Questions tagged [xss]

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

Filter by
Sorted by
Tagged with
0 votes
1 answer
27 views

XSS bypass in url

I have a website: https://bugbounty.com/test/"injection inside js", but " is escaped with \ and I'm trying to inject </script><script>alert() but https://bugbounty.com/test/&...
1 vote
2 answers
60 views

xss: is it possible to continue javascript code execution after a "throw new Error()" line?

there is this javascript file that a can inject code after throw new Error("error string") line. But it seems that after the throw statement, no code can be executed. throw new Error("...
1 vote
1 answer
75 views

How is a XSS attack possible in this context?

I'm testing a website, which is vulnerable to XSS. <input type="hidden" id="referer" name="referer" value="INJECTION_POINT"> <script> document....
  • 11
1 vote
0 answers
18 views

force XSS after bypassing Request.Form using URL Encoding

I am testing a cross-site scripting attack on a website, as we all know the Request.Form function validates the input so the user couldn't insert a <script> inside the input. My focus in this ...
  • 11
0 votes
0 answers
29 views

Is storing access token in private data, refresh token in http-only cookie safe?

Backend: Django / Django Rest Framework, would be hosted at GCP k8s Frontend: Angular, would be hosted at some CDN e.g Vercel Authentication: JWT (https://github.com/jazzband/djangorestframework-...
1 vote
0 answers
30 views

Understanding browser text input value rendering for combatting XSS

If you use inspect in the developer tools for Chrome the values for the two input boxes below will look the same. <input name="test1" type="text" value="<script>alert(...
  • 111
1 vote
1 answer
52 views

How to alert cookie in 30 character XSS payload?

The application allows user to enter a 30 character long username. I tried the following XSS payload and it worked, but the triager is asking if I can alert cookie. But script tags and src keyword is ...
  • 11
0 votes
1 answer
19 views

Validating XSS script with success response with expected data in REST API

I am performing security testing on a REST API and it is a POST method. I injected an XSS script in a body parameter and the API responded with '200 success' response with the actual expected data. If ...
1 vote
2 answers
114 views

What exactly are Hidden HTTP Parameters?

I read a lot of reports where 'hackers' potentially exploited a 'Hidden HTTP Parameter'. There are also tons of tools which are developed for this exact purpose. Example : https://blog.yeswehack.com/...
0 votes
1 answer
55 views

What are the risks of XSS in this forms?

I recently developed a website that was operational for me ^^ However, someone came to try injections and found an XSS flaw. I have a form like this: <h2> <span>Search</span> </...
  • 1
0 votes
0 answers
55 views

CSP for Single Page App: Use client-side nonce for securing iframe content

Goal I'd like to tighten my Content Security Policy. Situation I have a single page react application (= All code and styles are bundled together into a bundle.js file). The file is simply placed on a ...
  • 101
0 votes
0 answers
44 views

XSS payload with html Encoding

I was reading about XSS Contexts on Portswigger and it has a section about the use of HTML-Encoding in bypassing input validation. What i understand is : The browser html decodes the entities before ...
0 votes
1 answer
54 views

Why do you think this code isn't firing?

I don't have a lot of knowledge about xss so im kinda confused, why this is not popping up an alert box?
  • 1
0 votes
0 answers
25 views

I clicked what looked like an Amazon email, but it (maybe) was from an Amazon affiliate. Ended up at Amazon.com anyway. Can I safely investigate? [duplicate]

In a case of clicking too fast, I clicked on a picture that looked like it was from Amazon. However this was not the case. I did end up at Amazon, but I'm aware that other things could've taken place ...
0 votes
1 answer
49 views

How do browsers defend the user against XSS?

I'm learning about the different mitigations employed by browsers against XSS vulnerabilities. Let's say, the developer made a mistake and there is a XSS vulnerability on a site. Unfortunately, a ...
0 votes
1 answer
61 views

Jsoup XSS attack with URL encoded input

I'm having a Spring Web Application that exposes REST APIs. I have implemented XSS filter using Jsoup that strips the input using Safelist.NONE. The penetration testing team raised a concern where the ...
1 vote
0 answers
31 views

Storing auth token in html

Current projects webs application utilises a cookie based approach to store users auth token. Implemented with secure and http-only attributes set. All traffic over https. The application loads third ...
  • 11
1 vote
0 answers
97 views

Client-side Javascript injection by assinging the output of window.location.href.substr to a variable

Sample code: function winLoad() { var sessionId = ''; if (window.location == window.top.location) { var semicolonIndex = window.location.href.indexOf(';'); if (semicolonIndex !=...
  • 11
2 votes
1 answer
60 views

Can I use a ServiceWorker to prevent an XSS attacker from gaining access to private user data?

