Questions tagged [self-xss]

Self XSS is a XSS vulnerability that only affects the one performing it, such as tricking the victim into copy pasting code into the browser console.

Filter by
Sorted by
Tagged with
0 votes
1 answer
164 views

XSS Triggers only when pasted in

I have a XSS case that I would like to exploit as a proof of concept, however the payload seems to only be triggering when pasted in and not from the URL. Basically, I have a search box which when ...
user avatar
1 vote
0 answers
120 views

Does this qualify as Filename Upload DOM-XSS?

An application has the following javascript code which is triggered whenever an user tries to upload a file. a.html(fileName) then if the user uploads a file named <img src=x onerror=alert()> ...
user avatar
  • 487
1 vote
1 answer
203 views

Found XSS in chat form in bug bounty but they say it's only self XSS. How to leverage it? [closed]

I have found an XSS bug in a chat form on a bug bounty target. When I enter in the chat form input <button onclick="alert(1)">click</button> and after that I click the button a ...
user avatar
  • 21
2 votes
2 answers
243 views

Further exploit self XSS

I´m pentesting a clients website and found a self XSS Vulnerability in the Login Page: in case of a login error the Error Page shows the Username, so if you input <script>alert("XSS")&...
user avatar
1 vote
0 answers
764 views

Self-XSS From File Upload Name

I encountered this type of vulnerability a couple of times but was not able to fully exploit it. This vulnerability is a self-xss which is triggered from file names. E.g. If I were to upload a file ...
user avatar
1 vote
1 answer
794 views

Is this considered DOM-XSS or self-XSS or both?

SCENARIO: A web page shows an error login page using these javascript lines <script> let queryParams = new URLSearchParams(window.location.search); document.getElementById("message")....
user avatar
  • 487
0 votes
0 answers
497 views

Bypass XSS in script tag

<script type="text/javascript"> window.RPM = {"debug":false,"env":"user input"} </script> user input can be inputted with xss payload. Filter is doing following replaces: i) " with \" ...
user avatar
2 votes
1 answer
1k views

Is this a XSS vulnerability? I can't figure out why it's not working

I was working on a web app and as I was building the front-end for a search function I tried to see if it would be vulnerable to XSS. After pressing the search button, the js code will generate a ...
user avatar
  • 43
1 vote
0 answers
208 views

Clickjacking and XSS on file upload input?

I reported a self-xss on file uploader input to a bug bounty company and they said that they will only accept it if i can find a good clickjacking exploit for that input. My question is: Is it ...
user avatar
  • 71
3 votes
3 answers
6k views

CVSS Score for self-XSS (stored XSS)

I have a web application which is vulnerable to stored, self-XSS attack. Proper encoding is not done In the place where the data from a database (set by the same user) is added to response. However, ...
user avatar
  • 31
1 vote
2 answers
1k views

Is eval() in JavaScript considered self-XSS?

I found eval() in the JavaScript code of a site in HackerOne. I could not find the where the function is called, so to test the vulnerability I went to console in Chrome and wrote the method and a ...
user avatar
  • 11
1 vote
4 answers
3k views

How to prevent self-XSS?

I am creating a website which solely uses REST api for all the features and functionality, from signup and login to fetching data and populating the webpage using Mustache as template engine for ...
user avatar
  • 113
11 votes
2 answers
7k views

Facebook's warning of self-xss

I happened to open my browser console on Facebook recently and was greeted with the following message. Stop! This is a browser feature intended for developers. If someone told you to copy and paste ...
user avatar
  • 223