Questions tagged [xss]

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

Filter by
Sorted by
Tagged with
0
votes
0answers
29 views

is XSS possible on modern versions of angular

I wondering if XSS is still possible with modern version of angular I that the older version have some sandbox bypass but what of the newer versions.
0
votes
0answers
31 views

Can anyone give a practical example of exploiting reflected xss? [closed]

I know reflected xss can be dangerous but how can we exploit it more rather than just a popup. For example, I got a popup with this payload <IMG SRC=# onmouseover="alert('abc');"> Now ...
1
vote
1answer
67 views

Can an Intrusion Prevention System (e.g. Snort) prevent CSRF and XSS attacks?

I am currently learning about IPS and was wondering about a query that applies to how IPS works. I have knowledge of CSRF and XSS attacks, however I am unsure if Intrusion Prevention Systems can ...
0
votes
1answer
36 views

Which cookies can xss have access to

I clicked on a link in my android phone and I don’t know if it was an xss or not. I want to know that in the case of an xss attack, can the hacker access my whole cookies or just the cookies that ...
1
vote
1answer
76 views

How to confirm if it's a case of XSS

On a training website where instructors can create Q&A exams for their students, an instructor put a question about XSS. Part of the question was http://abcd.com/options#<img src=1 onerror=...
0
votes
0answers
40 views

XSS with Java to get User Cookies

I am practicing some XSS on a vulnerable apache2 web application and having some issues getting the user's cookie information. I am following the instructions in this Lab for the XSS Attack. We are ...
0
votes
0answers
32 views

Vulnerability detection tool that scans for dynamic script tag appending to DOM

I understand that dynamically appending a script tag to DOM could lead to XSS attacks if script's URL isn't properly secured and my.remote.domain.com isn't whitelisted as an allowed domain to load and ...
0
votes
2answers
51 views

Safely creating script tag and attaching to DOM

I have a need to to create and attach a script tag to DOM at runtime. The script is a remote webpack bundle (via a Module Federation plugin). I would like to be able to change the URL to that hosted ...
0
votes
0answers
29 views

What you can do with XSS attacks [duplicate]

I am practicing in a website which is vulnerable to XSS so as to learn better this kind of attacks. I have managed to inject somewhere the usual <script>alert('XSS')</script> and it seems ...
0
votes
0answers
63 views

Intercept postMessage token through an XSS

I have found an XSS vulnerability which is triggered on a backend admin system from an output sent from a regular user. So this XSS is triggered in an iframe belonging to viewer.exemple.com but loaded ...
0
votes
0answers
54 views

XSS attack being blocked by the browser

I'm trying to validate / test and XSS attack; however when I navigate to the page, the browser (tried on Chrome and Edge) tells me: A parser-blocking, cross site (i.e. different eTLD+1) script, is ...
2
votes
1answer
87 views

Is an XSS attack possible under these constraints?

The output is: <img src="http://example.com/[input]" oncontextmenu="openUrl('http://example.com/[input]')"> Where [input] is the user input, which is sanitised through this ...
2
votes
2answers
122 views

Does escaping quotes in a HTML attribute context prevent XSS?

I'm learning about XSS and I found I can inject code in this tag a few days ago. Tag: <div id="pagenotfound" title='Cannot find /it/search/testtesttesttetst\'onload=alert(1)'> My ...
8
votes
5answers
4k views

How to protect a <input type='password'/> from XSS?

Most sites having a sign in form have the following html element: <input type="password" /> If I press F12 to open the debugger on chrome and type: document.getElementByName("...
0
votes
1answer
50 views

Validity of a WAF as a Compensating/Alternative Control for CSP, X-XSS-Protection, etc [closed]

I would like to know peoples' thoughts as to whether a WAF is a perfectly acceptable compensating/alternative control to things like CSP, X-XSS-Protection, etc. I know WAF is suppose to protect ...
1
vote
1answer
58 views

Blocking reflected XSS on common web servers

How is it possible to block reflected XSS on common web servers, such as IIS, Apache HTTP Server and Nginx? The Content-Security-Policy: reflected-xss filter doesn't work on latest Chrome and X-XSS-...
2
votes
1answer
179 views

Stored XSS Cookie Stealing - shortest payload

I'm testing a web app (for which I have permissions) and I found a stored XSS vulnerability. It is a little bit tricky to exploit because the input: is being capitalized it has a length constraint of ...
0
votes
1answer
45 views

Can this Javascript redirect be exploited in some way?

