Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [xss]

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

15
votes
3answers
4k views

Does incognito/private browsing prevent XSS attacks?

When starting an incognito/private browsing session, no cookies from other browsing profiles should exist. For example, if I am logged in to a site on my main browsing profile, then start a new ...
0
votes
1answer
89 views

Is XSS exploit always illegal? [closed]

I recently got a great deal of $$ stolen by scammers. I am trying to use XSS exploitation to find his real identity (IMSI, IMEI, External IP, Internal IP, any computer unique ID) Is it legal? I am ...
2
votes
2answers
51 views

What is client side non-DOM XSS?

I've been reading on the new categories of XSS. According to OWASP, they're no longer just reflected, stored and DOM-based XSS, but rather server/client side, and then subdivided into reflected/stored....
-2
votes
0answers
28 views

How can I execute an XSS attack when < and > are encoded? [duplicate]

Say I have a site with a search box/input and I'm injecting my script into there. The less than and greater than signs in the query are then sanitized to &lt and &gt. How can I get around this ...
2
votes
1answer
69 views

Are unescaped backslashes dangerous in terms of XSS?

I thought the \ (backslash) character was a dangerous character that you needed to filter out/properly encode to protect against XSS attacks (OWASP says so, too), and I still do, but why? I found a ...
0
votes
1answer
47 views

How can I execute a XSS on 302 redirect and the body on the page?

Is there a way to execute XSS? on 302 redirect and the body on the page? <HTML><HEAD> <TITLE>302 Moved Temporarily</TITLE> </HEAD> <BODY> The document has moved &...
0
votes
0answers
42 views

Xss experimenting question [on hold]

This is the .html document after submitting this: <form action="/mysite.com" novalidate> E-mail: <input type="email" Id="user_email">"<script>alert(1)</script> <input type="...
1
vote
0answers
51 views

Bypassing double quote in DOM based XSS?

I am trying to generate a POC for DOM XSS exploit. I could inject a code using the following link: <a href="wepage.jsp" target='&quot;><script> alert(document.cookie)</script>&...
0
votes
0answers
42 views

Cookie grabbing failing even though the input is susceptible to reflected XSS?

I tried to grab cookies through "document.cookie" JavaScript and the XSS reflected cookies on the host site. But whenever I tried to capture cookies and redirect it to my local server through a PHP ...
-1
votes
0answers
29 views

What's This xsser Error Message? [closed]

I am trying to run a (quick) check against a site of mine, and grabbed a Docker-ized version of xsser here. I'm trying variations of the command below to get it running, but all I can get is an error ...
0
votes
1answer
25 views

DOMXSS - Is Input Field Content an Attack Vector?

A typical example for DOMXSS is that vulnerable code carelessly processes the part after the hash mark as in https://www.example.org/path/param1=val1&...#PAYLOAD_HERE without validation. For ...
1
vote
1answer
113 views

MageCart attack on Newegg

I am reading about an attack that occurred during August of this year conducted by the group MageCart through the use of "card skimming" to steal credit card info from Newegg users. While reading ...
1
vote
2answers
98 views

Can a site vulnerable to XSS be used to attack a site with a CSRF vulnerability?

I heard of the attacks Cross Site Scripting (XSS: An attack where an attacker injects malious client side code (For example: JavaScript) into a web application.) and Cross Site Request Forgery (CSRF: ...
1
vote
1answer
50 views

Is XSS via MIME sniffing a Stored or Reflected XSS?

The title says it all. I understand how to exploit XSS via MIME sniffing, but the question is, do you call this type of XSS stored or reflected? OWASP says Stored attacks are those where the ...
1
vote
0answers
91 views

How can I steal all cookies from reflected XSS?

I just found a website with a XSS vulnerability. When I visit the following URL, a pop up occurs: https://example.com/article/HALLOWEEN"><script>alert(1);</script> I have a ...
1
vote
0answers
118 views

How did the recent British Airways hack go down?

