Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [xss]

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

-1
votes
0answers
33 views

How can I execute my JS payload?

So basically, I am trying to get my JavaScript scripts to work but due to the server-side filters such as htmlspecialchars it keeps failing. Our input is placed between this block of code: <div ...
3
votes
1answer
51 views

javascript eval() clarification

I've read this article about eval security issues. I need a clarification about this particular situations: For example, imagine we had a web app with a text field input that we were running eval()...
-2
votes
1answer
123 views

How to protect my site from XSS

I own a chat site {https://trixac.com}. It uses BoomChat's code. Recently I banned a troll and now he is back and hes running XSS injections against my site and it's working for some odd reason. I've ...
0
votes
0answers
55 views

xss attack on value field by bypassing encoded double quotes

consider a website that handles search query like this: <input class="something" type="search-field" value="SEARCHQUERY"> if i try to inject this script it doesnt work... " onerror="alert(0) ...
1
vote
1answer
69 views

CSP: What is script-src-attr and script-src-elem?

script-src-attr and script-src-elem directives are new additions in CSP3. I am not able to understand how are they different from the script-src directive. https://w3c.github.io/webappsec-csp/#...
0
votes
1answer
59 views

java script in link href=“javascript:alert(1)”

In an app I am testing they allow to input a domain name, store it, and when they print it on the browser they concatenate "http://" at the beginning of the domain. So, if you input "google.com", then ...
1
vote
4answers
128 views

can XSS attacks be nullified by prepending a backward slash to all external links?

In my website I noticed my developers had set it up so certain form data was past from the URL to the content of the website. E.G ?email="email" The obvious vulnerability means that I can put ?email=...
2
votes
1answer
60 views

Blind XSS Payload for xml file?

I think i may have found a blind XSS. I can only upload xml files that are opened inside the backend. My questions is: How can i turn this payload into a blind xss payload to receive a ping to my ...
0
votes
0answers
47 views

Requests logged in Cloudflare as “XSS, HTML Injection - Body”

Rule name: XSS, HTML Injection - Body Rule: 100096BHTML Since about a week ago, requests matching this WAF rule have strongly increased on a customer's website. This is an example graph showing only ...
3
votes
2answers
86 views

How to chain XSS payloads?

I found a parameter on a website that is vulnerable to XSS. The website is a game and the parameter in question is the name of a player team. However, the parameter is limited to only 20 characters. ...
0
votes
0answers
45 views

XSS PoC for JSON

When I am requesting for a password reset, it's making a request like this -> {"eval":"uiFormNotify('messageDiv', 'info', 'msg.email_reset_to_existing', 10);Metronic.unblockUI('#forgotPwdForm');$('#...
0
votes
0answers
41 views

How to ignore htmlentities() to steal cookies in php page

I have a messageboard running at http://10.8.0.240/a9q2/messageboard.php. I can use my 'student' login to login the messageboard and post messages which can be seen by the admin and other students. ...
1
vote
1answer
101 views

Presistent XSS Filter Bypass Question

I was testing out a stored XSS on a test site I made which is vulnerable so the problem is when I tried executing the usual "><script>alert('XSS')</script> It did not work instead. But ...
3
votes
2answers
141 views

CVSS Score for self-XSS (stored XSS)

I have a web application which is vulnerable to stored, self-XSS attack. Proper encoding is not done In the place where the data from a database (set by the same user) is added to response. However, ...
1
vote
1answer
85 views

Can this be turned into dom xss? [on hold]

I am testing a bug bounty website and i reached a support ticket creation functionality. I registered with email address {{15*15}}@testemail.com. I created a ticket but when i try to open the ticket i ...
0
votes
2answers
88 views

Cross Site Scripting href=/\evil

I've seen <base href=/\evil> and <base href=//0> as a vector to use XSS. Could someone make an example using these vectors and explain me if "/\" is the same as http:// or has some ...
1
vote
1answer
48 views

Why is not checking the origin of postMessage insecure?

