Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [xss]

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

Filter by
Sorted by
Tagged with
0 votes
0 answers
50 views

Is it a good idea to implement an XSS blocking middleware like cloudflare? [closed]

I noticed that whenever someone tries to send XSS data, Cloudflare blocks it. So I tested it and concluded the pattern. I want to implement a Regex that detects any XSS pattern and block it. Note: I ...
a_duck's user avatar
  • 1
0 votes
1 answer
42 views

Running blog under /blog, security considerations

I'd like to set up a self-hosted Ghost.org blog for a SaaS. I have two options: example.com/blog blog.example.com Everywhere I read they recommend the /blog for SEO. However, I'm concerned about the ...
hyperknot's user avatar
  • 101
0 votes
0 answers
51 views

Overcoming Middleware: Exploiting XSS to Retrieve Data

I am attempting to perform an XSS attack on my server and have successfully bypassed the CSP. In my server code, I store all users in the following manner: .get("/users", adminReq, (req, ...
EPiez's user avatar
  • 13
1 vote
0 answers
49 views

Overcoming Cookie Theft Barrier in XSS Attack despite CSP Implementation

I have a website that includes CSP rules: .use( helmet.contentSecurityPolicy({ directives: { defaultSrc: ["'self'"], scriptSrc: [ "'self'", "cdnjs....
EPiez's user avatar
  • 13
0 votes
1 answer
79 views

Bypassing CSP and implementing XSS attack

I am using Content Security Policy (CSP) rules in my code to defend against XSS attacks. Here are the CSP rules I have implemented using Helmet: .use( helmet.contentSecurityPolicy({ directives: { ...
EPiez's user avatar
  • 13
0 votes
1 answer
118 views

Is it possible to trick a user into logging in to a site, then stealing a non HttpOnly cookie that will be set after they log in?

If a user has already logged in, and then the site sets a non HttpOnly cookie, then it seems possible to trick the user into doing something that would lead to the cookie being stolen. If the cookie ...
ETLJ's user avatar
  • 11
0 votes
0 answers
55 views

Cross Site Scripting with URL protocol schema javascript

I'm testing a web application and I found a XSS vulnerability. I can inject schemas like data:// or tel:// but they have blocked the javascript:// schema. On current browsers the origin is null if I ...
jack's user avatar
  • 1
-1 votes
1 answer
122 views

How to sanitize $_SERVER url variables?

An attacker used the HTTP_REFERER variable to inject Javascript by sending the following in the Header: Referer: javascri&#...
rami300's user avatar
  • 160
0 votes
2 answers
56 views

Is There a way to exploiting / Make exploit scenario for Header based reflected XSS?

I've found a reflected XSS, but the problem is that the attack vector is the header (any header). Is there a way to develop an exploit scenario based on this?
0xdead 4f's user avatar
2 votes
1 answer
145 views

Secure way to output encoding HTML for insert raw html via javascript

I want to be 100% secure, I create raw html this way: const template = document.createElement('template') template.innerHTML = html_raw const cloned = template.content.cloneNode(true) document....
The nothing's user avatar
0 votes
2 answers
123 views

Does CSP protect against XSS in url?

If I have a web app that is vulnerable to XSS in the url (reflected XSS), does CSP protect against this type of XSS? Ex: when I run www.example.com/<script>alert(1);</script> in the ...
anonymous's user avatar
0 votes
1 answer
87 views

Preventing HTTP requests containing XSS in nodeJS

I want my expresJS server to detect and stop any request containing XSS input before it gets saved in the database, as my website does not utilize any html input, and it does not need to. What is the ...
a_duck's user avatar
  • 1
1 vote
0 answers
156 views

Vue HTML escape

I have done a code scan and fail to understand whether there is a real problem. For both cases I get "Vue HTML escaping is disabled.". Case 1: <a :href="return.url"> doesn't ...
snakx123's user avatar
1 vote
0 answers
162 views

When we url encode (") will become (%22), is there any way we can decode (")?

While studying the XSS vulnerability, I encountered a significant doubt. I noticed that when we include " in a URL, it gets encoded as %22. Therefore, I believe we can utilize the decoded version ...
suwarnarajtest testaccount's user avatar
0 votes
1 answer
151 views

is <script>javascript:alert(document.domain); a valid script for xss?

I have submit the following text <script>javascript:alert(document.domain); in a feedback of a restaurant listed on a website and feedback is sent to website not restaurant. I want to verify but ...
Jaikaran saini's user avatar
0 votes
0 answers
97 views

XSS Bypass Whitelist

I found a HTML injection on a markdown although it seems odd as the user already can use html in the box So I tried to turn it to XSS but after a day with trial and error I concluded that the website ...
ELMO's user avatar
  • 111
4 votes
2 answers
1k views

HTTPonly token without CSRF is safe?

