Questions tagged [xss]

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

Filter by
Sorted by
Tagged with
1
vote
0answers
18 views

Is it better to disable X-XSS-Protection header or set the header as X-XSS-Protection: 0?

Because X-XSS-Protection header is now not supported by major browsers I wonder what option is better, to delete this header or to set the header as X-XSS-Protection: 0? Because browsers do not ...
0
votes
0answers
45 views

How to reliably detect Browser Exploitation Attacks with BeEF and other JavaScript hooking packages?

"Unlike other security frameworks, BeEF looks past the hardened network perimeter and client system, and examines exploitability within the context of the one open door: the web browser. BeEF ...
0
votes
2answers
101 views

read etc/passwd using XSS

by trying the XSS room on THM, I try was trying to read the /etc/passwd using the following cmd: <iframe src="/etc/passwd"></iframe> However what I got is an error code as shown ...
1
vote
0answers
32 views

Does this qualify as Filename Upload DOM-XSS?

An application has the following javascript code which is triggered whenever an user tries to upload a file. a.html(fileName) then if the user uploads a file named <img src=x onerror=alert()> ...
1
vote
0answers
74 views

NodeJS, unrestricted file upload, RCE [closed]

I'm testing on application which runs on NodeJS, and discovered unrestriced file upload vulnerability, path traversal is not possible. Uploaded file is visitable, I can upload .html to perform XSS ...
0
votes
2answers
91 views

Prevent URL encoding on form submit

During an engagement, I found a potential XSS vulnerability on a page. There is an HTML form that is submitted to this page (POST method) and sent parameters are reflected (without encoding) in the ...
0
votes
1answer
35 views

is XSS in Content-Disposition possible?

There is a web application that can upload HTML files and also download the uploaded file. When I upload an HTML file containing the script tag and download it, the response is as follows. HTTP/1.1 ...
-1
votes
1answer
43 views

XSS Inside the text part of an <a> tag [closed]

How do I xss inside <a href="https://gooogle.com">here</a> ? I have tried normally using alert() but it didn't work
0
votes
0answers
44 views

Security issues in xhr DOM update

I'm writing a javascript code that update DOM with html/javascript from XMLlHttpRequest response (A sort of JQuery's $.load() function), depending on some client side condition (e.g. which browser ...
0
votes
0answers
30 views

DOM-based XSS example doesn't work

Google have written up a great explanation of XSS attacks with 3 interactive demos: https://www.google.co.uk/about/appsecurity/learning/xss/ If I follow the instructions, I can see a JavaScript alert ...
0
votes
1answer
54 views

DOM-based XSS - via URL

I have a website that I am testing but I am pretty new to all of this security stuff and would appreciate some help!. I have a url similar to the following: http://testurl?nexturl=whatever The ...
0
votes
1answer
107 views

Is it possible to bypass this csp?

Today I created a web application. I'm using this csp to avoid xss attacks. CSP: Content-Security-Policy", `child-src 'none'; connect-src 'none'; default-src 'none'; font-src 'none'; frame-src '...
0
votes
1answer
109 views

How do I bypass a regex filter that filters all html to avoid xss?

How do I bypass a regex filter that filters all html to avoid xss? I've tried using things like &lt;img src="aa" onerror="alert(1)"&gt; but still no luck. This is for a CTF ...
0
votes
1answer
75 views

srcdoc attribute of iframes as a source of XSS attacks

I am trying to implement a case where a user provides us some html code which is then stored in our database. We then retrieve the HTML from our database as a string. (We have no control over the user ...
0
votes
2answers
97 views

Is this potential XSS exploitable?

I am pentesting a website and I found that I can inject code at value="" <input type="text" id="search_1" name="keyword" placeholder="Search by keyword&...
0
votes
0answers
39 views

Injection inside double quoted section of script element

For a test to find vulnerabilities I found the following code in a page and I am looking for ways to manipulate it: <script> func({ "key1": "value", "...
1
vote
0answers
75 views

Attack on a string created by a developer

Go and Java have "compile time constants", and JavaScript will soon get a feature that allows "Distinguishing strings from a trusted developer from strings that may be attacker ...
0
votes
0answers
41 views

Is it a good and safe to recommend programmers that APIs always encode '<' in JSON payloads to '\u003c' to prevent XSS?