Since I can modify pathname, search and hash value could I leverages this in some way? var URL = window.location.hostname+window.location.pathname + window.location.search + window.location.hash; ...
1
vote
0answers
55 views

XSS strip tag bypass [closed]

I'm studying and I really need some help, I've this code: $param1 = strip_tags($_GET['var2'], '<>'); I'm trying all kinds of things, like: $_GET['var2'] = "Hello <img src=x onerror=...
14
votes
2answers
3k views

SQL injection inside XSS

Is it possible to perform an SQL injection inside an XSS attack? And if so, where can I find information on this or some examples?
1
vote
1answer
72 views

Is possible ot create XSS with theses chars?

As part of bug bounty, I have a PATCH request to the API to change my name. I can post theses chars: : ; ' * ` = # / [ ] ( ) This is the HTML result : data-cy="label-input__input" value=&...
1
vote
1answer
99 views

Is it possible to read and extract HTTP request headers via JavaScript while performing XSS & CSRF? If so, how?

Is it possible to read and extract HTTP request headers via JavaScript? i.e. something like; var req = new XMLHttpRequest(); req.open(‘GET’, document.location, false); req.send(null); var headers = ...
2
votes
1answer
49 views

web app 3rd party JS dependency vulnerability management

As a security engineer, I wonder about the common approach for web app 3rd party JS dependency vulnerability management. We have a lot of apps depend on Jquery etc. In a regular vulnerability scan, ...
2
votes
0answers
51 views

Will javascript execute which is in an HREF?

I have located an issue where the user can provide an HTML that will be rendered on a page. Unfortunately, the HTML is rendered inside an href attribute using "(quotes), making it impossible to ...
1
vote
0answers
70 views

Prevent XSS in 3rd party (self hosted) application

We have an application which have purchased from a 3rd party and host in our own environment. The application consists of its own UI and back-end, and is included in our own application through an ...
1
vote
1answer
67 views

XSS on infinite-scrolling pages

Say I make a social-media website and forget to include the htmlspecialchars() function. If the website uses infinite scrolling (that will eventually show every post on the website if you scroll down ...
2
votes
1answer
73 views

Is an XSS via Cross-Site File Upload (CSFU) practically exploitable?

I came across a very interesting case: The user uploads a file The file contains <script>alert(2)</script> The web app shows the file's content to the user -> the XSS payload is ...
0
votes
0answers
61 views

JWT implementation and protection against CSRF and XSS

I have been going through OWASP guidelines on managing JWT based authentication. So, I have decided to change my current JWT implementation as per that. Flow is as below. When authenticated ...
1
vote
1answer
151 views

Can a malware steals my Facebook c_user, xs, and datr Cookies?

Just as the title suggests. I have a PasswordStealer on my PC and I'm afraid that it can do that. AFAIK, that malware can record keystrokes and steal saved passwords which I don't mind because I don't ...
0
votes
2answers
83 views

Does an effective Content Security Policy mitigate a universal cross-site scripting vulnerability?

I am doing some background research into types of XSS and prevention and as I understand it there is not much any application can do against a universal XSS in a plugin or browser. A last line of ...
0
votes
0answers
28 views

Whats wrong with this XSS vector? [duplicate]

Payload: <DIV STYLE="background-image: url(javascript:alert('XSS'))"> Reference: http://seguretat.wiki.uoc.edu/index.php/XSS_Cheat_Sheet Can someone please explain why this payload is ...
0
votes
1answer
227 views

Xss filter bypass >&lt;script&gt;alert(1);&lt;/script&gt; [duplicate]

As you can see, all fields that I send only the attributes < > are coded, so they are not executing in the browser. Is there any way to bypass this XSS filter? In my case, only these attributes ...
2
votes
1answer
98 views

Prevent Cross Site Scripting but still support HTML file upload

I have a web application where user can upload and view files. The user has a link next to the file (s)he has uploaded. Clicking on the link will open the file in the browser (if possible) or show the ...
0
votes
0answers
12 views

JavaScript injection minimal example using node/express not working: <script> not executed [duplicate]

I want to create a minimal example where JavaScript injection/XSS is working. This is my example server: const express = require("express"); const path = require("path"); const ...
3
votes
1answer
843 views

How can I read local files from blind XSS?