How can a hacker steal my session where my form does not have CSRF tokens but my session cookies are HTTPonly? how would he get my session cookie in this case? is this possible? for example, to be ...
H01F's user avatar
  • 43
7 votes
3 answers
2k views

Is storing authentication tokens in local storage with a strong CSP safe?

Whenever the topic comes up, almost every source recommends to never store authentication tokens in a place where they can be accessed by client-side Javascript. The recommendation is almost always to ...
Mad Scientist's user avatar
0 votes
1 answer
114 views

React chars to HTML encode?

I've observed that React can HTML encode specific characters to prevent XSS vulnerabilities in certain contexts. For instance, consider the following code in App.jsx: function App() { const ...
BooRuleDie's user avatar
2 votes
0 answers
169 views

CSP: Allow inline scripts while blocking javascript: in iframe src

We wan't to prevent attacks comming in from src attribute "javascript:" but still allow lnline script tags. Currently the only option is to add sha-hash's but there are too many inline ...
Chris Gunawardena's user avatar
1 vote
0 answers
82 views

How to use html encoded characters to perform XSS?

I am trying to perform XSS but to get out of the context and write the payload I need to use Angle brackets and the angle brackets are html encoded. I tried double encoding technique with url encoding+...
Riaz Rabia's user avatar
1 vote
1 answer
164 views

SOP (Same Origin Policy) and CDN SVG XSS

If an SVG file with an XSS payload is hosted on say cdn.example.com and is loaded as a display picture on say mainprod.com, can the XSS payload within the SVG file access and steal cookies from ...
anonmer's user avatar
  • 13
1 vote
1 answer
403 views

Is it secure to use session ID as authentication token received from an HTTP header?

I am writing a mobile application for an already existing web app. In the backend, I implemented the usual cookie-based session ID authentication. with a CSRF token generated on login and sent with ...
TommyGun's user avatar
0 votes
0 answers
96 views

Potential XSS bug in email form?

I have a invite users via email form on my website and I was wondering if this could be a potential XSS flaw? I captured the request via Burp, and this is how it looks: Input: { "toEnvWithEmail&...
Sarthak Goyal's user avatar
1 vote
0 answers
113 views

Is the ability to inject arbitrary CSS styles in an img tag a security vulnerability?

I've discovered a behavior in a popular service's markdown parser that allows the 'style' attribute to be used within 'img' tags through some crafted markdown code. This allows for the application of ...
LunaXenon's user avatar
0 votes
0 answers
78 views

Does other frontend framework have similar issue like AngularJS?

I'm reading an article that talks about XSS exploitation on AngularJS, AngularJS will render the template in ng-html, and it bypasses sanitize-html. My questions, I'm wondering if other frameworks ...
daisy's user avatar
  • 2,077
1 vote
1 answer
99 views

Is it safe to store the OIDC token in a private field of a javascript object?

I would like to initialise a React application with an OIDC token. This token will be stored in a private field of the "api client" object. This object will be used to execute API calls and ...
Marco Altieri's user avatar
1 vote
1 answer
161 views

Is this a type of XSS attack?

I have been exploring customer support in a website as part of bug bounty program. I then started a chat with their customer support and pasted the following in the box: <!--<img src="-->...
Testing Graphics's user avatar
0 votes
0 answers
89 views

Security frontend side

Hi i´m a frontend developer and next week we will have a security audit i need to be sure that frontend side is secure and dont have vulnerabilities, so my question is, ¿What would you recommend or ...
David Medina's user avatar
0 votes
1 answer
848 views

Why can't we close some tags for cross site scripting purposes?

There's a webstore that i am trying to find a XSS vulnerability for BUG BOUNTY. On that store is a search bar that i can send anything https://www.examplestore.com/blog/?s=</title><script>...
Victor Lucas Mazzotti's user avatar
0 votes
3 answers
177 views

is a stored xss possible if user input is not saved?

I was wondering if a stored cross-site scripting attack is possible if the user input is not saved. If a website is vulnerable to an xss attack, can someone put in a code or something that stores a ...
Trazerman's user avatar
2 votes
0 answers
103 views

Security in Angular: Addressing XSS Concerns with External Libraries and Interpolation

Introduction: We heavily use external libraries, such as DataTables, in combination with interpolation. In Angular, we've identified two primary XSS prevention strategies: Interpolation ({{ }}) ...
VJSpeter's user avatar
0 votes
0 answers
151 views

How to abuse the onerror method to get XSS?

