Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

learn more… | top users | synonyms

0
votes
1answer
21 views

How and why does case insensitive XSS work, given that javascript is case sensitive

I found out a lot of instances where XSS scripts like the following work. <iMg SrC=x OnErRoR=window.location=123> My question is: Given that javascript is a case sensitive language, how is ...
1
vote
1answer
15 views

Will same-site cookies be sufficent protection against CSRF and XSS?

I must say, that I like this idea and it seems that it will bring a new form of protection against CSRF and XSS or at least it will reduce those attacks. So, how effective will this protection be? ...
0
votes
0answers
14 views

Executing JS script in a tooltip without “<” and “>” characters (XSS) [duplicate]

In the system that I am working on I have a simple form. In the form there is an input called "ID". The contents of the input is than displayed in a tooltip (after clicking the "i" icon) The input ...
0
votes
2answers
71 views

How to detect XSS in GET requests?

How to detect XSS in HTTP/1.1 GET requests? A request can be malicious and I want to know how to detect if the GET request to a server is trying to XSS my website?
4
votes
4answers
274 views

Is it safe to redirect to URL parameter without filtering?

A webpage redirects to an URL given in parameter redirect without filtering it, like this: $newURL=$_GET["redirect"]; header('Location: '.$newURL); login.php?redirect=home.php If it echoes the ...
-1
votes
0answers
21 views

More on Caja: In order to escape the sandbox [closed]

Recently I found an XSS on Google and I reported it, but that happened to be Google Caja sandbox, so the code is executed in the javascript sandbox. I'm very curious if there's a way to bypass that ...
1
vote
2answers
57 views

XSS on a single page web application

I'm practicing stored XSS attacks on my vulnerable single page web application. I want to achieve some kind of DoS attack, where the page keeps reloading from the server. I can easily inject ...
0
votes
1answer
35 views

XSS between tags when only < and > are encoded? [duplicate]

Let's say we have <span></span>. Our website takes the value of a query parameter and adds it between the tags so we have <span>Hello!</span>. If we sanitize the parameter by ...
2
votes
1answer
42 views

Bypass char filtering - security shephard

I'm stuck in the XSS part of the security shephard OWASP app. I am not looking for someone to tell me the solution, I just need to learn how to find it myself, I'm a bit rusty on XSS. So what I know ...
1
vote
1answer
89 views

exploiting XSS in jQuery selector

My static code analyser flags this piece of Javascript on my client's web site as a potential DOM based XSS: var x = $('#' + window.location.hash.substr(1)) ...
8
votes
3answers
957 views

Is a HTML form tag more exploitable than a HTML link in user submitted content?

I have a content editor in a web application which allows administrators to add and edit content in certain areas of the application. The editor component I have used automatically removes any script ...
3
votes
1answer
88 views

Is it possible for XSS to occur in src attribute?

I'm working on XSS vulnerability and understanding it. I know in following cases cross site script injection happen in Javascript context Inside <script> tag. Inside html tag in event handler ...
4
votes
2answers
79 views

Why would a modern browser allow internal resources to be loaded from an external page

Recently someone announced that several Arris surfboard models lacked any form of authentication to perform functions such as reboot and factory reset a modem with a single http call. Read more on ...
3
votes
1answer
33 views

Exploiting an XSS vulnerability

This question is related to a class project involving a team of 2 students against another team of two students. We both have servers with a default plugin that we have a week to patch vulnerabilities ...
-2
votes
1answer
76 views

Clicking a lot of website links in Google Maps, then sent through multiple URL redirects, and lastly to a page that made my laptop start beeping?

I was in Google maps clicking on all the website links listed in the side panel, looking at every website really fast. Note, they were all tattoo parlors. One of the links I clicked bounced me through ...
3
votes
2answers
101 views

Can CSRF protection work even if an XSS vulnerability exists?

Need for CSRF protection that withstands an XSS attack One of the big dangers of XSS is that it can often bypass CSRF protection and thus perform any action the victim can perform. If it would be ...
0
votes
1answer
59 views

Is JWT in cookies with any CSRF solution just as vulnerable to XSS as JWT in localStorage?