When I do one of these payloads, I can see /etc/passwd: <iframe src=file:///etc/passwd></iframe> <img src="xasdasdasd" onerror="document.write('<iframe src=file:///etc/...
1
vote
2answers
84 views

Does OpenID Connect provide CSRF and XSS protection?

I've been reading several articles recently about how storing JWTs in local or session storage is inherently insecure. The mitigation is apparently to implement a "session ID pattern", i.e. ...
3
votes
1answer
400 views

ModSecurity - XSS not blocked when #/ (hash) is added in the url by NodeJS application

I have installed ModSecurity in Apache server and using it as a reverse proxy to forward request to a NodeJS applicaiton. I have followed this tutorial to configure ModSecurity in Apache, https://www....
0
votes
0answers
209 views

CTF XSS Session Hijacking

I'm playing a complete noob in terms of security but a friend invited me to play a internal CTF for my company and I'm stuck with this challenge. I have a simple website that goes as follows: http://...
0
votes
0answers
253 views

Is it possible to bypass httponly?

I reading some articles about XSS, and how to mitigate the flaws in a web application. I've seen the HttpOnly on Set-Cookie, and i ask myself can this flag can be bypass ? Or is it a another way to ...
0
votes
0answers
29 views

How to secure my mobile application without knowing the source of an uri to display an image?

I would like to know if I expose myself to security problem (potential xss threat?) if I accept unverified external url of images (for instance https://another-website-external-image.png) to be ...
0
votes
1answer
54 views

Is there a good place to find WAF rules tested? [closed]

I am searching evaluated WAF rules that check OWASP Top 10 and even more to have decent protection of a web infrastructure.
2
votes
0answers
31 views

Escaping angle brackets if entry point is between tags?

So I'm trying to evade a filter that escapes < and >. I read that it's possible if the XSS gets injected inside a tag, but in my case, it gets injected between <span></span>. Are ...
1
vote
1answer
56 views

CVE-2019-14748 but the file is downloaded and open locally - can it be used for XSS?

I'm testing CVE-2019-14748 on an example.com with osTicket. I've uploaded a test.html with the basic <script> and <img> XSS payloads which run when a user opens test.html. However, in ...
0
votes
2answers
81 views

can i execute javascript in href when i have text before my input?

This is where I took this example from: <a href="<?php echo $_GET['e'];?>">Back</a> In this code, I can do http://my_url?e=javascript:alert() But what can I do if my code ...
1
vote
0answers
38 views

Bypassing Comment by XSS

I'm learning Web Security currently, and my tutor left this practice for us. Is there any solution to bypass this js statements and as a result, for example, to display alert(1)? Thanks! input = input....
0
votes
0answers
16 views

How can I bypass double quote transformation in &quot; and < transformation in &lt; and > &gt; in XSS bug bounty attack [duplicate]

I started bug bounting and I am trying to do an XSS attack and my " and < > are converted in &quot; &lt; &gt; How can I bypass this?
1
vote
0answers
59 views

Safely render HTML template with inline CSS from trusted domain (it forces the use of “style-src: unsafe-inline” in CSP)

I am working with a form that a user can fill out to send an e-mail. As part of the form, there is a preview button that shows the user a preview of how the mail will look in a new tab in the browser. ...
1
vote
1answer
88 views

XSS injection in the name of a file to be sent

I found a reflected XSS in a POST request that sends a file to the web server. The HTTP POST Request The HTTP 200 OK Response When I want to try to insert document.cookie in the payload, the web ...
1
vote
0answers
89 views

XSS on marketing websites like craigslist. How does this work on a technical level? [closed]

I was wondering how this works. We have a marketing site in Holland where people can sell second hand goods. Rumor goes that there is a lot of phishing going on there and XSS code is used in the ...
1
vote
0answers
155 views

XSS with Template Literals

I suspect I have a potential XSS vulnerability at a client-side level, however, I'm not able to exploit it successfully. The URL I'm using consists of three parameters that reflect back to the user ...

1
2 3 4 5
28