Questions tagged [xss]

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

Filter by
Sorted by
Tagged with
0
votes
0answers
28 views

How can I change HTTP header parameters to test a website with automatic tools? [closed]

In order to access the login page of a webpage I have to add to the HTTP request header the following two parameters: X-Forwarded-For: 192.168.32.3 Change the user-agent field value Thus, for ...
0
votes
0answers
17 views

Open redirection (DOM-based) on ASP.NET 4.7 Web Forms

A scan with Burp Suite has reported a possible vulnerability on all the pages of my application, which is based on ASP.NET 4.7 WebForms. the issue is: The application may be vulnerable to DOM-based ...
-1
votes
1answer
60 views

Is it Possible XSS in <h1> tags without using “<” [closed]

In example website "<" character is filtered.Is it possible to find XSS in h1 XSS h1
0
votes
1answer
53 views

DOM-Based cross-site scripting on window.location.pathname

A scan with Burp has identified a DOM-Based cross-site scripting vulnerability. The only script with a sink is the following. Do you think it's a false positive? (Can I make it more secure in some ...
0
votes
0answers
28 views

Google Gruyere - Ajax Json Stored Xss

I was doing the google security challenges here: http://google-gruyere.appspot.com/part2 I don't understand the solution for the Ajax Stored Xss part. So here's the problem summarized: Every user ...
11
votes
4answers
3k views

JSON API response flagged as XSS by vulnerability scanner. Is this a false positive?

When a user attempts to access any URL without authentication (including a non-existent URL), my web service returns an HTTP 401 response. This response is JSON encoded, and the body of this response ...
6
votes
1answer
150 views

DOM Based XSS and Adding HTML Elements

So as a rule of thumb I once learned that adding or removing HTML with JavaScript/JQuery (.html(),.append(), etc) leaves yourself wide open for DOM Based XSS Attacks. It is now my understanding that ...
1
vote
1answer
50 views

IFrame Vulnerability Classification

I was participating in a bug bounty on a website we will call example.com, when I ran into a very strange edge case which I am not sure I should report. The website uses ads and tracking similar to ...
0
votes
0answers
59 views

SQL injection and XSS prevention

I would kindly ask you to review the following code and tell me if it's enough to prevent most of SQL injection and XSS attacks. SQL injection: treated via PDO prepared statements; XSS: All user's ...
1
vote
1answer
72 views

Possible to bypass this regex for XSS?

When testing for XSS, is it at all possible to bypass the below regex? I doubt it because it only accepts uppercase and lowercase letters, but maybe? /^[A-Za-z]+$/
0
votes
0answers
48 views

Ionic local storage store sensitive data for private app

I'm new to the ionic framework and have some basics of it and currently I'm developing a private app for my family only that store some sensitive information in the localstorage. I used some crypto ...
1
vote
1answer
34 views

Ways to exploit a form action value when it s reflected from URI on React-Django

I am working on a security testing project, where I have noticed that the form action of a login page takes whatever is fed to URI as a parameter, the respective part of the login page is as follows: ...
1
vote
0answers
21 views

performing authenticated scan for xss using selenium and xsstrike tool

I'm automating XSS security test, I automated XSS reflected and stored, now for automating XSS dom I'm required to use XSSStrike tool (https://github.com/s0md3v/XSStrike/wiki/Usage). Im using ...
0
votes
0answers
55 views

DOM XSS via JQuery function init()

Burp reported potential DOM XSS. Data is read from location and passed to the 'init()' function of JQuery via: var table = location['table'] || location['sysparm_table']; snPresence.init(table, ...
1
vote
0answers
36 views

Dom based Cross-Site Scripting (XSS) sources

Which are still relevant sources for Dom-based Cross-Site Scripting (XSS) in 2020? Had a list of those: document.URL, document.documentURI, document.location, location, location.href, location....
0
votes
0answers
31 views

Any way to XSS inside div, without angle brackets?

I am currently learning XSS exploitation and stumbled across this exercise : <td width="100%" valign="top" class="message"> <div> USER INPUT HERE </div> </td> ...
0
votes
0answers
36 views

Is XSS possible when using htmlspecialchars and https prefix check in href?