I've read that JWT tokens shouldn't be stored in localStroage because XSS attacks can read them. The proposed solution is to store JWT tokens in HTTPOnly cookies and use anti-CSRF w/ double-submit ...
0
votes
0answers
42 views

Using phpinfo() to get httponly cookies?

phpinfo() shows all cookies, even the httponly. So the question is - how can I receive users cookis on target website through xss with phpinfo? The xss will contain code that will open phpinfo page in ...
0
votes
3answers
51 views

Typical 'search box' XSS attack

When I develop a site, I'm always conscious of security flaws, but I'm struggling to see how a search box could ever be used to inject script that could be ran on a page of mine. So I understand ...
-1
votes
1answer
29 views

Is this XSS filter safe or not?

I have a classified site, I was wondering if this is secure enough or not, between I got this filter from a friend of mine. var a = window.location.hash.replace(/[^\w\-#]/g, "_"); a = a + ...
1
vote
0answers
93 views

Can an attacker bypass this DOM XSS filter? [closed]

I'm not asking to break someone's security, but can an attacker bypass this filter? What should I add to secure it more or it is enough? var target = window.location.hash.replace(/[^\w-_]/g, ''); ...
1
vote
1answer
40 views

Is this a secure method for dynamically setting X-Frame-Options? (multiple domains)

X-Frame-Options header will prevent your site from being iFramed by other domains. On browsers that accept the ALLOW-FROM directive you are limited to specifying only a single origin. You could use a ...
1
vote
2answers
47 views

XSS in GET request not decoded on backend

So I am pretty sure I know the answer to this question but I want to be 100% sure so I am looking for some input here. A vulnerability was reported to a site of mine that looks something like this: ...
0
votes
3answers
68 views

Safely downloading user submitted content

TL;DR We save the request payload and Content-Type header in a database. It should be JSON or CSV but may be malformed. Support users download the request payload as a file in their browsers using ...
1
vote
1answer
40 views

Stealing user cookies with flash/actionscript

I know I am asking a dumb question here, but pardon me, I am learning. I found two questions viz, How do I access cookies within Flash? and How to Make a button send an email using AS3 ...
4
votes
1answer
91 views

Is this sanitization method secure?

I implemented this sanitization fix: function san($str, $type="full") { switch ($type) { case "full": $str = preg_replace("/[^a-zA-Z0-9_\-]/i", "", $str); break; ...
2
votes
3answers
55 views

Unable to upload a file on xss vulnerable page

I was wondering, if I have a php script, which could upload a file, What if I inject it in a page which is vulnerable to Xss. So, I created one and Here is the code of index.php <html> ...
3
votes
2answers
137 views

How can I execute a XSS when a web application transforms a data from lowercase to uppercase?

I'm testing a web application, when I send an input data to web application, this places the data in an onlcick function, something like this: <a href="#" onclick="someFunction('dataFromServer', ...
3
votes
2answers
79 views

Does DOM XSS work on pages that don't use js?

Can an XSS attack be done on a static page that doesn't use any JavaScript?
3
votes
1answer
49 views

How to prevent data from Interception?

I am a web developer. A few days ago, I used Burp, to intercept facebook's official App over network, by setting up proxy. I noticed that the data was encrypted. While I have been using Json to ...
1
vote
1answer
62 views

Setting the HTTP header X-Frame-Options DENY for static assets

I am checking the security of my Django application through a security scanner and I wonder if it useful to set the X-Frame-Options DENY header on static assets like CSS, images or JS files? I guess ...
4
votes
2answers
103 views

Why are cookies considered more secure against XSS?

This article discusses storing session tokens in a cookie vs in localStorage: https://stormpath.com/blog/where-to-store-your-jwts-cookies-vs-html5-web-storage/ The article states: Cookies, when ...
0
votes
1answer
63 views

XSS from image upload - does cropping solve most issues?

I am testing an image uploader but I'm a mere developer. Here are the main points to consider: There are no extension checks. The image is uploaded to memory. It is modified to be a certain size ...
3
votes
1answer
62 views

PHP - Is it safe to file_put_content raw HTML?

