Questions tagged [xss]
Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).
1,519
questions
1
vote
0
answers
30
views
Is the ability to inject arbitrary CSS styles in an img tag a security vulnerability?
I've discovered a behavior in a popular service's markdown parser that allows the 'style' attribute to be used within 'img' tags through some crafted markdown code. This allows for the application of ...
- 11
0
votes
0
answers
17
views
Does other frontend framework have similar issue like AngularJS?
I'm reading an article that talks about XSS exploitation on AngularJS,
AngularJS will render the template in ng-html, and it bypasses sanitize-html.
My questions,
I'm wondering if other frameworks ...
- 2,057
0
votes
0
answers
27
views
Can you inject permanent code into a website by client-side XSS? [closed]
Is there a way to permanently add code to a website vulnerable to client-side XSS? so if you refresh the page, it is still changed?
if you can, how?
1
vote
1
answer
32
views
Is it safe to store the OIDC token in a private field of a javascript object?
I would like to initialise a React application with an OIDC token.
This token will be stored in a private field of the "api client" object. This object will be used to execute API calls and ...
- 653
0
votes
1
answer
95
views
Is this a type of XSS attack?
I have been exploring customer support in a website as part of bug bounty program.
I then started a chat with their customer support and pasted the following in the box:
<!--<img src="-->...
0
votes
0
answers
46
views
Security frontend side
Hi i´m a frontend developer and next week we will have a security audit i need to be sure that frontend side is secure and dont have vulnerabilities, so my question is, ¿What would you recommend or ...
0
votes
1
answer
740
views
Why can't we close some tags for cross site scripting purposes?
There's a webstore that i am trying to find a XSS vulnerability for BUG BOUNTY.
On that store is a search bar that i can send anything
https://www.examplestore.com/blog/?s=</title><script>...
0
votes
3
answers
101
views
is a stored xss possible if user input is not saved?
I was wondering if a stored cross-site scripting attack is possible if the user input is not saved.
If a website is vulnerable to an xss attack, can someone put in a code or something that stores a ...
2
votes
0
answers
40
views
Security in Angular: Addressing XSS Concerns with External Libraries and Interpolation
Introduction:
We heavily use external libraries, such as DataTables, in combination with interpolation. In Angular, we've identified two primary XSS prevention strategies:
Interpolation ({{ }})
...
- 31
0
votes
0
answers
58
views
How to abuse the onerror method to get XSS?
In the book Javascript for hackers, Gareth Heyes overwrites the window.onerror method with eval, used to execute a function.
From my understanding, the following snippet run in a browser console ...
- 133
0
votes
0
answers
34
views
Safe Sinks js confusion
Have some confusion regarding safe sinks in javascript.
The DOMpurify library linked in the OWASP article does not explicitly mention the .files and .valueAsDate of an HTMLInputElement as safe sinks, ...
- 101
0
votes
0
answers
64
views
CSP script-scr blob
What are the risks to allow a "blob:" directive to the script-src CSP? Is it safe?
I have a list of allowed domains defined in script-src, but nonetheless I got an error specifying the ...
0
votes
2
answers
66
views
Simple XSS Example Involving AJAX not Firing
In creating a simple demonstration of XSS I'm failing to see the result of the injected code, and I'm wondering what simple thing I've overlooked.
This is the code that handles the AJAX request after ...
- 175
2
votes
2
answers
398
views
CVSS3 score for XSS leading to account takeover
Let's say there is a XSS vulnerability in a web application. The XSS allows an attacker to hijack the user's session. Within the session, the attacker can view/modify the user's credit card and ...
- 85
0
votes
0
answers
152
views
XSS Payload That Can Bypass Special Character Check
I developed the following C# algorithm to prevent XSS attacks:
private bool Is_There_XSS_Payload(string arg)
{
Regex regex = new Regex(@"^[a-zA-Z0-9]+$");
bool result = ...
- 1
0
votes
0
answers
33
views
XSS: bypassing html entity encoding of <,>,& characters [duplicate]
I am currently testing a webapplication that is sanitizing user input by html entity encoding special characters.
E.g. <script>alert(1)</script> becomes <script>alert(1)&...
0
votes
1
answer
351
views
Using window.open('',"_blank") can this be XSS exploited?
If I have javascript that opens a window using the code below, the content is a user supplied variable that is not sanatized. Is there any security risk in this situation. The content will only be ...
