty complicated case where I try to perform a stored XSS attack when uploading a jpg file with malicious filename. Whitespace is being filtered but it seems single and double quotes along ...
XII's user avatar
  • 534
-1 votes
1 answer
4k views

AES-CBC then SHA vs AES-GCM for encrypting and authenticating a web token

I am trying to have something like JWT but kinda ad hoc and encrypted. The token itself is simply a stringified JSON that contains the user id and unix timestamp. Now, I tried to use AES-128-GCM, ...
pls no's user avatar
  • 123
86 votes
6 answers
202k views

Why would I ever use AES-256-CBC if AES-256-GCM is more secure?

I guess the gist of my question is: Are there cases in which CBC is better than GCM? The reason I'm asking is that from reading this post by Matthew Green, and this question on cryptography stack ...
The Quantum Physicist's user avatar
2 votes
1 answer
2k views

Provide json post data in form based authentification

ZAP provides a way to turn a login (POST) request into a logging pattern (through the "mark as ..." in context menu). When the data is something like "user=toto&psswd=t@T°", it will translate it ...
Marvin's user avatar
  • 125
1 vote
2 answers
784 views

How can I use a MitM attack to modify intercepted contents on the fly? (educational)

I'm trying to start learning about pentesting, and for my first self-learning project, I want to intercept communication between a client (Laptop) and a server (Ubuntu). They are communicating through ...
user171988's user avatar