There is a standard XSS exploitation technique where one can use javascript keyword in <a href=""> to execute javascript code. Example: <a href="javascript:alert(42);">please clickme</...
0
votes
1answer
37 views

Is it possible to bypass escape() when document.getElementByName gets the value?

Say I have the following script var a = document.getElementById('in').value; escape(a); Is it possible to bypass the escape function to do some XSS? I have tried );alert(1); to no avail. I have ...
0
votes
1answer
42 views

XSS cookie Stealing with Character limitations

The rules also Include 1. No jQuery 2. Only through making an API AJAX request. 3.character limitation of 100 characters. Can any suggest me how I can build a payload sticking with these rules.
4
votes
3answers
132 views

Is non-executed content still considered XSS?

I'm working through an OWASP Zap report that has flagged several URLs on the domain as being vulnerable to XSS, but the vulnerability is never output in a context that is executable by the browser. ...
1
vote
1answer
87 views

Possible attack vectors for a web site scraper

I’ve written a little utility that, given a web site address, goes and gets some metadata from the site. My ultimate goal here is to use this inside a web site that allows users to enter a site, and ...
0
votes
0answers
16 views

How to bypass filter which blocks < charachter? [duplicate]

I am practicing reflected xss .I found a page in my lab which gives back the input in response of the request.But the application is sanitizing anything which comes after a < character because of ...
0
votes
1answer
75 views

How to bypass sanitization of < while exploiting an XSS vulnerability?

Whatever is to the right of < is being deleted if I don't have a following >, else everything in between < and > is being deleted. Is there a way to bypass this sanitization?
0
votes
0answers
46 views

Is document.write(window.location.hash.substr(1)) still exploitable for DOM XSS? [duplicate]

I stumbled upon Google's firing range for DOM XSS testing, and this case caught my eye: <script> var payload = window.location.hash.substr(1);document.write(payload); </script> As far ...
1
vote
1answer
44 views

How could an attacker exploit XSS in a cookie reflecting the URL?

In one of the recent penetrationtests I encountered an XSS vulnerability within a cookie. The situation is as follows. The webapplication uses the cookie to store the current URL. Once the user ...
0
votes
1answer
32 views

XSS on reflecting parameter

A website reflects the parameter I send, but the user input is accepted in the form of string. Hence whatever I search is reflected as <meta property="og:title" content="hello _userinput_ to xyz" ...
-1
votes
1answer
49 views

Multi Reflection XSS filter Bypass: Bypass this XSS filter and generate a popup

$input = $_GET['user_name']; echo(remove_xss($input)); remove_xss($input){ convert $input to lowercase remove all "script" remove all double and single quotes remove all img, iframe, onclick, body, ...
0
votes
1answer
51 views

WYSIWYG Rich text editor and renderer with no XSS risks

In our web app, we need to allow users to input rich text which is then presented to other users. We are looking for a simple WYSIWYG (JavaScript) editor that outputs a format which is backwards ...
0
votes
0answers
38 views

A mesh of Cookie in Header & HttpOnly token - secure “enough”?

This is another attempt of mine to make sense of securing my web-app, which is built with two frameworks: Django REST API - serves as the backend. It generates both a token upon correct login, and a ...
2
votes
1answer
57 views

How Create string in Java Script without single or double quote?

I participate in a CTF and I had to steal Admin's cookies. And quotes (single and double) were encoded. I needed to use document.location=URL for steal cookie, but I can't pass URL using quotes. So ...
2
votes
2answers
199 views

Any way to bypass this xss filter?

I'm wondering if there is a way to bypass this xss filter XSS Context: In a script tag What the filter does: lowercases the user input doesn't encode < > UNLESS </script is present (it ...
0
votes
1answer
78 views

“/> <script>alert('xss')</script> <br class=” doesn't reflect in input tag [closed]

I've my this webapp running on localhost. I've been trying to reflect XSS through this input tag but it's not working for some reason. could someone please tell how to have it reflected? the payload ...
3
votes
1answer
275 views

Effect of Script tag inside HTML comment

I recently participated in a CTF and solution of that CTF is based on this weird behavior of browser. In First case when I am including script tag inside an HTML comment and without closing that ...
1
vote
1answer
56 views

How to conduct XSS via message body or HTTP cookie?

