Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [json]

JSON (JavaScript Object Notation) is an open standard for encoding data in both human-readable and machine-readable form, usually for transmission to or from a web API. Use this tag for security issues relating to the format itself, or where the fact that the data is json-formatted is core to the question. For questions about web APIs where the security issue does not depend on the data format, please use [api]

0
votes
0answers
21 views

JSON-CSRF using Flash SWF Doesn't make POST request

I was trying to recreate a POC where an endpoint didn't have CSRF protection and was exposing a form submission. So, I have read these ( before asking here ): Vimeo hackerone Report by avlidienbrunn ...
3
votes
3answers
70 views

Encoding output in JSON HTTP API

I'm the author of a JSON REST API. This REST API is consumed by various clients, such as HTML/JS-clients, .NET clients (console applications) and Ruby clients. The output of the API is in JSON format, ...
2
votes
3answers
100 views

Returning POST JSON data securely?

I have a webpage (HTTPS encrypted and authorized only via domain credentials) that displays grid information. This grid information is received via a POST request to my server which will send back ...
-1
votes
2answers
122 views

Is it safe to eval JSON?

I know JSON is supposed to be a notation that can otherwise function as direct-code to evaluate Javascript? But is that so? There is a function I know about and use when I must, JSON.parse. It's the ...
2
votes
0answers
52 views

Is Jil vulnerable to Friday The 13th JSON attack?

Is the .NET JSON (de-)serializer Jil vulnerable to Friday The 13th JSON attack when deserializing untrusted input? If this attack is applicable, how can it be prevented? Explanation of the attack: ...
1
vote
1answer
66 views

What are a JSON rest api's responsibilities to prevent XSS? [duplicate]

I'm building a rest API that serves exclusively JSON. It might one day be consumed by a browser based app. Is there anything I should do on my end to prevent XSS attacks?
1
vote
1answer
270 views

Sanitizing JSON deserialization

I'm currently investigating best practices for secure JSON deserialization of untrusted input for object mapping. After researching, it seems like... the default jackson mapper: https://...
0
votes
2answers
299 views

What are the security concerns for base64 encoded JSON files? [closed]

In a REST API, I'd like to receive images as base64 encoded strings in a JSON objects fron user's post and save them to disk using node.js fs module. The request body are objects like: { file: '...
1
vote
1answer
70 views

Is using JSON a secure way of handling sql queries in python?

The question I will try to articulate this as clearly and best I can: Suppose that I have a python program which connects to a database on a server. Next I ask you to consider that this python ...
3
votes
2answers
226 views

Why does “<!--<script>” in a JS string cause a broken page/denial of service for that page?

I was under the impression that all I needed to do to make inline JSON safe was to break any closing </script> tags in strings, e.g. escape the / like <\/script>. However I found a weird ...
0
votes
1answer
87 views

Is there a way to send a password over JSONP (GET) over HTTPS (SSL)? Crypto maybe?

I understand sending passwords in the clear over GET is not considered secure because the query string can be logged by multiple eavesdroppers. However if I REALLY need to use JSONP to submit a ...
0
votes
3answers
1k views

SQL Injection on POST JSON request

I have a web application vulnerable to SQL injections. I'm using BurpSuite to intercept the requests. More specifically, the data variable below is vulnerable. I added my own data to aggregates and ...
1
vote
1answer
142 views

How to exploit escapable JSON parameters

I have an HTML page with this bit of code in it: <div> <div id="login-container" class="login-container"> <login-page params="{&quot;redacted&quot;:&quot;redacted&...
0
votes
0answers
147 views

Inject the same JSON payload twice - SQLmap

I have a "password change" form that could be injectable. However, I can't find a way to use SQLmap in this case. Here is the legitimate POST request: POST http://localhost/api/passwordchange ... ...
4
votes
3answers
912 views

XSS breaking out of JSON.parse and href attribute

I have a pretty complicated case where I try to perform a stored XSS attack when uploading a jpg file with malicious filename. Whitespace is being filtered but it seems single and double quotes along ...
-1
votes
1answer
852 views

AES-CBC then SHA vs AES-GCM for encrypting and authenticating a web token

I am trying to have something like JWT but kinda ad hoc and encrypted. The token itself is simply a stringified JSON that contains the user id and unix timestamp. Now, I tried to use AES-128-GCM, ...
21
votes
4answers
20k views

Why would I ever use AES-256-CBC if AES-256-GCM is more secure?