In the book Javascript for hackers, Gareth Heyes overwrites the window.onerror method with eval, used to execute a function. From my understanding, the following snippet run in a browser console ...
Riccardo D's user avatar
0 votes
0 answers
125 views

Safe Sinks js confusion

Have some confusion regarding safe sinks in javascript. The DOMpurify library linked in the OWASP article does not explicitly mention the .files and .valueAsDate of an HTMLInputElement as safe sinks, ...
okzoomer's user avatar
  • 101
1 vote
1 answer
494 views

CSP script-scr blob

What are the risks to allow a "blob:" directive to the script-src CSP? Is it safe? I have a list of allowed domains defined in script-src, but nonetheless I got an error specifying the ...
Giuseppe Canto's user avatar
0 votes
2 answers
159 views

Simple XSS Example Involving AJAX not Firing

In creating a simple demonstration of XSS I'm failing to see the result of the injected code, and I'm wondering what simple thing I've overlooked. This is the code that handles the AJAX request after ...
Stephen's user avatar
  • 175
3 votes
2 answers
907 views

CVSS3 score for XSS leading to account takeover

Let's say there is a XSS vulnerability in a web application. The XSS allows an attacker to hijack the user's session. Within the session, the attacker can view/modify the user's credit card and ...
mateleco's user avatar
  • 110
0 votes
0 answers
297 views

XSS Payload That Can Bypass Special Character Check

I developed the following C# algorithm to prevent XSS attacks: private bool Is_There_XSS_Payload(string arg) { Regex regex = new Regex(@"^[a-zA-Z0-9]+$"); bool result = ...
KosD's user avatar
  • 1
0 votes
0 answers
40 views

XSS: bypassing html entity encoding of <,>,& characters [duplicate]

I am currently testing a webapplication that is sanitizing user input by html entity encoding special characters. E.g. <script>alert(1)</script> becomes &lt;script&gt;alert(1)&...
Pascal3366's user avatar
0 votes
1 answer
1k views

Using window.open('',"_blank") can this be XSS exploited?

If I have javascript that opens a window using the code below, the content is a user supplied variable that is not sanatized. Is there any security risk in this situation. The content will only be ...
Henry's user avatar
  • 113
0 votes
1 answer
205 views

Is <img :src="require`${JSON.parse(string)}`"> in electron vue is safe from XSS?

I am inspecting a client's application written with Vue.js and I found there a following construction. // Somewhere else in the code var data = JSON.parse(jsonString); // In the vue component <...
Max's user avatar
  • 101
1 vote
1 answer
981 views

XSS in document.write(location.href)

Let's say a website contains the following <script> tag and does not have a CSP blocking any execution here. <script type="text/javascript"> document.write(location.href) </...
J Heschl's user avatar
  • 123
1 vote
0 answers
245 views

Reflected XSS but no Content-Type is specified

I have found parameter that simply reflects into response body, but no Content-Type is specified by server. It doesn't use any XSS-protection mechanisms like CSP or X-XSS-Protection. However, I was ...
ksenia pi's user avatar
2 votes
1 answer
726 views

Why don't Internet browsers allow me to fetch a JSON file from raw.githubusercontent.com, but they allow me to fetch .psm files from there?

When I was making my PicoBlaze Simulator in JavaScript, I added 6 examples of how to use it. Those examples are on my GitHub profile, they are the .psm (PicoBlaze Assembly) files. I decided not to ...
FlatAssembler's user avatar
0 votes
0 answers
97 views

Are there any html Sanitizer() API configs that allow javascript execution?

I'm talking specifically about the HTML Sanitizer API: https://developer.mozilla.org/en-US/docs/Web/API/HTML_Sanitizer_API The API allows you to configure the sanitizer with a list of allowed elements ...
user1131308's user avatar
0 votes
1 answer
301 views

With Response header having content-type: application/json, is it still possible to trigger XSS?

The application is responding using the user supplied request but the content type is set as application/json. Is it possible to trigger still XSS? This is a language neutral question, it can be Java,...
warrior-oo7's user avatar
0 votes
2 answers
115 views

What defines an XSS vulnerability? (my case) [closed]

I was in a bug bounty. I can't be sure of this problem because it's all over the website. Will this be harmful for the organization? When I exit the angular brackets and paste the payload, it pops up ...
Wade Thrillson's user avatar
1 vote
1 answer
147 views

Is this code vulnerable to DOM XSS?

const scriptElement = document.createElement('script'); // Set the source (src) attribute scriptElement.src = '/evil.js?'+decodeURI(urlParams['sync']); // Append the script element to the HTML ...
Spiderman Khalifa's user avatar
0 votes
1 answer
129 views

XSS not executing properly

Instead of receiving Alert(XSS) I get [object Object] The application is expecting a .csv file and the name of the file is being reflected. I put the original .csv file and then I remove it in order ...
ilich262's user avatar
4 votes
1 answer
5k views

Is it safe to use font-src with data: in a Content Security Policy?

I'm currently experiencing an issue where base64 encoded fonts are being blocked by CSP on my website (note that I replaced the base64 with abcdefg in this example: Refused to load the font 'data:font/...
x3nr0s's user avatar
  • 143

1
2 3 4 5
31