Questions tagged [xss]

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

Filter by
Sorted by
Tagged with
0 votes
3 answers
76 views

What XSS attacks could somebody perform through an iframe?

If a potential attacker was able to upload a cross-origin <iframe> element to your website as a post of some sort, what could they actually do through it? I know that cross-origin <iframe> ...
1 vote
1 answer
23 views

Can the value attribute of input tag be a DOM-XSS sink?

Can at this code the input.value be a Dom-XSS sink? let qs=new urlsearch(location.search); let paramValue=qs.param; let input=document.getElementByID('inputField'); input.value=paramValue; I tried ...
0 votes
1 answer
50 views

XSS in href attribute

I'm currently pentesting a website where I can set a URL on my profile. I'm trying to get an XSS to fire, but my javascript knowledge is a bit limited for this use case: Imagine this is your ...
  • 50
1 vote
1 answer
95 views

Is this code code vulnerable to XSS?

I have a function that accepts the param url and passes it to exec() function getQueryValue(url, name) { name = name.replace(/[\[]/, "\\[").replace(/[\]]/, "\\]"); var ...
  • 135
0 votes
1 answer
46 views

Reflected DOM XSS Portswigger Lab

I'm a total beginner and im trying to solve Portswigger Academy labs. I'm studying on XSS right now and im stuck in somewhere. Lab Details:This lab demonstrates a reflected DOM vulnerability. ...
0 votes
1 answer
42 views

Can you have an <iframe> tag with no spaces?

I am looking to figure out how to create an iFrame tag without any spaces. I have found an input on a Bug Bounty program that reflects my input back into the page, and allows me to escape double ...
  • 50
0 votes
1 answer
55 views

XSS payload to Send request to server without closing tag

I was testing a website which does not have XSS in their scope. So I thought it would be a good idea to escalate XSS to a bug which is valid. I need to make a request to my server but the problem is ...
1 vote
2 answers
83 views

Difference Between Reflected XSS and Reflected-DOM XSS

What's the difference between Reflected XSS (RXSS) and Reflected-DOM XSS (RDOMXSS)? After some research, I think it can be concluded that Reflected-DOM XSS is: Similarities: The value is reflected by ...
0 votes
0 answers
30 views

Bypass XSS filter in data- attribute

My web application allows users to make custom divs with whitelisted attributes. One of them is data-{user-input}. Recently I have seen the following XSS payload: [[div data-test/onmouseover=alert(1)]]...
0 votes
1 answer
99 views

"One of your code blocks includes unescaped HTML." JS console security warning

I operate a blog using Google's Blogger platform about programming. I use highlight.js for syntax highlighting, and now on my posts I see the console warning: One of your code blocks includes ...
0 votes
0 answers
43 views

Accidentally locked an XSS vulnerable input

On https://ais.osym.gov.tr/ I saw an XSS vulnerable input. I tried some payloads without malicious intent which only contained alerts or console logs. The code img \x00src=x onerror=alert(1) worked. ...
2 votes
1 answer
87 views

Can I visit a malicious website by using Tor with settings set to safest or by using NoScript on an ordinary browser with settings set to untrusted?

Can I visit a malicious website by using Tor with settings set to safest or by using NoScript on an ordinary browser with settings set to untrusted? If not then is there any way to visit a malicious ...
1 vote
0 answers
163 views

Checkmarx Client DOM XSS Violation in ReachJS

I have this message from Checkmarx: The application's = embeds untrusted data in the generated output with location, at line 19 of ****.js. This untrusted data is embedded straight into the output ...
  • 111
1 vote
2 answers
76 views

Reflected XSS found in web application via POST request with JSON body. Is this issue exploitable?

I was testing an application recently and i came across with a Reflected XSS vulnerability via HTTP POST Request with JSON body. Although this condition can't be exploitable from his own, due respond'...
  • 15
1 vote
1 answer
86 views

Risk of injecting a malicious script/code?

I was was inspecting elements in a website and I randomly stumbled onto this piece of code . </style><meta name="add-styles-here"/><meta name="add-scripts-here"/>&...
-1 votes
1 answer
83 views

Is there any way to bypass javascript comment filtering (XSS)

So I am testing an application and I almost got an XSS vulnerability but only if I can comment on the rest of the code. e.g. Originally this is how the target returns the user-entered input: I've ...
1 vote
0 answers
48 views

Need for URL encoding in XSS / CORS lab

I am doing one of Portswigger's labs on web security, specifically CORS (cross origin resource sharing). I am having trouble understanding why there is a need for URL encoding certain parts of the XSS ...
  • 11
0 votes
1 answer
58 views

Is it possible to get xss in json body request?

