Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [xss]

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

Filter by
Sorted by
Tagged with
0 votes
0 answers
10 views

Input Sanitation injection reflects local cookie information inside the Input textbox. How can this be leveraged to a xss attack? [closed]

The injection is inside an <input> element for an email address. The injection payload is ";"@site.com. Once submitted, local cookie information appears inside the actual input textbox....
user avatar
0 votes
0 answers
17 views

How to turn a relative path script (js) import to an absolue one with a url for XSS ? (more details below)

I have a parameter whose value is injected in the HTML as the following <script src="/dir1/dir2/dir3/dir4/INJECT_HERE"> </script> I was able to traverse back to just / but when ...
user avatar
0 votes
1 answer
75 views

How does this break out of a javascript tag?

How does putting the alert function '-alert(1)-' into a search field, where it ends up inside a script tag actually break out of the script string? Wouldn't this just be interpreted as an empty string ...
user avatar
0 votes
0 answers
22 views

What are vulnerabilities of saving user input directly in wordpress plugin?

I have a WordPress plugin that helps create an organization chart/tree and then generates a URL where the chart is available to be viewed by the public. The plugin dashboard looks like this the plugin ...
user avatar
0 votes
2 answers
56 views

What are the vulnerabilities of exposing url end point param?

I have a wordpress plugin that helps create an organization chart/tree and then generates a URL where the chart is available to be viewed by the public? Inside the plugin's view in WordPress dashboard....
user avatar
1 vote
1 answer
60 views

Why is this XSS not working on my site?

I'm attempting to make a site with an example of what XSS would look like, so in this I take user input and set a paragraph element's innerHTML to the user input but the script isn't running. However ...
user avatar
  • 13
0 votes
1 answer
26 views

HTML Injection into custom sanitiser

I found a curious website that shows listings. It allows you to type a description, and also allows for you to use tags like <b> and <u> for formatting. But it doesn't let you do more ...
user avatar
  • 101
0 votes
0 answers
12 views

Threat Assessment Javascript User-controlled Variable Names on Window

I have a requirement to support some external integration to a 3rd party vendor on our site (which is a SaaS site with multiple tenant logins). The vendor requires a script and a global variable to be ...
user avatar
0 votes
1 answer
78 views

IP address in access.log is incorrect and likely hacked

I just noticed in my access.log several POST requests coming from a (hidden) registration sub page that is not accessible via any link. A 'hacker' seems to have posted a form from there (manually it ...
user avatar
  • 103
0 votes
0 answers
46 views

XSS - Anyway to bypass double quotes in href of anchor?

I have an anchor that has href attribute populated by my input. I am trying to input javascript, but it always renders it useless since it always appears between double quotes. So far, I have tried ...
user avatar
0 votes
0 answers
40 views

Headers X-XSS-Protection issue

I want to clear my doubt that Is there any issues coming from adding 'Strict-Transport-Security' and 'X-XSS-Protection' headers ? Header set Strict-Transport-Security "max-age=10886400; Header ...
user avatar
1 vote
0 answers
25 views

Is PHP json_encode sufficient for HTML data blocks?

I want to access data in a PHP variable from JavaScript code. An (old) OWASP cheat sheet recommends embedding it in HTML before accessing it, an approach like this: <div id="init_data" ...
user avatar
0 votes
0 answers
31 views

How to XSS inside div tag without angle bracket? [duplicate]

<div class="comment"> --------------- </div> How to do XSS between div tags without angle bracket?
user avatar
  • 1
0 votes
0 answers
26 views

Security implications of access and refresh tokens (JWT) with refresh token rotation and automatic reuse detection

In an effort to avoid having to deal with CSRF attacks, I'm trying to implement an auth flow that completely avoids using cookies. In most cases this makes one vulnerable to XSS attacks. However, ...
user avatar
  • 101
1 vote
1 answer
37 views

Is there a consensus on whether HTML encoding should happen upon upload or retrieval/display for defense against stored XSS?

The common thing to do in defense against XSS, stored or not, is to HTML-encode the payload. Encoding upon the upload/POST of the data is efficient for processing power and neutralizes it early to be ...
user avatar
0 votes
0 answers
36 views

Mitigating CSRF and XSS with JWT authentication: can someone tell me where my logic is wrong

I'm currently working on a personal project including a RESTful API and also trying to understand how to make it as secure as possible. I have read a bit about JWT, the possible vulnerabilities as ...
user avatar
0 votes
1 answer
46 views

Is this safe from XSS?

