Questions tagged [xss]

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

Filter by
Sorted by
Tagged with
0
votes
0answers
34 views

Is it possible to read and extract HTTP request headers via JavaScript while performing XSS & CSRF? If so, how?

Is it possible to read and extract HTTP request headers via JavaScript? i.e. something like; var req = new XMLHttpRequest(); req.open(‘GET’, document.location, false); req.send(null); var headers = ...
1
vote
0answers
26 views

web app 3rd party JS dependency vulnerability management

As a security engineer, I wonder about the common approach for web app 3rd party JS dependency vulnerability management. We have a lot of apps depend on Jquery etc. In a regular vulnerability scan, ...
1
vote
0answers
37 views

Will javascript execute which is in an HREF?

I have located an issue where the user can provide an HTML that will be rendered on a page. Unfortunately, the HTML is rendered inside an href attribute using "(quotes), making it impossible to ...
1
vote
0answers
24 views

Access to a js variable which visible for a brief period of time via XSS [migrated]

If I put a breakpoint on a Javascript function when I visit a web page and I examine a JS variable that variable contains the cleartext password just for a brief period of time. I found an XSS and I ...
0
votes
0answers
23 views

How can I scrape the XSRF cookie value to bypass CSRF protection? [closed]

I'm learning about XSS attacks and need some assistance as I'm not that good with JavaScript or other ECMA-based syntax. My local server integrates anti-CSRF tokens via the XSRF cookie value. This ...
1
vote
0answers
63 views

Prevent XSS in 3rd party (self hosted) application

We have an application which have purchased from a 3rd party and host in our own environment. The application consists of its own UI and back-end, and is included in our own application through an ...
1
vote
1answer
62 views

XSS on infinite-scrolling pages

Say I make a social-media website and forget to include the htmlspecialchars() function. If the website uses infinite scrolling (that will eventually show every post on the website if you scroll down ...
2
votes
1answer
49 views

Is an XSS via Cross-Site File Upload (CSFU) practically exploitable?

I came across a very interesting case: The user uploads a file The file contains <script>alert(2)</script> The web app shows the file's content to the user -> the XSS payload is ...
-1
votes
0answers
23 views

What are the alternatives of angular brackets, double-inverted comma, etc. for XSS if the server sanitizes it? [duplicate]

I am trying to do XSS on some websites mentioned in hackerone. So in some web applications, the server sanitizes angular some special characters. What can I do so that the server won't sanitizes it ...
0
votes
0answers
56 views

JWT implementation and protection against CSRF and XSS

I have been going through OWASP guidelines on managing JWT based authentication. So, I have decided to change my current JWT implementation as per that. Flow is as below. When authenticated ...
1
vote
1answer
101 views

Can a malware steals my Facebook c_user, xs, and datr Cookies?

Just as the title suggests. I have a PasswordStealer on my PC and I'm afraid that it can do that. AFAIK, that malware can record keystrokes and steal saved passwords which I don't mind because I don't ...
0
votes
2answers
71 views

Does an effective Content Security Policy mitigate a universal cross-site scripting vulnerability?

I am doing some background research into types of XSS and prevention and as I understand it there is not much any application can do against a universal XSS in a plugin or browser. A last line of ...
0
votes
0answers
28 views

Whats wrong with this XSS vector? [duplicate]

Payload: <DIV STYLE="background-image: url(javascript:alert('XSS'))"> Reference: http://seguretat.wiki.uoc.edu/index.php/XSS_Cheat_Sheet Can someone please explain why this payload is ...
0
votes
1answer
155 views

Xss filter bypass >&lt;script&gt;alert(1);&lt;/script&gt; [duplicate]

As you can see, all fields that I send only the attributes < > are coded, so they are not executing in the browser. Is there any way to bypass this XSS filter? In my case, only these attributes ...
2
votes
1answer
55 views

Prevent Cross Site Scripting but still support HTML file upload

I have a web application where user can upload and view files. The user has a link next to the file (s)he has uploaded. Clicking on the link will open the file in the browser (if possible) or show the ...
0
votes
0answers
11 views

JavaScript injection minimal example using node/express not working: <script> not executed [duplicate]

I want to create a minimal example where JavaScript injection/XSS is working. This is my example server: const express = require("express"); const path = require("path"); const ...
3
votes
1answer
568 views

How can I read local files from blind XSS?