- 113
3
votes
1
answer
556
views
Why is the browser not sending cookies with cross-domain WebSocket handshake request?
If I have understood Cross-Site WebSocket Hijacking (CSWSH) attack correctly [1][2][3][4], the attack relies on two things (examples are from the first reference):
the browser sending the cookies set ...
- 559
0
votes
1
answer
83
views
Is <img :src="require`${JSON.parse(string)}`"> in electron vue is safe from XSS?
I am inspecting a client's application written with Vue.js and I found there a following construction.
// Somewhere else in the code
var data = JSON.parse(jsonString);
// In the vue component
<...
- 101
1
vote
1
answer
430
views
XSS in document.write(location.href)
Let's say a website contains the following <script> tag and does not have a CSP blocking any execution here.
<script type="text/javascript">
document.write(location.href)
</...
- 113
1
vote
0
answers
110
views
Reflected XSS but no Content-Type is specified
I have found parameter that simply reflects into response body, but no Content-Type is specified by server. It doesn't use any XSS-protection mechanisms like CSP or X-XSS-Protection. However, I was ...
- 11
2
votes
1
answer
328
views
Why don't Internet browsers allow me to fetch a JSON file from raw.githubusercontent.com, but they allow me to fetch .psm files from there?
When I was making my PicoBlaze Simulator in JavaScript, I added 6 examples of how to use it. Those examples are on my GitHub profile, they are the .psm (PicoBlaze Assembly) files. I decided not to ...
- 123
0
votes
0
answers
44
views
Are there any html Sanitizer() API configs that allow javascript execution?
I'm talking specifically about the HTML Sanitizer API: https://developer.mozilla.org/en-US/docs/Web/API/HTML_Sanitizer_API
The API allows you to configure the sanitizer with a list of allowed elements ...
- 101
0
votes
1
answer
136
views
With Response header having content-type: application/json, is it still possible to trigger XSS?
The application is responding using the user supplied request but the content type is set as application/json. Is it possible to trigger still XSS?
This is a language neutral question, it can be Java,...
- 43
0
votes
2
answers
74
views
What defines an XSS vulnerability? (my case) [closed]
I was in a bug bounty. I can't be sure of this problem because it's all over the website.
Will this be harmful for the organization?
When I exit the angular brackets and paste the payload, it pops up ...
1
vote
1
answer
85
views
Is this code vulnerable to DOM XSS?
const scriptElement = document.createElement('script');
// Set the source (src) attribute
scriptElement.src = '/evil.js?'+decodeURI(urlParams['sync']);
// Append the script element to the HTML ...
0
votes
1
answer
66
views
XSS not executing properly
Instead of receiving Alert(XSS) I get [object Object]
The application is expecting a .csv file and the name of the file is being reflected. I put the original .csv file and then I remove it in order ...
- 11
3
votes
1
answer
2k
views
Is it safe to use font-src with data: in a Content Security Policy?
I'm currently experiencing an issue where base64 encoded fonts are being blocked by CSP on my website (note that I replaced the base64 with abcdefg in this example:
Refused to load the font 'data:font/...
- 133
1
vote
0
answers
110
views
HTML tags converting into entity characters in XSS [closed]
When I type xss in a search box, it's reflecting and when I inspect it, it's showing as <h1>Search results for: xss</h1>.
So I tried to inject script <img src=x onerror=alert(1)> and ...
- 23
1
vote
2
answers
430
views
XSS in a href with target=_blank
I have found out that in most browsers the following code won't execute:
<a href="javascript:alert(1)" target=_blank>click</a>
But the same code without blank will.
My question ...
1
vote
1
answer
104
views
JS bug is stopping my xss payload to exeute
The XSS vector is at the * but the function issue_type is not declared hence my payload is not getting executed.
following is the instance of the vulnerable code:-
<select name="sub_subissues&...
- 13
1
vote
2
answers
263
views
Reflected XSS detected by Burp Suite not working
Burp Suite detected a reflected XXS, if I use the Repeater and send the request the payload shows up in the response unfiltered, but if I visit the url it gets filtered, is there a way to bypass it or ...
0
votes
1
answer
325
views
XSS bypass in url
I have a website: https://bugbounty.com/test/"injection inside js", but " is escaped with \ and I'm trying to inject </script><script>alert() but https://bugbounty.com/test/&...