I run a small blogging platform, and I want my users to be able to embed javascript that runs on their blogs (to manipulate the DOM, etc. as you might if you were hosting your own website). However, I ...
  • 125
0 votes
1 answer
134 views

Vulnerabilities in img src

It is known that in modern browsers you can't run XSS in img src(assuming quotes are escaped), because neither javascript: protocol, nor svg will execute the code. But does it mean that trusted data ...
3 votes
2 answers
230 views

Can someone bypass this XSS filter

During our Red/Blue team practice my friend made a web forum application where people can post messages. What he did was filtering: The equal sign The key words: "javascript", "alert&...
0 votes
1 answer
65 views

XSS in location.hash.match() function

I was solving a CTF. Just reading the source code of the web page, I found a vulnerable piece of code: var r4c='(.*?)'; var results = location.hash.match('token\\('+r4c+'\\);'); I am unable to ...
0 votes
0 answers
52 views

Adding a script tag after the html closing tag

I am still a beginner in web vulnerability. While I was browsing on the internet I saw a challenge inspired by a real life security crisis. We are given a pcap of a malware infection that was done in ...
0 votes
1 answer
55 views

How secure is using https://*.domain.com as a value in a Content Security Policy?

Let's say I am an organization with all my resources on example.com. I have a web server in the DMZ that hosts a website named app.example.com open to the internet. The CSP for that website is Content-...
  • 1
0 votes
2 answers
90 views

Check for special characters in request parameters

Our system is accepting requests including special characters, see parameter2. Request [ { "reqHeader": { "parameter1": "abc", "...
  • 111
0 votes
2 answers
88 views

AES Encryption as XSS protection for url parameters?

So, I found a website that uses AES encryption to prevent XSS and I'm wondering if this approach is inherently flawed. It has an endpoint like execute.php?code=encryptedPayload which de-crypts the ...
  • 148
2 votes
1 answer
94 views

Should I worry about excessive data forgery from my users on Firebase?

I'm getting familiar with Firebase and the firestore database. I have a small project relying on a certain data format. It is a simple React project with direct connexion to its firestore, so no back-...
  • 23
2 votes
2 answers
113 views

What could go wrong with this inlined javascript variable initialization in ASP

I am currently reviewing an ASP application where this javascript initialization is used all over the place: const someValue = "<% get_some_value() %>"; And this pattern is actually ...
0 votes
0 answers
20 views

How to turn this particular HTML rendering into a XSS or open redirection

I am performing penetration testing on a web application. Let's say the site as "https://example.com" There is a comment field , where a user can add data and it will be shown in the same ...
1 vote
0 answers
72 views

What are the ways in which XSS can be done in innerHTML

Server has blacklisted <img> and <a> tags in input. Server does: var myvar = url.searchParams.get('query')) document.getElementById("id").innerHTML = myvar <img> and <a&...
1 vote
0 answers
122 views

Possible window.location.hash DOM XSS

I've recently gotten into web security and javascript and I think this looks like apretty promising DOM XSS: let hastagIntentos = 0 , posAnterior = 0 , reintentosHatagPos = 0; function ...
2 votes
1 answer
69 views

Should I call a vulnerability XSS even though it is blocked by the CSP?

Let's say the Content Security Policy looks like this: Content-Security-Policy: default-src 'self'; It's also not possible to upload JS files on the same origin. Now there's an exploit to write ...
  • 23
1 vote
2 answers
440 views

String in JSON message body blocked by Azure WAF with OWASP 3.1 returning 403

Details I have an application running behind an Azure Web Application Firewall (WAF) on an Azure Application Gateway (AppGW) that was previously on an on-premises server. Since moving it to Azure, ...
  • 113
0 votes
0 answers
31 views

XSS reflected in a parameter via POST (Body)

In the last few days, I received a challenge. This challenge was based on an XSS vulnerability reflected in a website. When the site makes a certain request via POST, in the body there is a parameter ...
0 votes
0 answers
31 views

XSS by methods of ASCII on servers other than Apache Tomcat

I know that Apache Tomcat can communicate with US_ASCII encoding, which gives an interesting vector to XSS, such as: ¼script¾alert(¢XSS¢)¼/script¾ Is there a request syntax that would make other ...
0 votes
3 answers
263 views

What XSS attacks could somebody perform through an iframe?

