Questions tagged [xss]

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

Filter by
Sorted by
Tagged with
0
votes
1answer
18 views

JSON Web Token splitting

It's been quite a few years since the last time I did web development and I realized many things have changed: instead of stateful server-side sessions with authentication cookies and CSRF tokens now ...
0
votes
1answer
44 views

XSS attack not executing with correct payload

Hello I was testing on a private program where I was able to inject XSS but for some reason it is not popping up when I put the mouse over the input field. <input type="text" onmouseover=&...
0
votes
0answers
29 views

CSRF and XSS Protection with a Static Site and REST API

I'm building an application which will support both browser and application access to REST resources. Applications will POST a username/password JSON body to a login endpoint which will return a ...
2
votes
1answer
104 views

Can XSS ever occur in an <img> tag's "src" attribute?

In a scenario where an attacker has control over the src attribute of an img HTML tag, they could easily inject a simple JavaScript XSS payload like the following: <img src="javascript:alert(1)...
2
votes
1answer
135 views

Is this server side object vulnerable to XSS?

I have an object that is stored in the server side of the application. It is never inserted into the DOM. The object looks like this: {"id": "34245425", "field": false, &...
0
votes
2answers
58 views

How is Object Tag data URI XSS actually XSS?

I have been looking into XSS pertaining to base64 encoding a data URI into an <object> tag (which is typically considered only a feasible XSS payload in Firefox), but I am failing to understand ...
0
votes
1answer
63 views

JWT cookie with CSRF token as a claim inside the JWT

I am trying to figure out if the solution I am suggesting is valid for both XSS & CSRF protection, I would like to store the JWT in an httpOnly & secure cookie and not in local storage, when ...
0
votes
1answer
54 views

How do I test for Reflected XSS in webpage titles, url parameters and javascript variables?

I have a java web app. I'm using OWASP Java Encoder to encode for html, javascript and url components to mitigate reflected XSS. I'm new to this so I'm not sure on how to test on my web app for the ...
0
votes
1answer
41 views

How to test an Angular SPA for DOM XSS with OWASP ZAP?

I want to test an Angular SPA for any DOM-based XSS. How do I do that with OWASP ZAP?
1
vote
1answer
55 views

How to implement the CSRF token mechanism for restful APIs?

Considering the following facts, using CSRF token for a restful API (which of course is intrisincly session-less) seems inevitable: storing JWT in local storage(any where other than http-only cookie) ...
0
votes
1answer
77 views

HTML Option Tag XSS

Is it possible to inject javascript inside of an HTML option tag? For example, say you have the following html: <select> <option MALISCIOUS_CODE_HERE>Option Description</option> &...
0
votes
1answer
101 views

Detecting XSS when Payload is only Triggered on Another Page

I am trying to detect the presence of a blind/stored XSS vulnerability of an input field. The vulnerability does not trigger on page 'A' where the payload is injected. It is likely due to the fact ...
1
vote
2answers
127 views

Bypass WAF to perform XSS?

I am trying to find an XSS in website protected by Cloudflare. I use Burp to find which HTML tags allowed. Only the <script/> is tag disallowed. I tested multiple payloads to pass the WAF and ...
0
votes
1answer
98 views

Could this code be vulnerable to XSS?

It seems like exploiting XSS is becoming harder with every browser version update. My question is: Is this code vulnerable to XSS? <script type="text/javascript"> var url = ...
0
votes
1answer
81 views

What can attacker do with OpenID Connect id_token?

I have an application that stores the id_token in the localStorage of the browser. Since there is no CSP and Web Storage does not have the same protections such as cookies (HttpOnly, SameSite) this &...
0
votes
2answers
119 views

XSS payloads getting filtered but HTML tags are getting rendered. Can we exploit this? [duplicate]

I was trying to test a potential XSS vulnerability on a website. On the search bar I can see the filtering process happening i.e if I type script> (not with starting <) I can see the same in the ...
2
votes
1answer
1k views

Is <plaintext> vulnerable to XSS

I have a question regarding the element. I know that this element has been deprecated for a long time, but during a penetration test, we inserted the following attack vector into a textarea: <...
0
votes
1answer
304 views

XSS in <span> where only < and > are encoded

When im doing a penitent, I noticed the application takes the user input and put it in a tag. When I used the string of '';!--"<XSS>=&{()}, I noticed the returned output (when viewing ...
0
votes
3answers
254 views

Does SOP prevent a class of CSRF attacks?