I guess the gist of my question is: Are there cases in which CBC is better than GCM? The reason I'm asking is that from reading this post by Matthew Green, and this question on cryptography stack ...
1
vote
1answer
399 views

Provide json post data in form based authentification

ZAP provides a way to turn a login (POST) request into a logging pattern (through the "mark as ..." in context menu). When the data is something like "user=toto&psswd=t@T°", it will translate it ...
1
vote
2answers
354 views

How can I use a MitM attack to modify intercepted contents on the fly? (educational)

I'm trying to start learning about pentesting, and for my first self-learning project, I want to intercept communication between a client (Laptop) and a server (Ubuntu). They are communicating through ...
2
votes
3answers
382 views

How do I prevent XSS in direct access to AJAX/JSON APIs?

In my rich client, I escape user-provided data before rendering to prevent XSS. The data comes from the server unescaped. That is necessary for application logic, e.g., avoiding situations where I ...
18
votes
3answers
5k views

What is the difference between JWT and encrypting some json manually with AES?

What is the difference between using a JSON Web Token (JWT) and simply having an AES key and sending and receiving encrypted JSON from the client? For example, this could be sent to the client: ...
5
votes
0answers
29 views

Is there a good way to store OAuth2 tokens for a native application?

Currently I have a native PC application that builds and uploads a configuration to an embedded Linux device (i.e. the client). This device connects to Google Calendar via their OAuth2 API. The ...
5
votes
1answer
905 views

Passing PHP code directly into JavaScript in HTML5

I want to pass a PHP string directly to a JavaScript variable and keep the load on the server to a minimum. I have the following JavaScript in an PHP file for doing this: <!DOCTYPE html> <...
30
votes
2answers
9k views

Important data can be modified from the developer console. What should I do?

Scenario: I have a to-do list that is generated with JavaScript using JSON that was encoded on the server side. I put the todo item id in the HTML id attribute. So the process goes like this: Server ...
0
votes
1answer
335 views

Content-Type for a JWE Compact Serialization payload

The scenario is that the same code library is used by both client and server to encrypt/decrypt messages. The server application uses the library's encryption function to encrypt some content (that ...
4
votes
1answer
2k views

Preventing replay attacks with JWT

I am currently building a RESTful API that will be used for a web and mobile app. Authentication to the API will be done using JSON Web Tokens. When using JWT, we can use the exp claim to expire the ...
0
votes
2answers
211 views

Are JSON web services vulnerable to CORF attacks?

Is a web service vulnerable to CSRF attack if the following are true? GET/OPTIONS Requests are Rejected Token is used for Authentication, Without token we cant access the application Access-...
1
vote
0answers
94 views

Are JSON key names vulnerable to alternate encoding (CAPEC-267) attacks?

It's sometimes possible to use an alternate encoding to get around security checks (CAPEC-267). While the JSON spec may be strict on what is valid, popular parsers don't necessarily conform perfectly [...
9
votes
3answers
8k views

CSRF with JSON POST when Content-Type must be application/json

I am testing web application for which business actions are done by sending JSON requests like for example: POST /dataRequest HTTP/1.1 Host: test.com User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; ...
1
vote
1answer
818 views

How to Prevent JSONP injection

Recently, i came across many web applications that are using callback parameters to retrieve JSON formatted data. This makes web application vulnerable to JSONP Injection attack. So what is the ...
2
votes
1answer
1k views

Is JSON Hijacking different than JSONP injection?

I am quite confused while understanding these two vulnerabilities. How are JSONP-related vulnerabilities different from JSON Hijacking?
1
vote
1answer
610 views

CSRF Protection for JSON API with Cookie Auth [duplicate]

I am building the API for a SPA and Chrome plugin using Rails, and I am inclined to go use Secure HTTPOnly cookies for authentication because: This is the default solution for standard Rails auth ...
0
votes
1answer
124 views

Help identifying contents of strange email

My wife received a weird email from an address neither of us recognizes. The structure of most of the message reminds me of JSON. What do I have here? Is is possible to decipher? Thanks! The message ...
0
votes
1answer
582 views

Is JavaScript object injection exploitable?