How did the Magecart group manage to inject their malicious code into the source code of the BA ticketing site? I have read two articles, one of which said, it could be because BA was not checking ...
0
votes
0answers
33 views

Checkmarx tool indicates DOM Client XSS “High” Vulnerability for MicrosoftAjax.js

We are using the Checkmarx security tool to check our code against security vulnerabilities. I am running into this "High" vulnerability for JavaScript DOM Client XSS in the MicrosoftAjax.js file. ...
31
votes
7answers
6k views

How do hackers make the victim access an XSS attack URL?

As I understand it, the basic idea of XSS is to let the user's browser execute some malicious code created by the hackers. Say, if a page has a vulnerability of loading arbitrary script when user ...
4
votes
3answers
985 views

Is this code vulnerable to Reflected XSS?

I'm doing a pentest and came by this code: (function() { var subdomain = (function() { var query = /[?&]css=([^&#]*)/i.exec(window.location.search); if(...
-1
votes
1answer
115 views

Is it dangerous to use javascript:window.open in href tags?

I have a website and would like to create a link to share information on a third-party site. Is it safe to use the javascript:window.open() function to do this? If unsafe, are there any ways this ...
1
vote
1answer
67 views

Does escaping/cutting of <> prevents you from XSS [duplicate]

I have an input, which displays a value (Firstname) in a box on the page. On the server side, the input is escaped by following rule (vb.net): Public Function UnescapeString(strValue As String) As ...
3
votes
2answers
216 views

Why does “<!--<script>” in a JS string cause a broken page/denial of service for that page?

I was under the impression that all I needed to do to make inline JSON safe was to break any closing </script> tags in strings, e.g. escape the / like <\/script>. However I found a weird ...
1
vote
1answer
33 views

How does Software Defined Perimeter (SDP) protect against certains attack that happen in the browser?

I have been doing a bit of research on SDP (Software Defined Perimeter) but it's still a bit unclear to me how it protects against certain types of attacks. On Wikipedia it says that it can protect ...
2
votes
1answer
58 views

What stops us from using an <antiscript> tag to stop XSS?

I am aware of various ways to prevent XSS attacks, such as escaping and encoding, which are prone to issues, and using a Content Security Policy which requires extraction of all scripts. However, what ...
0
votes
2answers
67 views

XSS vulnerability through burp suite

I am getting a XSS vulnerability through burp suite but when I inject script manually I don't get the XSS vulnerability. Is this a reportable vulnerability?
0
votes
2answers
85 views

XSS attack vsibible in html but no running

To test XSS for a certain website, username in the account settings to <script type="text/javascript">alert("XSS");</script>. In the html the code it is visible and but it's not running. ...
2
votes
1answer
57 views

Am I safe from XSS in React as long as I don't use dangerouslySetInnerHTML?

Let's say I write a webapp using React only, never touching the DOM directly. I never use dangerouslySetInnerHTML. Do I still have to worry about XSS? Or in other words, are there any other unsafe ...
1
vote
1answer
25 views

Should untrusted strings be sanitized server-side if they're inserted into the document body through document.createTextNode?

Chat webapp. Clients (that is, web browsers) send messages to the server, which the server broadcasts to all connected clients. Client-side code looks like this: let p = document.createElement('p') p....
1
vote
1answer
43 views

What characters need to be escaped or replaced to prevent xss jsonp callback attacks?

I have a service which allows the user to specify a callback function name that wraps the data being returned to support jsonp callbacks. I want to make sure that I am covering all of my bases in ...
1
vote
1answer
147 views

Cross Site Scripting on a Unique Key

Is it possible to perform a cross-site scripting attack by entering my script into a field that is required to match a specific value? I am scanning an application for vulnerabilities, and my ...
0
votes
1answer
82 views

Use of Single/Double quotes for XSS/SQL Injection Context

XSS Prevention: Why it is recommended to use single quotes or double quotes for declaring HTML attribute values instead of unquoted values? It is recommended to prevent XSS. Same goes for SQL ...
1
vote
1answer
64 views

How to detect XSS on HTML tags? [closed]

I am a beginner who is trying to understand XSS. I want to make my own site and am very curious about how to detect if any of the HTML tags are vulnerable to XSS (like if the <src> or <a> ...
0
votes
0answers
38 views

Microservices: JWT and Springboot

I'm developing a backend infrastructure based on microservices. I'm using Springboot framework. Regarding the authentication and authorization phases, I would use Oauth2 + JWT. That's mainly because ...
-1
votes
1answer
81 views

Xss filtering of single quote [closed]

Any hint Here Bypass filtering of single quote http://leettime.net/xsslab1/stage--08.php
1
vote
0answers
34 views

Protect website against attacks with iframe for user generated javascript?