1
vote
2
answers
359
views
xss: is it possible to continue javascript code execution after a "throw new Error()" line?
there is this javascript file that a can inject code after throw new Error("error string") line. But it seems that after the throw statement, no code can be executed.
throw new Error("...
- 13
1
vote
1
answer
177
views
How is a XSS attack possible in this context?
I'm testing a website, which is vulnerable to XSS.
<input type="hidden" id="referer" name="referer" value="INJECTION_POINT">
<script>
document....
- 11
1
vote
0
answers
272
views
force XSS after bypassing Request.Form using URL Encoding
I am testing a cross-site scripting attack on a website, as we all know the Request.Form function validates the input so the user couldn't insert a <script> inside the input.
My focus in this ...
- 11
0
votes
0
answers
61
views
Is storing access token in private data, refresh token in http-only cookie safe?
Backend: Django / Django Rest Framework, would be hosted at GCP k8s
Frontend: Angular, would be hosted at some CDN e.g Vercel
Authentication: JWT (https://github.com/jazzband/djangorestframework-...
1
vote
0
answers
57
views
Understanding browser text input value rendering for combatting XSS
If you use inspect in the developer tools for Chrome the values for the two input boxes below will look the same.
<input name="test1" type="text" value="<script>alert(...
- 111
1
vote
1
answer
610
views
How to alert cookie in 30 character XSS payload?
The application allows user to enter a 30 character long username.
I tried the following XSS payload and it worked, but the triager is asking if I can alert cookie. But script tags and src keyword is ...
- 11
0
votes
1
answer
98
views
Validating XSS script with success response with expected data in REST API
I am performing security testing on a REST API and it is a POST method. I injected an XSS script in a body parameter and the API responded with '200 success' response with the actual expected data.
If ...
- 1
1
vote
3
answers
955
views
What exactly are Hidden HTTP Parameters?
I read a lot of reports where 'hackers' potentially exploited a 'Hidden HTTP Parameter'. There are also tons of tools which are developed for this exact purpose.
Example : https://blog.yeswehack.com/...
- 41
0
votes
2
answers
217
views
What are the risks of XSS in this forms?
I recently developed a website that was operational for me ^^
However, someone came to try injections and found an XSS flaw.
I have a form like this:
<h2>
<span>Search</span>
</...
- 1
0
votes
0
answers
422
views
CSP for Single Page App: Use client-side nonce for securing iframe content
Goal I'd like to tighten my Content Security Policy.
Situation
I have a single page react application (= All code and styles are bundled together into a bundle.js file). The file is simply placed on a ...
- 101
0
votes
0
answers
127
views
XSS payload with html Encoding
I was reading about XSS Contexts on Portswigger and it has a section about the use of HTML-Encoding in bypassing input validation.
What i understand is :
The browser html decodes the entities before ...
0
votes
1
answer
68
views
Why do you think this code isn't firing?
I don't have a lot of knowledge about xss so im kinda confused, why this is not popping up an alert box?
- 1
0
votes
0
answers
26
views
I clicked what looked like an Amazon email, but it (maybe) was from an Amazon affiliate. Ended up at Amazon.com anyway. Can I safely investigate? [duplicate]
In a case of clicking too fast, I clicked on a picture that looked like it was from Amazon. However this was not the case. I did end up at Amazon, but I'm aware that other things could've taken place ...
- 1
0
votes
1
answer
97
views
How do browsers defend the user against XSS?
I'm learning about the different mitigations employed by browsers against XSS vulnerabilities.
Let's say, the developer made a mistake and there is a XSS vulnerability on a site. Unfortunately, a ...
- 1
1
vote
1
answer
312
views
Jsoup XSS attack with URL encoded input
I'm having a Spring Web Application that exposes REST APIs.
I have implemented XSS filter using Jsoup that strips the input using Safelist.NONE.
The penetration testing team raised a concern where the ...
- 113
1
vote
0
answers
73
views
Storing auth token in html
Current projects webs application utilises a cookie based approach to store users auth token. Implemented with secure and http-only attributes set. All traffic over https. The application loads third ...
- 11
1
vote
0
answers
406
views
Client-side Javascript injection by assinging the output of window.location.href.substr to a variable
Sample code:
function winLoad() {
var sessionId = '';
if (window.location == window.top.location) {
var semicolonIndex = window.location.href.indexOf(';');
if (semicolonIndex !=...
- 11