I was doing a VAPT assessment in which I see some JSON body in the request which has orgid deviceid So there any possibility to get XSS in json body?
3 votes
1 answer
355 views

Can a plain text email contain XSS injection?

I need to send a plain text email with user-specified input. For example, if a user is an attacker a plain text email can contain <script>alert(1)</script> It looks like mail clients ...
  • 33
0 votes
2 answers
56 views

Parameter vulnerable for HTML injection but cannot exploit because of URL encoding

I found a HTML injection vulnerability but there is an issue. The following request returns the following: curl "https://redacted.com/xss/para?meter="><h1>Test\</h1>"<...
  • 1
0 votes
1 answer
50 views

How does this PortSwigger lab's XSS work?

I was doing the following PortSwigger Lab on cross site scripting (XSS). The following payload works perfectly. http://foo?&apos;-alert(1)-&apos; Which is input into the following section of ...
1 vote
1 answer
102 views

Can BeEF also work in public?

Is it possible to run the tool called BeEF to do penetration testing on real domains like example.com? As far as I know, BeEF can only be used within localhost. I can only test my site for XSS on the ...
0 votes
1 answer
166 views

XSS against jQuery PortSwigger challenge

I am trying to do this jQuery XSS challenge here by PortSwigger. They have a good walkthrough for XSS attacks, however I could not find anything on jQuery, which is also a programming language I have ...
0 votes
1 answer
60 views

Is this SQLi or XSS? (or both/neither)

I'm trying to get the hang of SQLi and XSS, and I am starting to get the hang of it. However: in my lab I made this: ignore'"; UPDATE users SET name=<script>alert('Malicious activity')</...
0 votes
1 answer
251 views

Bypass double quotes " transformed to &quot;

I'm having a hard time bypassing &quot; I tried every payload but nothing happened. The payload is "><img src="data:xxx1" style='aaa: '\"/onerror=alert(1)//'' /> But ...
3 votes
1 answer
140 views

Security Headers: Access-Control-Allow-Origin vs. Cross-Origin-Resource-Policy (CORP)

Can someone explain the difference between the Access-Control-Allow-Origin header and the Cross-Origin-Resource-Policy header? According to MDN: The Access-Control-Allow-Origin response header ...
  • 31
1 vote
1 answer
2k views

XSS: window.location.href and window.open

I'm working through all issues that the static security analysis tool Fortify found in our internal Angular application. There is one particular issue I'm not confident of how to work with. Please see ...
  • 125
0 votes
0 answers
26 views

How to turn a relative path script (js) import to an absolue one with a url for XSS ? (more details below)

I have a parameter whose value is injected in the HTML as the following <script src="/dir1/dir2/dir3/dir4/INJECT_HERE"> </script> I was able to traverse back to just / but when ...
0 votes
1 answer
118 views

How does this break out of a javascript tag? [closed]

How does putting the alert function '-alert(1)-' into a search field, where it ends up inside a script tag actually break out of the script string? Wouldn't this just be interpreted as an empty string ...
0 votes
0 answers
36 views

What are vulnerabilities of saving user input directly in wordpress plugin?

I have a WordPress plugin that helps create an organization chart/tree and then generates a URL where the chart is available to be viewed by the public. The plugin dashboard looks like this the plugin ...
0 votes
2 answers
78 views

What are the vulnerabilities of exposing url end point param?

I have a wordpress plugin that helps create an organization chart/tree and then generates a URL where the chart is available to be viewed by the public? Inside the plugin's view in WordPress dashboard....
1 vote
1 answer
97 views

Why is this XSS not working on my site?

