Questions tagged [self-xss]
Self XSS is a XSS vulnerability that only affects the one performing it, such as tricking the victim into copy pasting code into the browser console.
15
questions
0
votes
0
answers
59
views
How to escalate or make a Self-XSS vulnerability more impactful when injecting a payload into the X-Forwarded-For header of a web request?
I'm a beginner bug bounty hunter, and I recently came across a Self-XSS vulnerability during my security testing on a target website. The vulnerability occurs when I inject a payload into the X-...
0
votes
1
answer
355
views
Using window.open('',"_blank") can this be XSS exploited?
If I have javascript that opens a window using the code below, the content is a user supplied variable that is not sanatized. Is there any security risk in this situation. The content will only be ...
- 113
0
votes
1
answer
333
views
XSS Triggers only when pasted in
I have a XSS case that I would like to exploit as a proof of concept, however the payload seems to only be triggering when pasted in and not from the URL.
Basically, I have a search box which when ...
- 1
2
votes
1
answer
206
views
Does this qualify as Filename Upload DOM-XSS?
An application has the following javascript code which is triggered whenever an user tries to upload a file.
a.html(fileName)
then if the user uploads a file named <img src=x onerror=alert()> ...
- 567
1
vote
1
answer
292
views
Found XSS in chat form in bug bounty but they say it's only self XSS. How to leverage it? [closed]
I have found an XSS bug in a chat form on a bug bounty target. When I enter in the chat form input <button onclick="alert(1)">click</button> and after that I click the button a ...
- 31
3
votes
2
answers
397
views
Further exploit self XSS
I´m pentesting a clients website and found a self XSS Vulnerability in the Login Page: in case of a login error the Error Page shows the Username, so if you input <script>alert("XSS")&...
2
votes
2
answers
1k
views
Self-XSS From File Upload Name
I encountered this type of vulnerability a couple of times but was not able to fully exploit it.
This vulnerability is a self-xss which is triggered from file names. E.g. If I were to upload a file ...
- 143
2
votes
1
answer
1k
views
Is this considered DOM-XSS or self-XSS or both?
SCENARIO:
A web page shows an error login page using these javascript lines
<script>
let queryParams = new URLSearchParams(window.location.search);
document.getElementById("message")....
- 567
0
votes
0
answers
765
views
Bypass XSS in script tag
<script type="text/javascript">
window.RPM = {"debug":false,"env":"user input"}
</script>
user input can be inputted with xss payload.
Filter is doing following replaces:
i) " with \" ...
- 101
2
votes
1
answer
1k
views
Is this a XSS vulnerability? I can't figure out why it's not working
I was working on a web app and as I was building the front-end for a search function I tried to see if it would be vulnerable to XSS.
After pressing the search button, the js code will generate a ...
- 43
1
vote
0
answers
278
views
Clickjacking and XSS on file upload input?
I reported a self-xss on file uploader input to a bug bounty company and they said that they will only accept it if i can find a good clickjacking exploit for that input. My question is: Is it ...
- 81
3
votes
3
answers
8k
views
CVSS Score for self-XSS (stored XSS)
I have a web application which is vulnerable to stored, self-XSS attack. Proper encoding is not done In the place where the data from a database (set by the same user) is added to response.
However, ...
- 31
1
vote
2
answers
2k
views
Is eval() in JavaScript considered self-XSS?
I found eval() in the JavaScript code of a site in HackerOne.
I could not find the where the function is called, so to test the vulnerability I went to console in Chrome and wrote the method and a ...
- 11
1
vote
4
answers
3k
views
How to prevent self-XSS?
I am creating a website which solely uses REST api for all the features and functionality, from signup and login to fetching data and populating the webpage using Mustache as template engine for ...
- 113
11
votes
2
answers
8k
views
Facebook's warning of self-xss
I happened to open my browser console on Facebook recently and was greeted with the following message.
Stop!
This is a browser feature intended for developers. If someone told you to copy and paste ...
- 223