I am reading Hackers Handbook and in one chapter it says: "Parameters submitted within the URL query string, message body, and HTTP cookies, are the most obvious entry points..." I understand that ...
0
votes
1answer
69 views

Triggering an XSS through a shortened URL?

I have this piece of HTML: <img src="image src" alt="{injectable}" title="{injectable}" border="0"> where {injectable} values correspond to the same input value that has to be 32 characters ...
2
votes
1answer
149 views

Reflected XSS in a JavaScript URL with some characters blocked

I am new to the field of Web Security and am practising labs from Portswigger Web Security Academy. In this lab, we have to call the alert function with 1337 as the parameter. The solution given on ...
2
votes
1answer
106 views

XSS payload explanation with x:x/

I am trying to understand exactly how JavaScript XSS (cross-site scripting) payloads found across the internet work and I would like your help for the following: <img src=`xx:xx`onerror=alert(1)&...
0
votes
1answer
215 views

DOM based XSS using window.location.hash

Target code: if($(location.href.split("#")[1])) { var target = $('#'+location.href.split("#")[1]); if (target.length) { $('html,body').animate({ scrollTop: target.offset().top - 160 //...
0
votes
0answers
27 views

Equivalent of .NET Framework WebForms ValidateRequest

Microsoft's .NET webforms seems to have a lead in developer convenience ensuring by default, the application is palpably protected against XSS with its ValidateRequest feature. Although developers ...
1
vote
2answers
103 views

Validating XSS Vulnerability in Rest API

I am performing security testing on a Rest API and it is a POST method. I injected a XSS script in a body parameter and the API responded with '400 Bad Request' error, but the response displays the ...
0
votes
1answer
187 views

There seems to have been an attempt to attack my website [duplicate]

I am using PHP as a server side language. And I don't use CMS or Framework. From the nginx log the website attack seems obvious. I wonder what kind of attack the attacker attempted. The attacker ...
0
votes
0answers
78 views

Bypass XSS in script tag

<script type="text/javascript"> window.RPM = {"debug":false,"env":"user input"} </script> user input can be inputted with xss payload. Filter is doing following replaces: i) " with \" ...
3
votes
1answer
94 views

Making SQL/HTML Injection attacks programmatically impossible

Apparently having 100% prevention of SQL Injection and XSS attacks is easier said than done, but why? Can't static code analysis tools ensure that all user supplied input vectors (including user ...
1
vote
0answers
73 views

XSS / SQL Injection Attacks with Character Encoding Mixups

Are there any character encoding mixup attacks that are still a threat in 2020? Such as with XSS or SQL injection being the most obvious. Some examples: Tricking a browser to display a page in UTF-...
0
votes
1answer
67 views

XSS via unsanitized window.location.search.split?

I'm trying to protect my code from XSS. I used a tool to identify risks and it alerted the following code part as a possible injection case. var urlParams = new URLSearchParams(window.location.search)...
0
votes
1answer
100 views

Why would an attacker use eval as part of a payload?

Now don't get me wrong, there are already other questions like this. But I'm looking into more of how an attack could actually be done. Instance A: A hacker gains access to a web server / hosting. ...
1
vote
1answer
115 views

XSS filter bypass &lt and/or <

On a homepage I can inject HTML-text in the URL. After som T-and-E I was able to send in this thing; ?type=<script<script>>alert(1)</script<script>> Which gave me a homepage ...
2
votes
1answer
94 views

How to safely display html emails?

I'm building a webmail application using php at the moment. I'm getting the email content from gmail using Imap and wanted to display the email as close as I can to how gmail shows it. Is it safe to ...
0
votes
0answers
63 views

Why CSP vs XSS?

I understand CSP can be beneficial against multiple attack vectors (i.e clickjacking, XSS), but as it specifically relates to XSS -- why is it a solution? My reason for asking this question stems ...
2
votes
2answers
200 views

Is 'looking for all XSS in my code' a solved computer science problem?

I have a fundamental theory question. Is looking for cross-site scripting a solved computer science problem? Or is it an open problem? Does it approximate the halting problem, injection problem or ...

1
2 3 4 5
26