Questions tagged [xss]

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

Filter by
Sorted by
Tagged with
3
votes
0answers
55 views

Is this XSS filter for HTML comments safe?

HTML comments can be notoriously tricky from an XSS standpoint, and the standard recommendation seems to be to never put untrusted user data in them. But shouldn't it be possible to strip out a few ...
1
vote
0answers
45 views

XSS Vulnerability Reproduction

I have a Qualys web application scan report that says I have a XSS vulnerability. It explains this was detected by requesting a malicious payload and evaluating the response. When I make the same ...
0
votes
3answers
78 views

Xss payload with onpointerover?

I bypassed a WAF and found an XSS vulnerability using the onpointerover event handler. In the page where I found the vulnerability, there's also a login page. What XSS payload can I use with the ...
0
votes
1answer
76 views

Is there a danger to client port scanning?

Are there any security risks associated with client-side port scanning? Or, more specifically, a "trusted" site (e.g., banking website) loading javascript trying to connect to various localhost ports? ...
0
votes
0answers
48 views

How to make a HTTPrequest in JSONP callback?

I'm trying an XSS challenge. I found an exploit that breaks CSP by using a JSONP callback. I can get an alert to pop up by putting something like: <script src="https://whitelisted.jsonp?callback=...
1
vote
0answers
77 views

Is there any way to break the HTML attributes without using single/double quotes?

I have the following code, <li data-type="test" title="?"> test </li> Following values were Not allowed <>&*#%\'"= My goal here is to get a javascript popup to appear. is ...
1
vote
1answer
51 views

Avoid cross site scripting in XML namespace

We have a legacy application on spring mvc and we have a web service exposed (SOAP protocol) for some reporting client app. This service was tested by a security team and the report indicates that the ...
5
votes
2answers
918 views

Is directly echoing the user agent in PHP a security hole?

Is this script vulnerable to PHP or JS code injection? In my quick test I changed the useragent to a PHP script but it will not be executed just printed. If change the user agent to a javascript code ...
1
vote
1answer
76 views

Ingesting markup from WYSIWYG text editors

Maybe I'm missing something obvious here... The development landscape is littered with client-side WYSIWYG text editors (for example, TinyMCE), all of which seem to want to send raw HTML back to my ...
1
vote
1answer
90 views

Why does javascript not show an alert box? [closed]

I'm trying to insert javascript:alert(1) inside tag. There is some kind of filter for javascript, so I tried using javascrip%74:alert(1) and that url is accepted. However when i click on it it ...
1
vote
1answer
59 views

Sending multiple Content-Length headers in a HTTP POST request using Javascript

I'm playing around with a self-xss bug that I believe I can escalate with a CSRF attack. However, the exploit relies on sending two identical Content-Length headers in a single POST request. ...
0
votes
1answer
71 views

How can i get an alert box from this?

While testing a website i noticed that the value of parameter username is reflected inside the javascript code of the response. It's insert into a variable like this one: var valueUser = "my-...
1
vote
1answer
85 views

Exploiting stored XSS on Android app?

I'm testing Android app which is vulnerable to HTML injection, but I'm having problem escalating it to a stored XSS vulnerability. I have tried these, and many more: <script>alert(1)</...
3
votes
2answers
161 views

XSS with <a> tag with target="_blank`

Basically, I am having an <a> tag with target set to _blank, where an attacker has control over the href parameter, thus possible inserting a javascript tag, like the following: <a target="...
1
vote
1answer
103 views

XSS in iframe can't access document cookies

I know of a website, lets call it website.com, that has these vulnerabilities: iframe injection: I can inject an iframe with a src attribute, but cannot inject any script directly. Lets say that this ...
2
votes
0answers
110 views

Is it still possible to use HTTP TRACE for XSS in modern Web Browsers?