When I do one of these payloads, I can see /etc/passwd: <iframe src=file:///etc/passwd></iframe> <img src="xasdasdasd" onerror="document.write('<iframe src=file:///etc/...
1
vote
2answers
54 views

Does OpenID Connect provide CSRF and XSS protection?

I've been reading several articles recently about how storing JWTs in local or session storage is inherently insecure. The mitigation is apparently to implement a "session ID pattern", i.e. ...
3
votes
1answer
376 views

ModSecurity - XSS not blocked when #/ (hash) is added in the url by NodeJS application

I have installed ModSecurity in Apache server and using it as a reverse proxy to forward request to a NodeJS applicaiton. I have followed this tutorial to configure ModSecurity in Apache, https://www....
0
votes
0answers
78 views

CTF XSS Session Hijacking

I'm playing a complete noob in terms of security but a friend invited me to play a internal CTF for my company and I'm stuck with this challenge. I have a simple website that goes as follows: http://...
0
votes
0answers
104 views

Is it possible to bypass httponly?

I reading some articles about XSS, and how to mitigate the flaws in a web application. I've seen the HttpOnly on Set-Cookie, and i ask myself can this flag can be bypass ? Or is it a another way to ...
0
votes
0answers
28 views

How to secure my mobile application without knowing the source of an uri to display an image?

I would like to know if I expose myself to security problem (potential xss threat?) if I accept unverified external url of images (for instance https://another-website-external-image.png) to be ...
0
votes
1answer
54 views

Is there a good place to find WAF rules tested? [closed]

I am searching evaluated WAF rules that check OWASP Top 10 and even more to have decent protection of a web infrastructure.
2
votes
0answers
29 views

Escaping angle brackets if entry point is between tags?

So I'm trying to evade a filter that escapes < and >. I read that it's possible if the XSS gets injected inside a tag, but in my case, it gets injected between <span></span>. Are ...
1
vote
1answer
54 views

CVE-2019-14748 but the file is downloaded and open locally - can it be used for XSS?

I'm testing CVE-2019-14748 on an example.com with osTicket. I've uploaded a test.html with the basic <script> and <img> XSS payloads which run when a user opens test.html. However, in ...
0
votes
2answers
65 views

can i execute javascript in href when i have text before my input?

This is where I took this example from: <a href="<?php echo $_GET['e'];?>">Back</a> In this code, I can do http://my_url?e=javascript:alert() But what can I do if my code ...
1
vote
0answers
37 views

Bypassing Comment by XSS

I'm learning Web Security currently, and my tutor left this practice for us. Is there any solution to bypass this js statements and as a result, for example, to display alert(1)? Thanks! input = input....
0
votes
0answers
16 views

How can I bypass double quote transformation in &quot; and < transformation in &lt; and > &gt; in XSS bug bounty attack [duplicate]

I started bug bounting and I am trying to do an XSS attack and my " and < > are converted in &quot; &lt; &gt; How can I bypass this?
1
vote
0answers
49 views

Safely render HTML template with inline CSS from trusted domain (it forces the use of “style-src: unsafe-inline” in CSP)

I am working with a form that a user can fill out to send an e-mail. As part of the form, there is a preview button that shows the user a preview of how the mail will look in a new tab in the browser. ...
1
vote
1answer
86 views

XSS injection in the name of a file to be sent

I found a reflected XSS in a POST request that sends a file to the web server. The HTTP POST Request The HTTP 200 OK Response When I want to try to insert document.cookie in the payload, the web ...
1
vote
0answers
87 views

XSS on marketing websites like craigslist. How does this work on a technical level? [closed]

I was wondering how this works. We have a marketing site in Holland where people can sell second hand goods. Rumor goes that there is a lot of phishing going on there and XSS code is used in the ...
1
vote
0answers
102 views

XSS with Template Literals

I suspect I have a potential XSS vulnerability at a client-side level, however, I'm not able to exploit it successfully. The URL I'm using consists of three parameters that reflect back to the user ...
0
votes
0answers
102 views

Angular Expression/XSS-Payload without Quotes or “$”

I am really trying hard to exploit a Client Side Template Injection vulnerability in a webapp I am currently pentesting. Im so close to getting the payload to be executed, but I am stuck at the last ...
0
votes
0answers
41 views

prevent dom based - xss from js file in mvc

I'm using a free template as a front end in my application and the main javascript file came out as a high risk as it's vulnerable to a dom based cross site scripting.Is there a way to sanitize the ...
1
vote
0answers
34 views

Decoding burp XSS DNS resolution payload

I'm testing burp against a vulnerable application as part of work for my client. There was one successful xss payload related to DNS lookup which worked on form data at point of file-upload. Here is ...
10
votes
1answer
3k views

How is it possible that a <script> tag was injected, but not executed?