I need to allow a user to pass unsafe text into an iframe URL: <iframe src="https://example.com?foo=INPUT"></iframe> Inside the iFrame render code, I have this: <!doctype ...
user avatar
  • 105
0 votes
1 answer
50 views

How do double quotes and angle bracket work in this scenario?

Question about a solution in portswigger academy (since portswigger explains nothing and I can't find any info elsewhere on this): Break out of the img attribute by searching for: Here is the img ...
user avatar
0 votes
0 answers
23 views

setAttributeNS XSS Vulnerability

Im fixing some security issues that AppScan found on my Angular Application, one of them is the insecure use of "setAttributeNS()" I use this method in my application to inject some ...
user avatar
0 votes
1 answer
40 views

DCP-Portal Vulnerability

This vulnerability is from a third party reviewer for PCI scans. I am stuck for months and can't figure this out. I already used sanitation to my page and it still fail the PCI scanning. I am starting ...
user avatar
0 votes
0 answers
29 views

Failed to inject payload with Python requests library in DVWA forms

I have written a Python script to inject a payload through the requests library, but the payload is being added instead of injecting xsstestscript=html.unescape("&lt;script&gt;alert&#...
user avatar
  • 1
1 vote
0 answers
71 views

XSS Payload Cookie Stealing

I have been playing around with the DVWA stored XSS page and wondered if someone could help. I used XSS Validator in Burp and found numerous payloads that give a prompt, indicating that XSS is present....
user avatar
  • 11
0 votes
1 answer
103 views

JSON Web Token splitting

It's been quite a few years since the last time I did web development and I realized many things have changed: instead of stateful server-side sessions with authentication cookies and CSRF tokens now ...
user avatar
0 votes
1 answer
90 views

XSS attack not executing with correct payload

Hello I was testing on a private program where I was able to inject XSS but for some reason it is not popping up when I put the mouse over the input field. <input type="text" onmouseover=&...
user avatar
0 votes
0 answers
104 views

CSRF and XSS Protection with a Static Site and REST API

I'm building an application which will support both browser and application access to REST resources. Applications will POST a username/password JSON body to a login endpoint which will return a ...
user avatar
  • 6,685
2 votes
1 answer
295 views

Can XSS ever occur in an <img> tag's "src" attribute?

In a scenario where an attacker has control over the src attribute of an img HTML tag, they could easily inject a simple JavaScript XSS payload like the following: <img src="javascript:alert(1)...
user avatar
  • 123
2 votes
1 answer
155 views

Is this server side object vulnerable to XSS?

I have an object that is stored in the server side of the application. It is never inserted into the DOM. The object looks like this: {"id": "34245425", "field": false, &...
user avatar
0 votes
2 answers
376 views

How is Object Tag data URI XSS actually XSS?

I have been looking into XSS pertaining to base64 encoding a data URI into an <object> tag (which is typically considered only a feasible XSS payload in Firefox), but I am failing to understand ...
user avatar
  • 3
1 vote
1 answer
177 views

JWT cookie with CSRF token as a claim inside the JWT

I am trying to figure out if the solution I am suggesting is valid for both XSS & CSRF protection, I would like to store the JWT in an httpOnly & secure cookie and not in local storage, when ...
user avatar
  • 113
0 votes
1 answer
88 views

How do I test for Reflected XSS in webpage titles, url parameters and javascript variables?

I have a java web app. I'm using OWASP Java Encoder to encode for html, javascript and url components to mitigate reflected XSS. I'm new to this so I'm not sure on how to test on my web app for the ...
user avatar
0 votes
1 answer
145 views

How to test an Angular SPA for DOM XSS with OWASP ZAP?

I want to test an Angular SPA for any DOM-based XSS. How do I do that with OWASP ZAP?
user avatar
1 vote
1 answer
173 views

How to implement the CSRF token mechanism for restful APIs?

Considering the following facts, using CSRF token for a restful API (which of course is intrisincly session-less) seems inevitable: storing JWT in local storage(any where other than http-only cookie) ...
user avatar
  • 113
0 votes
1 answer
161 views

HTML Option Tag XSS

Is it possible to inject javascript inside of an HTML option tag? For example, say you have the following html: <select> <option MALISCIOUS_CODE_HERE>Option Description</option> &...
user avatar
0 votes
1 answer
117 views

Detecting XSS when Payload is only Triggered on Another Page

I am trying to detect the presence of a blind/stored XSS vulnerability of an input field. The vulnerability does not trigger on page 'A' where the payload is injected. It is likely due to the fact ...
user avatar
  • 101
1 vote
2 answers
347 views

Bypass WAF to perform XSS?