I know that there are other recommendations like correctly encoding the JSON payload and using the correct content-type, however, my colleagues insist in that this is an additional good recommendation....
6
votes
2answers
750 views

Content Security Policy https: and data: meaning

I am having trouble finding information on the implications of using https: and data: as a source for the directives in a CSP. Example: img-src 'self' https: data:; Could someone some context around ...
1
vote
1answer
92 views

Found XSS in chat form in bug bounty but they say it's only self XSS. How to leverage it? [closed]

I have found an XSS bug in a chat form on a bug bounty target. When I enter in the chat form input <button onclick="alert(1)">click</button> and after that I click the button a ...
0
votes
0answers
34 views

Storing an OAuth 2.0 access token

I'm in a debate of where to securely store an OAuth 2.0 access token. There are two opinions: On the browser (inside of a HttpOnly cookie) On the server/inside the a database The argument against ...
1
vote
1answer
76 views

Bypass input validation

I'm trying to create a vulnerable sandbox environment for pentesting challenges. As part of the challenge, I want to include some elements of XSS or SQLi if possible. However, I do not wish to make ...
0
votes
0answers
55 views

Progressive web app, Access token storage

I'm currently working on an existing PWA (Progressive web app) build in VUEJS. Currently i'm using Auth0 for user authentication and it works fine. But it seems a bit overkill and client finds it very ...
0
votes
1answer
71 views

XSS Payloads: <script> vs javascript:

Hello I was experimenting with XSS payloads and couldn't help wonder the syntax for javascript:alert(0) The most basic payload for XSS makes sense, since the tag is used for JavaScript in HTML. <...
2
votes
0answers
150 views

Implementing Checkmarx suggested clickjacking fix introduces high severity Client DOM XSS vulnerability

My organization has scanned our code using Checkmarx and the low severity issue Potential Clickjacking on Legacy Browsers was detected due to a JavaScript function firing on an HTML image click event. ...
0
votes
1answer
76 views

Is every plain flow into a dangerous sink exploitable?

Given a flow of information (for example from the URL) into a sink on a certain site, and given that this information is plain, i.e. is not sanitized, does this mean that if an attacker could control ...
1
vote
1answer
214 views

Can an Intrusion Prevention System (e.g. Snort) prevent CSRF and XSS attacks?

I am currently learning about IPS and was wondering about a query that applies to how IPS works. I have knowledge of CSRF and XSS attacks, however I am unsure if Intrusion Prevention Systems can ...
1
vote
1answer
64 views

Which cookies can xss have access to

I clicked on a link in my android phone and I don’t know if it was an xss or not. I want to know that in the case of an xss attack, can the hacker access my whole cookies or just the cookies that ...
1
vote
1answer
89 views

How to confirm if it's a case of XSS

On a training website where instructors can create Q&A exams for their students, an instructor put a question about XSS. Part of the question was http://abcd.com/options#<img src=1 onerror=...
0
votes
0answers
51 views

XSS with Java to get User Cookies

I am practicing some XSS on a vulnerable apache2 web application and having some issues getting the user's cookie information. I am following the instructions in this Lab for the XSS Attack. We are ...
0
votes
0answers
34 views

Vulnerability detection tool that scans for dynamic script tag appending to DOM

I understand that dynamically appending a script tag to DOM could lead to XSS attacks if script's URL isn't properly secured and my.remote.domain.com isn't whitelisted as an allowed domain to load and ...
0
votes
2answers
57 views

Safely creating script tag and attaching to DOM

I have a need to to create and attach a script tag to DOM at runtime. The script is a remote webpack bundle (via a Module Federation plugin). I would like to be able to change the URL to that hosted ...
0
votes
0answers
31 views

What you can do with XSS attacks [duplicate]

I am practicing in a website which is vulnerable to XSS so as to learn better this kind of attacks. I have managed to inject somewhere the usual <script>alert('XSS')</script> and it seems ...
0
votes
0answers
76 views

Intercept postMessage token through an XSS

I have found an XSS vulnerability which is triggered on a backend admin system from an output sent from a regular user. So this XSS is triggered in an iframe belonging to viewer.exemple.com but loaded ...
0
votes
0answers
81 views

XSS attack being blocked by the browser

I'm trying to validate / test and XSS attack; however when I navigate to the page, the browser (tried on Chrome and Edge) tells me: A parser-blocking, cross site (i.e. different eTLD+1) script, is ...
2
votes
1answer
94 views

Is an XSS attack possible under these constraints?