If a potential attacker was able to upload a cross-origin <iframe> element to your website as a post of some sort, what could they actually do through it? I know that cross-origin <iframe> ...
2 votes
1 answer
161 views

Can the value attribute of input tag be a DOM-XSS sink?

Can at this code the input.value be a Dom-XSS sink? let qs=new urlsearch(location.search); let paramValue=qs.param; let input=document.getElementByID('inputField'); input.value=paramValue; I tried ...
0 votes
1 answer
263 views

XSS in href attribute

I'm currently pentesting a website where I can set a URL on my profile. I'm trying to get an XSS to fire, but my javascript knowledge is a bit limited for this use case: Imagine this is your ...
  • 50
1 vote
1 answer
135 views

Is this code code vulnerable to XSS?

I have a function that accepts the param url and passes it to exec() function getQueryValue(url, name) { name = name.replace(/[\[]/, "\\[").replace(/[\]]/, "\\]"); var ...
  • 135
1 vote
1 answer
160 views

Reflected DOM XSS Portswigger Lab

I'm a total beginner and im trying to solve Portswigger Academy labs. I'm studying on XSS right now and im stuck in somewhere. Lab Details:This lab demonstrates a reflected DOM vulnerability. ...
0 votes
1 answer
97 views

Can you have an <iframe> tag with no spaces?

I am looking to figure out how to create an iFrame tag without any spaces. I have found an input on a Bug Bounty program that reflects my input back into the page, and allows me to escape double ...
  • 50
0 votes
1 answer
191 views

XSS payload to Send request to server without closing tag

I was testing a website which does not have XSS in their scope. So I thought it would be a good idea to escalate XSS to a bug which is valid. I need to make a request to my server but the problem is ...
1 vote
2 answers
245 views

Difference Between Reflected XSS and Reflected-DOM XSS

What's the difference between Reflected XSS (RXSS) and Reflected-DOM XSS (RDOMXSS)? After some research, I think it can be concluded that Reflected-DOM XSS is: Similarities: The value is reflected by ...
0 votes
0 answers
78 views

Bypass XSS filter in data- attribute

My web application allows users to make custom divs with whitelisted attributes. One of them is data-{user-input}. Recently I have seen the following XSS payload: [[div data-test/onmouseover=alert(1)]]...
1 vote
1 answer
699 views

"One of your code blocks includes unescaped HTML." JS console security warning

I operate a blog using Google's Blogger platform about programming. I use highlight.js for syntax highlighting, and now on my posts I see the console warning: One of your code blocks includes ...
0 votes
0 answers
46 views

Accidentally locked an XSS vulnerable input

On https://ais.osym.gov.tr/ I saw an XSS vulnerable input. I tried some payloads without malicious intent which only contained alerts or console logs. The code img \x00src=x onerror=alert(1) worked. ...
2 votes
3 answers
189 views

Can I visit a malicious website by using Tor with settings set to safest or by using NoScript on an ordinary browser with settings set to untrusted?

Can I visit a malicious website by using Tor with settings set to safest or by using NoScript on an ordinary browser with settings set to untrusted? If not then is there any way to visit a malicious ...
1 vote
0 answers
826 views

Checkmarx Client DOM XSS Violation in ReachJS

I have this message from Checkmarx: The application's = embeds untrusted data in the generated output with location, at line 19 of ****.js. This untrusted data is embedded straight into the output ...
  • 111
1 vote
2 answers
485 views

Reflected XSS found in web application via POST request with JSON body. Is this issue exploitable?

I was testing an application recently and i came across with a Reflected XSS vulnerability via HTTP POST Request with JSON body. Although this condition can't be exploitable from his own, due respond'...
  • 15
1 vote
1 answer
94 views

Risk of injecting a malicious script/code?

I was was inspecting elements in a website and I randomly stumbled onto this piece of code . </style><meta name="add-styles-here"/><meta name="add-scripts-here"/>&...

1
2 3 4 5
30