I'm attempting to make a site with an example of what XSS would look like, so in this I take user input and set a paragraph element's innerHTML to the user input but the script isn't running. However ...
  • 13
0 votes
1 answer
36 views

HTML Injection into custom sanitiser

I found a curious website that shows listings. It allows you to type a description, and also allows for you to use tags like <b> and <u> for formatting. But it doesn't let you do more ...
  • 101
0 votes
0 answers
15 views

Threat Assessment Javascript User-controlled Variable Names on Window

I have a requirement to support some external integration to a 3rd party vendor on our site (which is a SaaS site with multiple tenant logins). The vendor requires a script and a global variable to be ...
0 votes
1 answer
84 views

IP address in access.log is incorrect and likely hacked

I just noticed in my access.log several POST requests coming from a (hidden) registration sub page that is not accessible via any link. A 'hacker' seems to have posted a form from there (manually it ...
  • 103
0 votes
0 answers
218 views

XSS - Anyway to bypass double quotes in href of anchor?

I have an anchor that has href attribute populated by my input. I am trying to input javascript, but it always renders it useless since it always appears between double quotes. So far, I have tried ...
0 votes
0 answers
54 views

Headers X-XSS-Protection issue

I want to clear my doubt that Is there any issues coming from adding 'Strict-Transport-Security' and 'X-XSS-Protection' headers ? Header set Strict-Transport-Security "max-age=10886400; Header ...
2 votes
1 answer
71 views

Is PHP json_encode sufficient for HTML data blocks?

I want to access data in a PHP variable from JavaScript code. An (old) OWASP cheat sheet recommends embedding it in HTML before accessing it, an approach like this: <div id="init_data" ...
0 votes
0 answers
127 views

Security implications of access and refresh tokens (JWT) with refresh token rotation and automatic reuse detection

In an effort to avoid having to deal with CSRF attacks, I'm trying to implement an auth flow that completely avoids using cookies. In most cases this makes one vulnerable to XSS attacks. However, ...
  • 101
1 vote
1 answer
42 views

Is there a consensus on whether HTML encoding should happen upon upload or retrieval/display for defense against stored XSS?

The common thing to do in defense against XSS, stored or not, is to HTML-encode the payload. Encoding upon the upload/POST of the data is efficient for processing power and neutralizes it early to be ...
0 votes
0 answers
113 views

Mitigating CSRF and XSS with JWT authentication: can someone tell me where my logic is wrong

I'm currently working on a personal project including a RESTful API and also trying to understand how to make it as secure as possible. I have read a bit about JWT, the possible vulnerabilities as ...
0 votes
1 answer
75 views

Is this safe from XSS?

I need to allow a user to pass unsafe text into an iframe URL: <iframe src="https://example.com?foo=INPUT"></iframe> Inside the iFrame render code, I have this: <!doctype ...
  • 105
0 votes
1 answer
75 views

How do double quotes and angle bracket work in this scenario?

Question about a solution in portswigger academy (since portswigger explains nothing and I can't find any info elsewhere on this): Break out of the img attribute by searching for: Here is the img ...
0 votes
0 answers
31 views

setAttributeNS XSS Vulnerability

Im fixing some security issues that AppScan found on my Angular Application, one of them is the insecure use of "setAttributeNS()" I use this method in my application to inject some ...
0 votes
1 answer
48 views

DCP-Portal Vulnerability

This vulnerability is from a third party reviewer for PCI scans. I am stuck for months and can't figure this out. I already used sanitation to my page and it still fail the PCI scanning. I am starting ...
0 votes
0 answers
67 views

Failed to inject payload with Python requests library in DVWA forms

I have written a Python script to inject a payload through the requests library, but the payload is being added instead of injecting xsstestscript=html.unescape("&lt;script&gt;alert&#...
  • 1
1 vote
0 answers
299 views

XSS Payload Cookie Stealing

I have been playing around with the DVWA stored XSS page and wondered if someone could help. I used XSS Validator in Burp and found numerous payloads that give a prompt, indicating that XSS is present....
  • 11
0 votes
1 answer
166 views

JSON Web Token splitting

It's been quite a few years since the last time I did web development and I realized many things have changed: instead of stateful server-side sessions with authentication cookies and CSRF tokens now ...
0 votes
1 answer
182 views

XSS attack not executing with correct payload

Hello I was testing on a private program where I was able to inject XSS but for some reason it is not popping up when I put the mouse over the input field. <input type="text" onmouseover=&...
1 vote
0 answers
157 views

CSRF and XSS Protection with a Static Site and REST API

I'm building an application which will support both browser and application access to REST resources. Applications will POST a username/password JSON body to a login endpoint which will return a ...
  • 6,715

1
2 3 4 5
30