Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [xss]

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

1
vote
2answers
88 views

How to exploit XSS vulnerability through an iframe

Recently, I found a stored cross site scripting vulnerability in a rather large website, but I am not sure if it is dangerous or worth reporting. On this website, there is a resource section that is ...
2
votes
1answer
75 views

Is it safe to let the user name an object key in JavaScript?

Recently I found a piece of code that takes input from the url. The input then get's saved into a javascript object: https://website.com/?foo=bar var x = {"foo": "bar"}; While the value doesn't ...
1
vote
0answers
49 views

WAF is set to Alert, not block. We are seeing thousands of XSS and SQL Injection attacks. How can I tell if any were actually successful?

I'm pretty inexperienced with WAFs and the events/alerts it generates. I'm wondering how I can tell if any of those were successful? For example, in the last 24 hours we saw over 50K alerts/events ...
0
votes
1answer
55 views

Is my checkNumber() function secure?

function checkNumber(number) { event = document.all ? window.event : number; key = document.all ? event.keyCode : event.which; window.event.keyCode if(key<48||key>...
0
votes
0answers
36 views

XSS vulnerability [closed]

I have a html page and a segment of PHP code. I know that is vulnerable to an XSS attack but I don't know how to perform the XSS attack. HTML <!DOCTYPE html> <html> <body> <h1&...
0
votes
0answers
43 views

How to bypass character filtering in XSS?

I am solving XSS challenges. I found difficulty in one that filters the character "o" both uppercase and lowercase. I can run tag. I have to call function "prettyRobot" to complete the cahllenge. But ...
0
votes
0answers
48 views

Bypass input sanitization to close HTML comment for XSS injection [closed]

I'm trying to execute a XSS attack. But the content that reflected in the browser was commented out. So I tried to close the comment by including --> but this become - ->. (A space in - -.) I ...
0
votes
1answer
64 views

XSS: Character showing in DOM

I have created an html page that redirects user to a test site that has an XSS vulnerability. I am able to successfully execute javascript via the vulnerability. However, I have found that some of the ...
1
vote
1answer
58 views

iframes, user generated content and scripts

Currently, we have a small personal project which is meant to allow people to create 'profiles' in HTML/CSS. We aim to put all this generated content within a sandboxed iframe. The next point in ...
3
votes
1answer
121 views

Find security weaknesses in this website (exam question)

I am currently studying for a computer security exam and I am stuck on the following question from a past exam paper 1c <form action=”message.php” method=”get”> 2c <p>Message: <input ...
0
votes
0answers
28 views

What are the risks with leaving the offending anchor portion of an URL in a failed client-side XSS attack?

As a simple example, let's assume that I have implemented a key-value lookup within a pre-populated, static JavaScript dictionary. Let's say that the dict is: a = { 'one': 'uno', 'two': 'dos' }; The ...
0
votes
1answer
72 views

Bypassing htmlspecialchars() for XSS (Reflected) and using an event handler is not an option in this case

I am trying to bypass high security XSS on DVWA. So the vulnerable code(I highly doubt that is it really vulnerable?) is:- <?php if(!array_key_exists ("name", $_GET) || $_GET['name'] == NULL || $...
1
vote
1answer
123 views

Bypass a simple XSS filter that only looks at <

Say, I have a page where the input from the user is taken and is passed through a simple client-side XSS filter. That filter only replaces < characters with ''. in = in.replace(/[<]/g, ''); ...
0
votes
1answer
77 views

Is it possible to bypass this Xss Filter?

Everyone, I was creating this XSS filter for my node plugin and I want to know is it possible to bypass this? function xSSFilter(str) { return str .replace(/&/g, '&amp;') ...
1
vote
0answers
29 views

If and why is it safer to output JS literals into an HTML tag than JS encode them and set them directly to a JS object?

From ASP .NET Core docs about preventing XSS: Before putting untrusted data into JavaScript place the data in an HTML element whose contents you retrieve at runtime. If this isn't possible, then ...
59
votes
9answers
12k views

How hard should I try to prevent a user from XSSing themselves?