Typically, within the onmessage handler, you would have something like this: window.onmessage = function(e) { if (e.origin != "www.example.com") return; //Do stuff }; The check for e....
0
votes
0answers
39 views

jQuery-1.11.0 xss p0c

I have a web application at the workshop that uses the old jQuery-1.11.0 library, where jQuery.globalEval (text); hence every text/javascript responses gets executed, and in my case it looks like: &...
1
vote
1answer
76 views

Is it possible to exploit XSS by replacing image data for img tag [duplicate]

If I have HTML page served over https with image loaded over http (image from other domain): <img src="http://some-image.png"/> so it's possible to inject any data to browser as image by using ...
0
votes
0answers
43 views

Is it possible to extract data from api response from main domain?

I found an XSS on subdomain.example.com, is it possible to use that xss to extract the response of an api request from the main domain example.com/api/xyz? The xss is on subdomain.example.com and I'd ...
1
vote
1answer
66 views

XSS vulnerability in a module that doesn't exist

We did a vulnerability scan on our systems and received a vulnerability: Basit Submit Module Cross Site Scripting Vulnerability. We are not even aware of this application on our system. We filed a ...
3
votes
0answers
55 views

How Can Exploit Xss and Sqli via HTTP Verb Tampering?

I was reading a paper about 'HTTP Verb Tampering' here: https://blog.jeremiahgrossman.com/2008/06/what-you-need-to-know-about-http-verb.html The author said: 2) HTTP Verb tampering is generally ...
0
votes
2answers
123 views

How hackers manage to run javascript code in webform

How hackers manage to input malicious code into web applications and most websites? I'd like to say that it is rare of websites to have the JavaScript function eval() on their website's code.
0
votes
0answers
31 views

Keycloak's Angular quickstart : XSS vulnerable?

We are using Keycloak for the authentication of our server-side rendered applications (Java/Spring/Thymeleaf), and now we want to use it for our Angular applications. Using the Angular quickstart, ...
0
votes
1answer
69 views

I want to inject XSS payload in an anchor tag, but the double quotes are being converted into %22

The tag works like this: <a ref="http://googl.com%22 onclick=alert(124)">http://google.com" onclick=alert(124)</a> Here, the double quote I put is turned into %22. Is there a way to ...
0
votes
1answer
75 views

How to identify where XSS is actually executed?

So I have a reflected XSS vulnerability where I get a pop up by entering <script>alert(2)</script> in the search field. I can't see this payload ('2') anywhere on the screen, neither if I ...
0
votes
0answers
30 views

is xss possible without these chars? [duplicate]

I'm wondering if xss is possible without these chars disallowed/filtered text: < > ! @ # $ % ^ & * : ? = ( ) I'm able to break out of a style attribute of an element by introducing an ending ...
-2
votes
2answers
53 views

XSS with HTTP flag true

Since HTTP only flag is used to mitigate Cross Site scripting, we cannot perform XSS on the web application? If we can, What are some best real time examples to pentest XSS when HTTPOnly Flag is true?...
0
votes
1answer
138 views

How to exploit publicy known vunerable version of jquery?

i searched no-stop for a lot of time trying to see how the publicy known "Vulnerable version of the library jquery" can be exploit to make proof of concepts to website owners. Let's say we have The ...
0
votes
0answers
47 views

What do these vulnerabilites/exploits mean for XSStrike

Could someone explain how to use the exploit I found, if I have found one? I may have potentially found an xss exploit on my church's website and want to notify the church website admin if I really ...
0
votes
2answers
116 views

XSS in HTML class tag with only double quotes escaped

I am currently testing XSS filter and I wonder, whether it is possible to demonstrate XSS attack on class tag attribute in HTML, when only double quotes are escaped. Other characters (<, >, ') are ...
0
votes
2answers
56 views

Does choice of DBMS matters in the protection of XSS and other injection attacks

I have filtered into 3 most used databases, MySQL, Microsoft SQL server and mangoDB. I have to choose the most secure database from these three. Does my choice of DBMS has a role in protection ...
1
vote
2answers
255 views

How to exploit XSS vulnerability through an iframe

Recently, I found a stored cross site scripting vulnerability in a rather large website, but I am not sure if it is dangerous or worth reporting. On this website, there is a resource section that is ...
2
votes
1answer
100 views

Is it safe to let the user name an object key in JavaScript?