I'm creating a small playground for people to write and test out their JavaScript on my website. I know websites like jsfiddle already exist but it's just for fun and for the sake of trying something ...
0
votes
2answers
407 views

XSS with URL encoding

If a website URL gets encoded then is the website still vulnerable to XSS or no? For example, if I try <script>alert(1)</script> and the site URL encodes my payload to %3Cscript%3Ealert(1)...
1
vote
2answers
139 views

Why is unsanitized output from ajax request bad?

I know what I just described is a reflected XSS vulnerability. What I can't figure out is why it is a vulnerability. Because the way I see it, a user can't be directed to the attacker's content ...
2
votes
0answers
71 views

HTML Form to PDF vulnerabilities

I have a form where the user inputs data. On the back end, I'm taking some of that data and embedding it into a PDF using ActiveReports. I then display it back to the user and save a copy on our ...
0
votes
1answer
91 views

Why this XSS payload doesn't work?

TOday I needed to demo DOM Based XSS, and I came across this page which is made for the same exact purpose. I wonder why <img+src+onerror=alert(1)> works but <script>alert(1)</script>...
1
vote
0answers
128 views

Is allowing blob: in Content-Security-Policy a risk?

Recently, I've set Content-Security-Policy headers for my web application. I've tried to be as strict as possible. What strikes me most is the fact that I had to allow blob: for connect-src and img-...
3
votes
2answers
336 views

Is reflected XSS impossible, when HTML meta-characters, e.g., < and >, are encoded, and the result output in HTML context?

Is reflected XSS impossible, when HTML meta-characters, e.g., < and >, are encoded, and the result output in HTML context? I have a website that displays the URL path directly in HTML context, i.e....
-1
votes
3answers
179 views

XSS in big wiki software

I found an XSS vuln at a big wiki software. Here's the vuln code: <?php /** * Mock load.php with pre-defined test modules. * * This program is free software; you can redistribute it and/or ...
0
votes
1answer
46 views

XSS - any implementations to encode every output received from the server?

I was wondering - Say for example you have a legacy application that is XSS vulnerable - are there any (hopefully client side) libraries that can catch and manipulate all outputs that the server ...
2
votes
1answer
157 views

How does the anchor tag (<a>) let you do a stored XSS?

I was trying to get XSS but and site validate input but when I entered https://google.com the site did this: <a href="//google.com">https://www.google.com</a> so I tried to do this: ...
0
votes
1answer
303 views

XSS payload without html tags [duplicate]

Which payload can be used to exploit XSS without using html tags <>. These tags are filtered(sanitized) and encoded in output.
0
votes
0answers
78 views

PHP malware in the style tag [duplicate]

I'm developing my website based on the Dashgum Bootstrap template, wich I found online. I did a debug "echo" on a completely new empty php page and while inspecting the source, this is what I found ...
0
votes
1answer
103 views

How browser parses the escape characters in Javascript (XSS)?

I am new to XSS attacks. Recently, I was doing a project and found that one of my input field (website) is vulnerable to XSS attack. The value in website field is inserted into a href of an anchor tag ...
0
votes
0answers
31 views

Older Angular - 1.2.32 - Payload to XSS

Testing the app with older Angular. Somehow curly brackets are removed when entered in the field, or as parameter. Found this payload list: https://gist.github.com/mccabe615/...
0
votes
0answers
120 views

What is the XSS auditor in Chrome/Firefox and how do I find bypasses?

I've been doing a lot of bug bounties lately and although I've been gaining reputation and experience, I never seem to find XSS even in private programs. Items are always being reflected as HTML. It ...
-1
votes
1answer
327 views

Bypass this unique XSS filter?

I found a website that reflected back the user inputs. But the problem is when I inject this payload <svg/onload=alert(1)> I get an error. But when I use this payload <%20svg/onload=alert(1)&...