I'm planning to create a website to let people edit/customize their stories. Let's say the stories will store a lot of html tags ( paragraph, images & video ) I'm thinking using some javascript ...
-1
votes
1answer
106 views

XSS in hidden inputs [closed]

I have some cases of XSS in input fields when the type is set to (hidden) . There are some good injections that can use the access key but it will take high user interaction. Is there a way to inject ...
1
vote
0answers
57 views

Force Browser to not URL encode specific chars [duplicate]

I try to get a XSS to work but the problem is, that the XSS is only working within BURP because there I can send for example '>' as an not URL encoded String. As soon as I try it in the browser, it is ...
0
votes
2answers
144 views

Why can't I test XSS Vulnerability?

I am using DVWA and having trouble executing a simple, reflected XSS vulnerability. Entering the suggested text does not produce a popup in either Firefox or Chrome. Are there any settings that I need ...
4
votes
4answers
73 views

Would an official <disablescripts> HTML (6?) element/wrapper combat XSS effectively?

Would it not be possible to use such a method to wrap areas where user input/output is expected (eg. comment boxes), so that even if a script is successfully injected through regex evasion, the script ...
1
vote
0answers
44 views

Open source tool to test a WAF against OWASP Top 10? [closed]

Are there any open source tools to test a WAF against OWASP Top 10? Especially I am looking for a tool that tests a WAF against different types of attacks & reports test results.
1
vote
2answers
48 views

Started seeing jQuery function calls in URL requests, what is this?

I administer an E-commerce site, and recently I have been seeing odd URL requests containing jQuery function calls. Here are some examples of the requested URLs that are being logged as 302 permanent ...
1
vote
2answers
81 views

How to prevent reflected XSS with the Java Struts Framework? [closed]

I have an application that executes under Jboss server. I have an Apache server in front. My application contains a security vulnerability (XSS Cross-site scripting). I wanted to know that I had to ...
2
votes
1answer
51 views

Differences between Burp request and Browser - Has different responses

So I was put on an engagement over the last week and I found a potential XSS when using Burp's intruder/repeater. However, the strange thing that I noticed was that the response in Burp is different ...
0
votes
1answer
36 views

Is it possible to use CSP for a Javascript-based video player?

Some of my workmates are developing a video player using Javascript. AFAIK, we are not going to have any website. The clients will connect to the server, download the javascript code and then render ...
0
votes
1answer
15 views

Disabling post-pageload http requests to account for XSS

I have a website where JavaScript is used to process sensitive data (chat messages) on the client side. No communication is done with the server or any other service after the initial page load. It's ...
3
votes
1answer
103 views

JS snippets on my live project do not appear in my code residing on my production server

I have a Django website project that is live (let's call it example.com). It's a forum where users can submit comments and reply to them. It has a Postgresql database, and gunicorn + nginx reverse ...
0
votes
1answer
77 views

xss bypass for javascript elements filtered as [removed]

If we write test ">script>alert(1)/script>, application is filtering the JavaScript with test">[removed]alert(1)[removed]. And payloads like onmouseover,onmouseout are skipping. In this ...
4
votes
3answers
560 views

XSS - How serious can it be? [duplicate]

I am just wondering about XSS attacks. Lets say I have a normal website, but it displays a few things based on $_GET variables. The website has no login system, all users can do is browse different ...
0
votes
3answers
121 views

XSS - Can we steal cookies from another website on another tab?

Suppose I found a XSS bug in a eCommerce website. Can we steal the victim's cookies from their bank website (if that is opened in another tab)?
4
votes
2answers
109 views

Should I worry about NoScripts anti-XSS warning when making a 3DSecure payment?

When I make an online payment using 3DSecure (Verified by Visa or Mastercard Securecode), NoScript informs me that it has stopped a potentially insecure script where site A (the bank or the credit ...
-1
votes
1answer
60 views

XSS Vector without < or > symbols or equal sign?

Just wondering if anyone could help me out with some XSS Vectors that work without having the < or > symbols. Basically the the input is stripped from < and > symbols and any equal signs such ...