Let's say a user can store some data in a web app. I'm now only talking about that sort of data the user can THEMSELVES view, not that is intended to be viewed by other users of the webapp. (Or if ...
36
votes
9answers
11k views

How dangerous is XSS?

I am a software engineer and have been watching a lot of videos about XSS. But I fail to understand how is it dangerous if it runs on the client side and does not execute on the server side which ...
0
votes
0answers
32 views

Finding hidden parameters manually for XSS

I am researching about XSS and Google helped me a lot about learning like how to bypass XSS filters, POST and GET based XSS . I am really curious to know how to find hidden parameters manually for ...
0
votes
2answers
50 views

Is eval() in JavaScript considered self-XSS?

I found eval() in the JavaScript code of a site in HackerOne. I could not find the where the function is called, so to test the vulnerability I went to console in Chrome and wrote the method and a ...
0
votes
4answers
137 views

Is XSS and HTML injection the same?

When doing a XSS, we usually put the JavaScript code between the <script> tags. I have noticed that HTML injections are very similar because you are doing almost the same thing, but using ...
0
votes
0answers
63 views

Application design to avoid XSS & CSRF attacks

I am learning to design a system where it can be guarded against XSS & CSRF attack. I'll quickly list down my understanding and then raise questions. It's a simple case of fraud that I am trying ...
5
votes
1answer
2k views

Why isn't this XSS working?

I'm learning DOM XSS and I have this code : <html> <body> Select your language: <select> <script> document.write("<OPTION value=1>"+document....
0
votes
1answer
86 views

XSS triggered but chrome didn't show popup. What exactly was going on?

Related to my previous question on XSS in canonical link. At the beginning I turned off Chrome's XSS auditor and tried executing XSS with just onload event using following payload which did not ...
13
votes
1answer
949 views

Is XSS in canonical link possible?

During regular pentesting of my site I discovered that I can close double quotes in a canonical link tag and enter an onerror attribute with a simple javascript alert(1). It is visible in source ...
3
votes
1answer
490 views

Character escape sequences for “>”

OWASP gives all character escape sequences for "<". Where can I find a similar list for ">"?
0
votes
0answers
15 views

Bypassing < > XSS filter on a website [duplicate]

<a href="https://website.com"><span style="color: black;">text</span></a> I am trying to bypass an XSS filter but it is not working since given <, > are filtered and become ...
0
votes
1answer
94 views

xss payload “-confirm``-” [duplicate]

I found -confirm``- this payload on xsstrike while scanning one of my websites. I want to know more about it.
0
votes
1answer
215 views

Is there a way to exploit jquery 1.12.4 vulnerability?

According to https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=jquery+1.12.4 and https://snyk.io/test/npm/jquery/1.12.4, I see that jQuery 1.12.4 has medium serevrity vulnerability. I checked on ...
-1
votes
0answers
69 views

Deobfuscation Malicious Javascript Codes

I want to deobfuscate malicious code where they are embedded in the URL. I have these URLs downloaded from here, where the URLs are embedded with malicious JavaScript. URL
0
votes
1answer
100 views

CSRF and XSS protection via Header & Cookie-based JWT (tokens)?

I have built a REST API, where users login, with extra permissions in some cases (or restricted to certain areas of the site; or even admin privileges). What I've built: JWT authorization (added to ...
2
votes
1answer
76 views

XSS stored in DVWA

Trying "XSS stored in DVWA" and now I am completely confused. It is not letting me bypass, I tried many inputs and I know what the preg_replace() is doing still nothing seems to work for me. I used ...
3
votes
2answers
225 views

Is this hybrid (cookie, jwt) authentication method for web applications known and practical?

I have been working with web applications for a while, some months ago I found a possible approach to get the security advantages from Browsers while using cookies for authenticating requests, with ...
1
vote
1answer
99 views

Can an XSS exploit on a subdomain steal the cookies of the parent domain?

As per my understanding, if a cookie doesn't have a domain attribute (explicitly telling where this cookie can be used), by default that cookie will be used by the domain which issued it and all its ...
0
votes
1answer
48 views

Is it worth using a client-side XSS-focused library like DOMPurify?