Just want to settle a debate I'm having with someone. Suppose there is no SOP. Via an XSS exploit, code can run on website A.com and submit an XHR request to B.com. Suppose B.com stores an auth token ...
2
votes
1answer
189 views

XSS inside of a javascript string, with unusual filter

While making a website I made an interesting mistake, and I'm wondering if this could be used to achieve XSS. I've come very close, but not quite. I can put my user input into a string inside of a <...
0
votes
2answers
96 views

abiliity to change elements in HubSpot iFrame forms

I recently started working on adding custom code to HubSpot forms after their form is loaded via an iFrame. Initially, I was using the following code to access the iFrame to change it: var form = ...
0
votes
1answer
130 views

XSS Triggers only when pasted in

I have a XSS case that I would like to exploit as a proof of concept, however the payload seems to only be triggering when pasted in and not from the URL. Basically, I have a search box which when ...
0
votes
1answer
253 views

How to bypass an XSS filter encoding single quotes? [duplicate]

I'm trying to do an XSS attack test on a website. I am using " and <> just fine and I have managed to escape the string. Now I'm trying to send my own cookie to my server that saves it to a ...
6
votes
1answer
697 views

Passing a C# object to Javascript in ASP.NET MVC

Several answers on StackOverflow suggest that a C# object can be passed to JavaScript in ASP.NET MVC by the following: <script type="text/javascript"> var obj = @Html.Raw(Json....
11
votes
2answers
3k views

How do I safely host third-party Javascript code in an iframe?

I'm building a website where users, among other things, can add embeds (YouTube, Google Forms, Airtable...) and show those embeds to other people. Embeds are snippets of HTML that can include <...
0
votes
0answers
199 views

Stored XSS cookie stealing, but a loop of redirection

I found a stored xss vulnerability on a comment section of a fun site and I wanted to steal cookies using xss attack. So on my remote server I run an HTTP server with Flask using python where there is ...
0
votes
1answer
138 views

Securing a Websocket Connection in case of XSS Vulnerability

Goal Authenticate the Client via HTTP Request. Authenticate the Client's WebSocket connection. Prevent exploitation of WebSocket connection(when a XSS Vulnerability is present on website). How I'm ...
0
votes
0answers
77 views

Taking html, js, css input from the user

We are building a multitenancy web app with Laravel (+Blade), each user can create a store (tenancy), and have a control panel where they can edit the store settings and styling, to edit the store ...
0
votes
1answer
161 views

Flask XSS prevention

I'm trying to fix a possible XSS vulnerability in WebApp (Flask) and I'm not sure what is the best way to prevent XSS without breaking functionality. For example, I have the following code block: ... ...
0
votes
0answers
109 views

Exploit an XSS without <> and valid encoding

I'm making a web penetration test, so I trying to exploit a XSS, I've looked that if I use a payload like the following: <script>alert(document.domain)</script> The output in the page ...
0
votes
1answer
117 views

Is it still XSS if it requires user input?

I have a web app which displays what I enter in an <input> field back as HTML, but it happens all client-side in the DOM after manual input, so it can't be made into a URL which causes a payload ...
4
votes
1answer
292 views

Is it better to disable X-XSS-Protection header or set the header as X-XSS-Protection: 0?

Because X-XSS-Protection header is now not supported by major browsers I wonder what option is better, to delete this header or to set the header as X-XSS-Protection: 0? Because browsers do not ...
0
votes
0answers
96 views

How to reliably detect Browser Exploitation Attacks with BeEF and other JavaScript hooking packages?