Let's assume we are talking about top 10 most used web browsers: Usage share of web browsers https://www.cgisecurity.com/questions/httptrace.shtml 'TRACE' is a HTTP request method used for ...
0
votes
1answer
43 views

Character filtration in globalisation supported application

I am working on building an application which will be used in various language , to secure from attacks like xss, SQL injection I thought implementing character filteration (whitelisting/blacking) but ...
1
vote
2answers
153 views

Terminate a javascript without “continuous” < and / [closed]

So I am testing a website and found out I can inject most characters, here is what I have found: " is always escaped with \" < and > are not escaped Interestingly, / is only escaped with / if < ...
2
votes
2answers
78 views

Understanding POST based XSS

I have been trying to learn about XSS, more specifically, POST based XSS. But I am unsure if I actually understand how POST based XSS works. With a GET, you can do XSS with the URL parameters, but to ...
1
vote
0answers
50 views

Finding XSS vulnerabilities [closed]

My hosting company have pulled my Drupal website because modsecurity highlighted Pattern match "(?:\b(?:(?:type\b\W?\b(?:text\b\W?\b(?:j(?:ava)?|ecma|vb)|application\b\W*?\bx-(?:java|vb))script|c(?:...
1
vote
1answer
117 views

Is there an XSS exploit to overcome stringification of all user input?

Question: Is stringifying all user input with something like JSON.stringify enough to prevent xss attacks? If not, is there an example of a xss exploit that overcomes this? Edit for clarification: ...
1
vote
1answer
115 views

Bootstrap 3.3.7 XSS [closed]

I found that Bootstrap 3.3.7 is vulnerable to Cross-Site Scripting (XSS) via the data-target, data-template, data-content, data-title and data-viewport attributes. How can I inject the XSS into these ...
2
votes
2answers
78 views

XSS Mitigation using regex

I am allowing following character in regex that is dash, tilde, attherate, a-z, A-z, 0-9 [A-za-z_0-9.,\t\r()\\[\\]@ ~/[-]+$] Is there any possibility to bypass these regex? Actually, whenever ...
3
votes
2answers
130 views

What does The input is reflected inside a tag parameter between double quotes mean?

A recent scan of Acunetix has shown some vulnerability on one of my pages. I tried reproducing it but i can not find any vulnerability. The so called vulnerably is titled The input is reflected inside ...
6
votes
1answer
302 views

Risk of allowing the string “xss” in query string

A former employee, put the following in our "global.axas" if (url.Contains("xss")){ response.StatusCode = 404; response.end(); } I get he was trying to prevent cross site scripting, but other than ...
1
vote
1answer
134 views

data:// uri XSS - using wrappers

Is there any way to load html data uri: data:text/html,<html><svg/onload=confirm(1)></html> with this scheme: data:// i have seen this payload going around: data://text/javascript,...
0
votes
1answer
80 views

How to fix XSS in rails

I am able to inject javascript:alert `1` or javascript:alert(1) into the href field of the rails app and it is getting executed as JavaScript. Html encoding is already implemented but it doesnt encode ...
1
vote
1answer
64 views

Is using default-src * safe?

I have a website to do security testing. The CSP is as follows. default-src * ; style-src 'self' 'unsafe-inline' data: https://netdna.bootstrapcdn.com/ http://s3.amazonaws.com/ https://s3.amazonaws....
0
votes
2answers
71 views

is it possible to bypass cookie protection to perform a CSRF on HUAWEI HG531 v1 router?

the AJAX login script var xhr1 = new XMLHttpRequest(); xhr1.open("post", 'https://192.168.1.1/index/login.cgi', false); xhr1.send("Username=admin&Password=...
0
votes
0answers
80 views

Is throwing malicious strings in json_encode a good way to evade Stored XSS?

I'm aware that filtering strings doesn't go this way, but when encoding xss payloads into json format in php and storing that information temporary in classes, the result in the browser, it will show ...
0
votes
2answers
110 views

Is acquiring the csrftoken alone sufficient for performing any security exploits?

I have confirmed the presence of reflected XSS vulnerability in my website and I see the csrftoken present in one of the cookies when injecting a document.cookie in javascript. We don't have the user-...
2
votes
1answer
125 views

Stored XSS + PHP Backdoor + File upload vulnerability

I built this web application(Used PHP 5 + MySQL) where I could take advantage of file upload vulnerability and XSS. My route of attack is: Upload a PHP backdoor which I built with msfvenom Go to ...
1
vote
1answer
39 views

Having web client do requests with User's 3rd party API key?