I've recently tested a web application and found out that it was vulnerable to Stored XSS attacks. However, a peculiar behavior left me a bit puzzled. When I inserted John <script>alert(1)</...
2
votes
1answer
102 views

What is the point of having a refresh token if it can be as easily stolen as an access token on client-side/JavaScript applications (SPA/PWA)?

From my understanding, the point of having a refresh token and short lived access tokens is to mitigate the consequences of having the access token stolen. This way, if this happens, the attacker will ...
1
vote
1answer
70 views

Is it possible to bypass malformed Content Security Policy missing quotes?

I found a website that has a very strict but malformed Content Security Policy of the form: Content-Security-Policy: script-src none which should actually be Content-Security-Policy: script-src 'none'...
0
votes
2answers
117 views

Bypassing htmlentities() for XSS attack

I'm only a beginner so if any more info is needed just request and i'll update the question. For one of my modules we are covering cross-site scripting and I have been given a series of PHP files that ...
0
votes
2answers
107 views

Does CSP mitigate against client prototype pollution XSS and DOM XSS?

DOM XSS and client prototype pollution-based XSS have one thing in common, we are modifying the pre-existing JavaScript code to popup an alert(1). Will CSP mitigate XSS in this case? Theoretically, ...
0
votes
0answers
95 views

How to evade Angular HTML sanitizer for XSS

I'm trying to evade the HTML sanitizer in a field I found more vulnerable in my application to test some XSS injection. The field that I'm trying to exploit is a dropdown with the following code. The ...
1
vote
1answer
55 views

Getting an abnormal amount of firewall warnings on web server

I just had a look at the firewall status and saw it had blocked over 300 requests from TOR, Python Urllib, and some script called aabbccdd.xss.ht/pigeonburger.xyz (pigeonburger.xyz being my website). ...
0
votes
1answer
221 views

XSS without angle brackets

I would like to run the following script inside an input tag when the page loads. I know how this can be fixed by using onfocus and autofocus. But how do I get the expression document.cookie in there? ...
28
votes
6answers
6k views

Is splitting a REST API server from a Web server considered a security threat?

I am participating in a project that involves a JavaScript SPA that provides a service and is intended to interact via REST APIs with one of our servers. Initially, I proposed to work on the two ...
0
votes
0answers
40 views

Should you even bother trying to hide authentication from XSS?

I read a comment on here that goes something like "trying to hide user authentication from an XSS attack is like reinforcing your fridge against a nuclear bomb; at that point, you've got much ...
1
vote
0answers
52 views

Can “c:set” cause Cross Site Scripting (XSS) vulnerability?

Can this be exploited as XSS vulnerability using urls like localhost/?myVar=<script>alert(document.cookie)</script> or though any other possibility? <c:set var="myVar" value=&...
0
votes
2answers
106 views

What parts of the javascript code can an XSS attack access? [duplicate]

I understand that XSS attacks can access all globals (like cookies, storage, etc) within the context of the running javascript code, but I would like to understand if they could also have access to ...
3
votes
0answers
79 views

How can I implement CSRF Tokens without server-side rendering/templating?

I am attempting to build an application that submits numerous fetch/XHR requests to a NodeJS backend. I'd like to implement CSRF token protection, but would like to avoid implementing server-side ...
0
votes
0answers
84 views

Sanitising data for a flutter application

I am having trouble with some user input security. I have a Flutter app where users can submit comments that can contain text e.g. a-z characters, numbers, symbols and emojis. These are stored in a ...
0
votes
1answer
122 views

It's possible to trigger a XSS in url context without this following caracter ' : '?

I try to bypass a XSS filter to trigger a XSS in url context. But the problem this following char is blacklist ' :' The site allow the user to use some basic html balise like h1, h2, h3, p, a, u, etc ...

1
2 3 4 5
28