I am trying to find an XSS in website protected by Cloudflare. I use Burp to find which HTML tags allowed. Only the <script/> is tag disallowed. I tested multiple payloads to pass the WAF and ...
user avatar
0 votes
1 answer
121 views

Could this code be vulnerable to XSS?

It seems like exploiting XSS is becoming harder with every browser version update. My question is: Is this code vulnerable to XSS? <script type="text/javascript"> var url = ...
user avatar
0 votes
1 answer
118 views

What can attacker do with OpenID Connect id_token?

I have an application that stores the id_token in the localStorage of the browser. Since there is no CSP and Web Storage does not have the same protections such as cookies (HttpOnly, SameSite) this &...
user avatar
0 votes
2 answers
144 views

XSS payloads getting filtered but HTML tags are getting rendered. Can we exploit this? [duplicate]

I was trying to test a potential XSS vulnerability on a website. On the search bar I can see the filtering process happening i.e if I type script> (not with starting <) I can see the same in the ...
user avatar
2 votes
1 answer
1k views

Is <plaintext> vulnerable to XSS

I have a question regarding the element. I know that this element has been deprecated for a long time, but during a penetration test, we inserted the following attack vector into a textarea: <...
user avatar
  • 139
0 votes
1 answer
2k views

XSS in <span> where only < and > are encoded

When im doing a penitent, I noticed the application takes the user input and put it in a tag. When I used the string of '';!--"<XSS>=&{()}, I noticed the returned output (when viewing ...
user avatar
  • 11
0 votes
3 answers
406 views

Does SOP prevent a class of CSRF attacks?

Just want to settle a debate I'm having with someone. Suppose there is no SOP. Via an XSS exploit, code can run on website A.com and submit an XHR request to B.com. Suppose B.com stores an auth token ...
user avatar
  • 11
2 votes
1 answer
238 views

XSS inside of a javascript string, with unusual filter

While making a website I made an interesting mistake, and I'm wondering if this could be used to achieve XSS. I've come very close, but not quite. I can put my user input into a string inside of a <...
user avatar
  • 123
0 votes
2 answers
139 views

abiliity to change elements in HubSpot iFrame forms

I recently started working on adding custom code to HubSpot forms after their form is loaded via an iFrame. Initially, I was using the following code to access the iFrame to change it: var form = ...
user avatar
  • 103
0 votes
1 answer
158 views

XSS Triggers only when pasted in

I have a XSS case that I would like to exploit as a proof of concept, however the payload seems to only be triggering when pasted in and not from the URL. Basically, I have a search box which when ...
user avatar
0 votes
1 answer
1k views

How to bypass an XSS filter encoding single quotes? [duplicate]

I'm trying to do an XSS attack test on a website. I am using " and <> just fine and I have managed to escape the string. Now I'm trying to send my own cookie to my server that saves it to a ...
user avatar
  • 3
6 votes
1 answer
1k views

Passing a C# object to Javascript in ASP.NET MVC

Several answers on StackOverflow suggest that a C# object can be passed to JavaScript in ASP.NET MVC by the following: <script type="text/javascript"> var obj = @Html.Raw(Json....
user avatar
  • 28.6k
13 votes
2 answers
3k views

How do I safely host third-party Javascript code in an iframe?

I'm building a website where users, among other things, can add embeds (YouTube, Google Forms, Airtable...) and show those embeds to other people. Embeds are snippets of HTML that can include <...
user avatar
  • 243
0 votes
0 answers
310 views

Stored XSS cookie stealing, but a loop of redirection

I found a stored xss vulnerability on a comment section of a fun site and I wanted to steal cookies using xss attack. So on my remote server I run an HTTP server with Flask using python where there is ...
user avatar
0 votes
1 answer
204 views

Securing a Websocket Connection in case of XSS Vulnerability

Goal Authenticate the Client via HTTP Request. Authenticate the Client's WebSocket connection. Prevent exploitation of WebSocket connection(when a XSS Vulnerability is present on website). How I'm ...
user avatar
  • 3
0 votes
0 answers
84 views

Taking html, js, css input from the user

We are building a multitenancy web app with Laravel (+Blade), each user can create a store (tenancy), and have a control panel where they can edit the store settings and styling, to edit the store ...
user avatar
  • 101

1
2 3 4 5
29