That may not be the best way to phrase the question, but gives the basic idea. If everything client-side is malleable, is it even worth it to use a JS library for sanitization? I've seen DOMPurify ...
-1
votes
1answer
96 views

Can running javascript from the console be considered as XSS?

I did it from the console. Is this a security issues?
0
votes
1answer
28 views

How to filter HTML Event in Native PHP7

i want to creating xss filter for my own project, this is for html event filtering preg_replace("/ on\w+='[^']*'/i", '', preg_replace('/ on\w+="[^"]*"/i', '', $framed)); but considering to more ...
0
votes
2answers
157 views

XSS possible inside the value field of input tag when double quote is filtered?

Is it possible to get XSS in the value field of Input tag when the application filters out double quote? <input type="hidden" name="something" id="somenthing" value="my_input_goes_here"> input ...
1
vote
0answers
78 views

XSS and CSRF Protection in a SPA with session cookies and auth in sub-domain (confused)

The problem is, that the more I read about XSS and CSRF and the protection against these attacks for my website, the more I get confused what would be the right strategy. Setup: SPA (Reactjs and ...
1
vote
1answer
45 views

XSS using SVG: Is AllowScriptAccess attribute ignored?

I was experimenting with some Anti-XSS solutions, and during my research, I found following the XSS vector in a cheatsheet: <EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH ...
3
votes
1answer
121 views

How to prevent XSS in user-generated content (html) without disabling scripts and CSS [duplicate]

Is there a way to somehow sandbox user-generated content? I'm working on webapp which will contain a lot of user-generated content. Only "trusted" users will be able to publish the content, but I want ...
0
votes
1answer
82 views

XSS vulnerability in display message

I have a webpage in which Email is given as input. It will then display "your email is abc@xyz.com". I am then changing the email in URL to <script>alert(1)</script> and send tbe request ...
2
votes
0answers
58 views

Sandboxing untrusted JavaScript execution by redeclaring variables

Some irrelevant background (read only if you want to say "no, just use an iframe") Scenario Suppose that I downloaded a string jsCode containing arbitrary JavaScript code from a (potentially ...
0
votes
1answer
59 views

Blind XSS via cookie?

I would like to know if its possible to test blind XSS via a cookie value. That is I send the server some cookie that has a blind XSS payload. Or is blind XSS only exploitable if a human interacts ...
0
votes
0answers
84 views

Is this script vulnerable to xss? If yes, how can i get an alert box?

I think this code may be vulnerable to dom based xss but i wasn't able to get an alert box. I am able to control the userTitle field, i tried using </script> but it get changed to u003c/...
0
votes
0answers
26 views

How to deploy your web server's Web Application Firewall while limiting false positives

For objective discussion: We deploy several Web Application Firewalls where I work. I know that one particular on-prem product uses Apache [reverse] Proxy & ModSecurity to match HTTP POST traffic ...
0
votes
2answers
423 views

Prevent javascript cross-origin redirect by window.location.href

Following this question, is there a way to prevent this code from redirecting users to domains not whitelisted? const form = document.getElementsByTagName('form')[0]; form.addEventListener('submit', ...
2
votes
0answers
57 views

Is the PHP BB code extension safe against XSS?

Bad home brew implementations of BB code (especially in PHP) are a common source of XSS vulnerabilities. Usually they rely on a bunch of regexes, a tool that is not fit for the job. But lo and ...
1
vote
1answer
50 views

Can XSS mitigate all anti-CSRF protections?

Say a website has the following form on their sign-up page: <form method="POST" action="https://example.com/login/"> <input type="hidden" name="x-csrf-token" value="[token]"/> <input ...
2
votes
1answer
74 views

Can the Internet Achive capture anything malicious?

I have been using the site Internet Achive when I was researching a domain name and found an older version of the domain I was investigating turned out to be a NSFW web site it seemed like it was ...
0
votes
0answers
35 views

Is this code vulnerable to DOM based XSS? jquery wrap()

Data is read from window.location and passed to the wrap() function of function of jQuery via the following statement: t.Location.wrap(window.location) The version of jQuery in use is the 1.12.1 - ...