I'm testing a site that behaves like this: When I change my username, I submit a POST request with JSON data like this {"username":"John"}. If I change that to for example {"username":{"test":"test"}...
9
votes
1answer
2k views

Why JSON Hijacking attack doesn't work in modern browsers? How was it fixed?

I understand JSON Hijacking vulnerabilities have been fixed in all modern browsers, but how exactly? There are many articles that talk about techniques to prevent JSON Hijacking attacks (i.e. ...
1
vote
1answer
320 views

Brute force email in JSON format

I have a parameter args=[490114,{"user_login":"user@example.com","":"","perm":"view","partners":[],"event_labels":[]}] in the HTTP request but in the encoded format. I want to brute force this ...
2
votes
1answer
2k views

CSRF and JSON APIs

I was searching for an CSRF implementation for Express.js, and i found something that get my atention, in this post it says that a JSON API is nos vulnerable to CRSF attacks... is that correct?? is ...
3
votes
1answer
5k views

Reflected XSS via JSON executed with Burp, but how to do it in realistic conditions?

I am testing a scenario with Burp proxy. I am located on a website https://website.com/web There's an option there to delete an item, when you click it , a certain POST request is sent (...
2
votes
1answer
713 views

XSS from JSON outputs

In the book "XSS Attacks - Exploits and Defense" Jeremiah Grossman writes: The exploit found in Google’s reader was due to the developers thinking that JSON was only going to be viewed by the ...
3
votes
1answer
235 views

Any reason to send a user a session salt?

I'm a summer intern turned full time employee. To make a long story short, the lead developer of the project I interned on quit, and since I'm the only other person that knows the project I got hired ...
3
votes
1answer
306 views

Overwrite File in Browser Cache

I heard about a security incident where someone had accidentally placed sensitive information inside a cached JSON file. I was wondering, for the purpose of containment, what is the best way to force ...
6
votes
1answer
313 views

Can this self-XSS be extended?

I have a textbox which makes a call to an API everytime the text has changed. The API returns JSON but executes any Javascript within the JSON returned (tested with Alert()). This textbox value is not ...
0
votes
1answer
1k views

Username and Password in JSON

Iimplemented a REST server to enable JWT Authentication with support to TLS (with a certificate self-signed). When I send the credentials to my REST server with a plugin of firefox (RESTClient) and ...
1
vote
0answers
3k views

SQLMAP - POST JSON data as body

Hi I'm trying to do a SQL injection in a login form. With BurpSuite I intercept the request: POST /xxxx/web/Login HTTP/1.1 Host: 10.0.0.70:42020 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10....
2
votes
2answers
886 views

JSON through <script src=, how do you get the JS object in the rogue page?

I was explaining the attack on a JSON REST API the other day (in real life, at work, not here), and I figured out that I do not understand part of the attack vector. Sorry if this is quite a basic ...
1
vote
1answer
788 views

How to securely insert JSON objects into javascript, DOM content and html elements attributes?

Is there a way to sanitize or scape strings to secure put data in a object into script or DOM like: var myObj = JSON.parse({someObject: value}) someElement.innerHTML('<div data-id="'+myObj....
3
votes
1answer
4k views

XSS not exploitable when POST data is sent in JSON?

There is a reflected XSS flaw in an application I am testing. Initially, the payload is sent in POST request as value of a JSON key and the response is also a JSON object. The returned value in the ...
-1
votes
2answers
684 views

What is the file signature for a .json file? [closed]

Suprisingly, I cannot find the hex value that identified a .json as a .json in any online list. What is the file signature for a .json file?
22
votes
1answer
16k views

How does JTI prevent a JWT from being replayed?

According the JWT RFC a JWT token can optionally have a jti which I interpret to be an a unique ID for a JWT Token. Seems like a UUID is a good value for a jti. The RFC claims that the jti can be used ...
1
vote
3answers
821 views

Data integrity and authentication of an Arduino using JSON Web Tokens and HMACs

I have a school project involving an Arduino-based sensor that needs to send sensor readings to a server via HTTP. The sensor readings do not need to be encrypted (it's okay that people know what they ...