The output is: <img src="http://example.com/[input]" oncontextmenu="openUrl('http://example.com/[input]')"> Where [input] is the user input, which is sanitised through this ...
2
votes
2answers
209 views

Does escaping quotes in a HTML attribute context prevent XSS?

I'm learning about XSS and I found I can inject code in this tag a few days ago. Tag: <div id="pagenotfound" title='Cannot find /it/search/testtesttesttetst\'onload=alert(1)'> My ...
9
votes
5answers
4k views

How to protect a <input type='password'/> from XSS?

Most sites having a sign in form have the following html element: <input type="password" /> If I press F12 to open the debugger on chrome and type: document.getElementByName("...
0
votes
1answer
64 views

Validity of a WAF as a Compensating/Alternative Control for CSP, X-XSS-Protection, etc [closed]

I would like to know peoples' thoughts as to whether a WAF is a perfectly acceptable compensating/alternative control to things like CSP, X-XSS-Protection, etc. I know WAF is suppose to protect ...
1
vote
1answer
72 views

Blocking reflected XSS on common web servers

How is it possible to block reflected XSS on common web servers, such as IIS, Apache HTTP Server and Nginx? The Content-Security-Policy: reflected-xss filter doesn't work on latest Chrome and X-XSS-...
2
votes
1answer
543 views

Stored XSS Cookie Stealing - shortest payload

I'm testing a web app (for which I have permissions) and I found a stored XSS vulnerability. It is a little bit tricky to exploit because the input: is being capitalized it has a length constraint of ...
0
votes
1answer
50 views

Can this Javascript redirect be exploited in some way?

Since I can modify pathname, search and hash value could I leverages this in some way? var URL = window.location.hostname+window.location.pathname + window.location.search + window.location.hash; ...
1
vote
0answers
69 views

XSS strip tag bypass [closed]

I'm studying and I really need some help, I've this code: $param1 = strip_tags($_GET['var2'], '<>'); I'm trying all kinds of things, like: $_GET['var2'] = "Hello <img src=x onerror=...
14
votes
2answers
3k views

SQL injection inside XSS

Is it possible to perform an SQL injection inside an XSS attack? And if so, where can I find information on this or some examples?
1
vote
1answer
77 views

Is possible ot create XSS with theses chars?

As part of bug bounty, I have a PATCH request to the API to change my name. I can post theses chars: : ; ' * ` = # / [ ] ( ) This is the HTML result : data-cy="label-input__input" value=&...
1
vote
2answers
289 views

Is it possible to read and extract HTTP request headers via JavaScript while performing XSS & CSRF? If so, how?

Is it possible to read and extract HTTP request headers via JavaScript? i.e. something like; var req = new XMLHttpRequest(); req.open(‘GET’, document.location, false); req.send(null); var headers = ...
2
votes
1answer
49 views

web app 3rd party JS dependency vulnerability management

As a security engineer, I wonder about the common approach for web app 3rd party JS dependency vulnerability management. We have a lot of apps depend on Jquery etc. In a regular vulnerability scan, ...
2
votes
0answers
51 views

Will javascript execute which is in an HREF?

I have located an issue where the user can provide an HTML that will be rendered on a page. Unfortunately, the HTML is rendered inside an href attribute using "(quotes), making it impossible to ...
1
vote
0answers
73 views

Prevent XSS in 3rd party (self hosted) application

We have an application which have purchased from a 3rd party and host in our own environment. The application consists of its own UI and back-end, and is included in our own application through an ...
1
vote
1answer
69 views

XSS on infinite-scrolling pages

Say I make a social-media website and forget to include the htmlspecialchars() function. If the website uses infinite scrolling (that will eventually show every post on the website if you scroll down ...

1
2 3 4 5
28