Recently I found a piece of code that takes input from the url. The input then get's saved into a javascript object: https://website.com/?foo=bar var x = {"foo": "bar"}; While the value doesn't ...
1
vote
0answers
60 views

WAF is set to Alert, not block. We are seeing thousands of XSS and SQL Injection attacks. How can I tell if any were actually successful?

I'm pretty inexperienced with WAFs and the events/alerts it generates. I'm wondering how I can tell if any of those were successful? For example, in the last 24 hours we saw over 50K alerts/events ...
0
votes
1answer
65 views

Is my checkNumber() function secure?

function checkNumber(number) { event = document.all ? window.event : number; key = document.all ? event.keyCode : event.which; window.event.keyCode if(key<48||key>...
0
votes
0answers
92 views

How to bypass character filtering in XSS?

I am solving XSS challenges. I found difficulty in one that filters the character "o" both uppercase and lowercase. I can run tag. I have to call function "prettyRobot" to complete the cahllenge. But ...
0
votes
1answer
71 views

XSS: Character showing in DOM [closed]

I have created an html page that redirects user to a test site that has an XSS vulnerability. I am able to successfully execute javascript via the vulnerability. However, I have found that some of the ...
1
vote
1answer
88 views

iframes, user generated content and scripts

Currently, we have a small personal project which is meant to allow people to create 'profiles' in HTML/CSS. We aim to put all this generated content within a sandboxed iframe. The next point in ...
3
votes
1answer
142 views

Find security weaknesses in this website (exam question)

I am currently studying for a computer security exam and I am stuck on the following question from a past exam paper 1c <form action=”message.php” method=”get”> 2c <p>Message: <input ...
0
votes
0answers
29 views

What are the risks with leaving the offending anchor portion of an URL in a failed client-side XSS attack?

As a simple example, let's assume that I have implemented a key-value lookup within a pre-populated, static JavaScript dictionary. Let's say that the dict is: a = { 'one': 'uno', 'two': 'dos' }; The ...
0
votes
1answer
246 views

Bypassing htmlspecialchars() for XSS (Reflected) and using an event handler is not an option in this case

I am trying to bypass high security XSS on DVWA. So the vulnerable code(I highly doubt that is it really vulnerable?) is:- <?php if(!array_key_exists ("name", $_GET) || $_GET['name'] == NULL || $...
1
vote
1answer
268 views

Bypass a simple XSS filter that only looks at <

Say, I have a page where the input from the user is taken and is passed through a simple client-side XSS filter. That filter only replaces < characters with ''. in = in.replace(/[<]/g, ''); ...
0
votes
2answers
125 views

Is it possible to bypass this Xss Filter?

Everyone, I was creating this XSS filter for my node plugin and I want to know is it possible to bypass this? function xSSFilter(str) { return str .replace(/&/g, '&amp;') ...
1
vote
0answers
37 views

If and why is it safer to output JS literals into an HTML tag than JS encode them and set them directly to a JS object?

From ASP .NET Core docs about preventing XSS: Before putting untrusted data into JavaScript place the data in an HTML element whose contents you retrieve at runtime. If this isn't possible, then ...
59
votes
9answers
12k views

How hard should I try to prevent a user from XSSing themselves?

Let's say a user can store some data in a web app. I'm now only talking about that sort of data the user can THEMSELVES view, not that is intended to be viewed by other users of the webapp. (Or if ...
36
votes
9answers
12k views

How dangerous is XSS?

I am a software engineer and have been watching a lot of videos about XSS. But I fail to understand how is it dangerous if it runs on the client side and does not execute on the server side which ...
0
votes
0answers
43 views

Finding hidden parameters manually for XSS

I am researching about XSS and Google helped me a lot about learning like how to bypass XSS filters, POST and GET based XSS . I am really curious to know how to find hidden parameters manually for ...
0
votes
2answers
83 views

Is eval() in JavaScript considered self-XSS?

I found eval() in the JavaScript code of a site in HackerOne. I could not find the where the function is called, so to test the vulnerability I went to console in Chrome and wrote the method and a ...
0
votes
4answers
161 views

Is XSS and HTML injection the same?

When doing a XSS, we usually put the JavaScript code between the <script> tags. I have noticed that HTML injections are very similar because you are doing almost the same thing, but using ...