"Unlike other security frameworks, BeEF looks past the hardened network perimeter and client system, and examines exploitability within the context of the one open door: the web browser. BeEF ...
0
votes
2answers
902 views

read etc/passwd using XSS

by trying the XSS room on THM, I try was trying to read the /etc/passwd using the following cmd: <iframe src="/etc/passwd"></iframe> However what I got is an error code as shown ...
1
vote
0answers
85 views

Does this qualify as Filename Upload DOM-XSS?

An application has the following javascript code which is triggered whenever an user tries to upload a file. a.html(fileName) then if the user uploads a file named <img src=x onerror=alert()> ...
1
vote
0answers
425 views

NodeJS, unrestricted file upload, RCE [closed]

I'm testing on application which runs on NodeJS, and discovered unrestriced file upload vulnerability, path traversal is not possible. Uploaded file is visitable, I can upload .html to perform XSS ...
0
votes
2answers
466 views

Prevent URL encoding on form submit

During an engagement, I found a potential XSS vulnerability on a page. There is an HTML form that is submitted to this page (POST method) and sent parameters are reflected (without encoding) in the ...
0
votes
1answer
85 views

is XSS in Content-Disposition possible?

There is a web application that can upload HTML files and also download the uploaded file. When I upload an HTML file containing the script tag and download it, the response is as follows. HTTP/1.1 ...
-1
votes
1answer
92 views

XSS Inside the text part of an <a> tag [closed]

How do I xss inside <a href="https://gooogle.com">here</a> ? I have tried normally using alert() but it didn't work
0
votes
0answers
104 views

Security issues in xhr DOM update

I'm writing a javascript code that update DOM with html/javascript from XMLlHttpRequest response (A sort of JQuery's $.load() function), depending on some client side condition (e.g. which browser ...
0
votes
0answers
73 views

DOM-based XSS example doesn't work

Google have written up a great explanation of XSS attacks with 3 interactive demos: https://www.google.co.uk/about/appsecurity/learning/xss/ If I follow the instructions, I can see a JavaScript alert ...
0
votes
1answer
101 views

DOM-based XSS - via URL

I have a website that I am testing but I am pretty new to all of this security stuff and would appreciate some help!. I have a url similar to the following: http://testurl?nexturl=whatever The ...
0
votes
1answer
177 views

Is it possible to bypass this csp?

Today I created a web application. I'm using this csp to avoid xss attacks. CSP: Content-Security-Policy", `child-src 'none'; connect-src 'none'; default-src 'none'; font-src 'none'; frame-src '...
1
vote
2answers
609 views

How do I bypass a regex filter that filters all html to avoid xss?

How do I bypass a regex filter that filters all html to avoid xss? I've tried using things like &lt;img src="aa" onerror="alert(1)"&gt; but still no luck. This is for a CTF ...
0
votes
1answer
342 views

srcdoc attribute of iframes as a source of XSS attacks

I am trying to implement a case where a user provides us some html code which is then stored in our database. We then retrieve the HTML from our database as a string. (We have no control over the user ...
0
votes
2answers
148 views

Is this potential XSS exploitable?

I am pentesting a website and I found that I can inject code at value="" <input type="text" id="search_1" name="keyword" placeholder="Search by keyword&...
0
votes
0answers
77 views

Injection inside double quoted section of script element

For a test to find vulnerabilities I found the following code in a page and I am looking for ways to manipulate it: <script> func({ "key1": "value", "...
1
vote
0answers
112 views

Attack on a string created by a developer

Go and Java have "compile time constants", and JavaScript will soon get a feature that allows "Distinguishing strings from a trusted developer from strings that may be attacker ...
0
votes
0answers
83 views

Is it a good and safe to recommend programmers that APIs always encode '<' in JSON payloads to '\u003c' to prevent XSS?

I know that there are other recommendations like correctly encoding the JSON payload and using the correct content-type, however, my colleagues insist in that this is an additional good recommendation....
6
votes
2answers
822 views

Content Security Policy https: and data: meaning

I am having trouble finding information on the implications of using https: and data: as a source for the directives in a CSP. Example: img-src 'self' https: data:; Could someone some context around ...

1
2 3 4 5
29