I am trying to figure out the best way to do this. I have done some searching and all I have found is about storing API keys in a back end, nothing like my use-case where there is no back end. ...
-2
votes
1answer
118 views

How to block or stop redirection with window.location?

I need to block redirection using window.location on my site. Some hacker has injected a stored XSS script into my site: if(my_username != 'Name') window.location = 'https://the url'; Now each ...
0
votes
1answer
47 views

What should be header response of XSS vulnerability upon form submission?

We have a PHP web application and all of the user inputs are sanitized. We tested it within Burp tool and found no XSS vulnerabilities. One of our security adviser tells us that when you type down ...
2
votes
2answers
218 views

Is there a way to execute XSS in an HTML img tag with SVG?

Is there a working technique to execute XSS in modern browsers using a SVG file displayed on a web page with an <img src=""> tag? I know a way to execute without <script> tag, but I don't ...
2
votes
1answer
84 views

Are all anchor tag href attributes considered XSS vulnerabilities?

I've got an app which allows users to customize the "thank you" message that is displayed to users when a form is submitted. For the "thank you" message contents I've whitelisted allowable HTML tags ...
1
vote
1answer
87 views

Performing multiline xss

I am playing one pentesting game theres a task where i need to perform multi line xss to print cookies. I was able to make xss that print "x" because one line is too short for entire command so this ...
0
votes
1answer
61 views

Server error when entering a percent symbol in search? [closed]

Fuzzing a website and came across an odd behavior. The site has a search bar, it sends queries via a GET request with the standard ?q= parameter. When I try the standard XSS payloads such as <...
0
votes
3answers
106 views

Information gathering on website [closed]

I'm pretty new to pentesting and everything about it. This question is primarily for web servers. I'd like to know for you pentesters out there, what information are you looking for when you are ...
2
votes
0answers
63 views

Are XSS attacks, or any other where a third party script is used as the attack vector, Living Off the Land (LOtL) Attacks?

I'm an intern at a big company and my education is in Security Risk Analysis but I somehow got put on a software development team and am basically relegated to research. I'm surrounded by software dev'...
0
votes
1answer
82 views

When should you give up on attempting a xss on part of a website? [closed]

I'm wondering when do you give up on some type of user input to exploit? What are the things that go through your head and that you check off, that makes you think that the input is properly sanitized?...
0
votes
2answers
82 views

Is there another way than session hijacking to access user account through XSS?

If I have discovered an XSS vulnerability, is there another way of gaining access to an account without session hijacking? Mainly because on most of the sites I test, the HttpOnly and Secure flags are ...
41
votes
1answer
5k views

Why do I need two parameters in an HTTP parameter pollution attack?

I'm reading about HTTP parameter pollution and I'm confused about one thing. If there is an endpoint like this, https://security.stackexchange.com/editpost/?postuid=19348 and you tried a HPP attack, ...
1
vote
1answer
325 views

How would someone XSS into a WebView?

There are several articles about XSS vulnerabilities in Android/iOS WebViews. By WebView I mean the 'real' webview not SFSafariViewController or Chrome Custom Tabs. I understand the main concept of ...
3
votes
1answer
161 views

Safe user input HTML in 2019

(I know this topic has been discussed a lot in the past, and I've read a lot of threads here as well as OWASP, but have additional questions including the specific CSP listed below.) We want to allow ...
0
votes
0answers
45 views

What's the impact of UXSS in open redirect vulnerability?

i am well aware of the impact of reflected, dom and stored XSS. Recently i discovered what Universal XSS is and i am a bit confused by it. i know it executes locally in the browser, but is it possible ...
3
votes
1answer
72 views

javascript eval() clarification

I've read this article about eval security issues. I need a clarification about this particular situations: For example, imagine we had a web app with a text field input that we were running eval()...
-2
votes
1answer
142 views

How to protect my site from XSS

I own a chat site {https://trixac.com}. It uses BoomChat's code. Recently I banned a troll and now he is back and hes running XSS injections against my site and it's working for some odd reason. I've ...
0
votes
0answers
78 views

xss attack on value field by bypassing encoded double quotes

consider a website that handles search query like this: <input class="something" type="search-field" value="SEARCHQUERY"> if i try to inject this script it doesnt work... " onerror="alert(0) ...