Questions tagged [xss]
Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).
1,496
questions
0
votes
1
answer
27
views
XSS bypass in url
I have a website: https://bugbounty.com/test/"injection inside js", but " is escaped with \ and I'm trying to inject </script><script>alert() but https://bugbounty.com/test/&...
1
vote
2
answers
60
views
xss: is it possible to continue javascript code execution after a "throw new Error()" line?
there is this javascript file that a can inject code after throw new Error("error string") line. But it seems that after the throw statement, no code can be executed.
throw new Error("...
- 13
1
vote
1
answer
75
views
How is a XSS attack possible in this context?
I'm testing a website, which is vulnerable to XSS.
<input type="hidden" id="referer" name="referer" value="INJECTION_POINT">
<script>
document....
- 11
1
vote
0
answers
18
views
force XSS after bypassing Request.Form using URL Encoding
I am testing a cross-site scripting attack on a website, as we all know the Request.Form function validates the input so the user couldn't insert a <script> inside the input.
My focus in this ...
- 11
0
votes
0
answers
29
views
Is storing access token in private data, refresh token in http-only cookie safe?
Backend: Django / Django Rest Framework, would be hosted at GCP k8s
Frontend: Angular, would be hosted at some CDN e.g Vercel
Authentication: JWT (https://github.com/jazzband/djangorestframework-...
1
vote
0
answers
30
views
Understanding browser text input value rendering for combatting XSS
If you use inspect in the developer tools for Chrome the values for the two input boxes below will look the same.
<input name="test1" type="text" value="<script>alert(...
- 111
1
vote
1
answer
52
views
How to alert cookie in 30 character XSS payload?
The application allows user to enter a 30 character long username.
I tried the following XSS payload and it worked, but the triager is asking if I can alert cookie. But script tags and src keyword is ...
- 11
0
votes
1
answer
19
views
Validating XSS script with success response with expected data in REST API
I am performing security testing on a REST API and it is a POST method. I injected an XSS script in a body parameter and the API responded with '200 success' response with the actual expected data.
If ...
- 1
1
vote
2
answers
114
views
What exactly are Hidden HTTP Parameters?
I read a lot of reports where 'hackers' potentially exploited a 'Hidden HTTP Parameter'. There are also tons of tools which are developed for this exact purpose.
Example : https://blog.yeswehack.com/...
- 41
0
votes
1
answer
55
views
What are the risks of XSS in this forms?
I recently developed a website that was operational for me ^^
However, someone came to try injections and found an XSS flaw.
I have a form like this:
<h2>
<span>Search</span>
</...
- 1
0
votes
0
answers
55
views
CSP for Single Page App: Use client-side nonce for securing iframe content
Goal I'd like to tighten my Content Security Policy.
Situation
I have a single page react application (= All code and styles are bundled together into a bundle.js file). The file is simply placed on a ...
- 101
0
votes
0
answers
44
views
XSS payload with html Encoding
I was reading about XSS Contexts on Portswigger and it has a section about the use of HTML-Encoding in bypassing input validation.
What i understand is :
The browser html decodes the entities before ...
0
votes
1
answer
54
views
Why do you think this code isn't firing?
I don't have a lot of knowledge about xss so im kinda confused, why this is not popping up an alert box?
- 1
0
votes
0
answers
25
views
I clicked what looked like an Amazon email, but it (maybe) was from an Amazon affiliate. Ended up at Amazon.com anyway. Can I safely investigate? [duplicate]
In a case of clicking too fast, I clicked on a picture that looked like it was from Amazon. However this was not the case. I did end up at Amazon, but I'm aware that other things could've taken place ...
- 1
0
votes
1
answer
49
views
How do browsers defend the user against XSS?
I'm learning about the different mitigations employed by browsers against XSS vulnerabilities.
Let's say, the developer made a mistake and there is a XSS vulnerability on a site. Unfortunately, a ...
- 1
0
votes
1
answer
61
views
Jsoup XSS attack with URL encoded input
I'm having a Spring Web Application that exposes REST APIs.
I have implemented XSS filter using Jsoup that strips the input using Safelist.NONE.
The penetration testing team raised a concern where the ...
- 103
1
vote
0
answers
31
views
Storing auth token in html
Current projects webs application utilises a cookie based approach to store users auth token. Implemented with secure and http-only attributes set. All traffic over https. The application loads third ...
- 11
1
vote
0
answers
97
views
Client-side Javascript injection by assinging the output of window.location.href.substr to a variable
Sample code:
function winLoad() {
var sessionId = '';
if (window.location == window.top.location) {
var semicolonIndex = window.location.href.indexOf(';');
if (semicolonIndex !=...
- 11
2
votes
1
answer
60
views
Can I use a ServiceWorker to prevent an XSS attacker from gaining access to private user data?
I run a small blogging platform, and I want my users to be able to embed javascript that runs on their blogs (to manipulate the DOM, etc. as you might if you were hosting your own website). However, I ...
- 125
0
votes
1
answer
134
views
Vulnerabilities in img src
It is known that in modern browsers you can't run XSS in img src(assuming quotes are escaped), because neither javascript: protocol, nor svg will execute the code. But does it mean that trusted data ...
3
votes
2
answers
230
views
Can someone bypass this XSS filter
During our Red/Blue team practice my friend made a web forum application where people can post messages.
What he did was filtering:
The equal sign
The key words: "javascript", "alert&...
- 51
0
votes
1
answer
65
views
XSS in location.hash.match() function
I was solving a CTF. Just reading the source code of the web page, I found a vulnerable piece of code:
var r4c='(.*?)';
var results = location.hash.match('token\\('+r4c+'\\);');
I am unable to ...
0
votes
0
answers
52
views
Adding a script tag after the html closing tag
I am still a beginner in web vulnerability. While I was browsing on the internet I saw a challenge inspired by a real life security crisis. We are given a pcap of a malware infection that was done in ...
0
votes
1
answer
55
views
How secure is using https://*.domain.com as a value in a Content Security Policy?
Let's say I am an organization with all my resources on example.com. I have a web server in the DMZ that hosts a website named app.example.com open to the internet.
The CSP for that website is Content-...
- 1
0
votes
2
answers
90
views
Check for special characters in request parameters
Our system is accepting requests including special characters, see parameter2.
Request [
{
"reqHeader": {
"parameter1": "abc",
"...
- 111
0
votes
2
answers
88
views
AES Encryption as XSS protection for url parameters?
So, I found a website that uses AES encryption to prevent XSS and I'm wondering if this approach is inherently flawed.
It has an endpoint like execute.php?code=encryptedPayload which de-crypts the ...
- 148
2
votes
1
answer
94
views
Should I worry about excessive data forgery from my users on Firebase?
I'm getting familiar with Firebase and the firestore database.
I have a small project relying on a certain data format. It is a simple React project with direct connexion to its firestore, so no back-...
- 23
2
votes
2
answers
113
views
What could go wrong with this inlined javascript variable initialization in ASP
I am currently reviewing an ASP application where this javascript initialization is used all over the place:
const someValue = "<% get_some_value() %>";
And this pattern is actually ...
0
votes
0
answers
20
views
How to turn this particular HTML rendering into a XSS or open redirection
I am performing penetration testing on a web application. Let's say the site as "https://example.com"
There is a comment field , where a user can add data and it will be shown in the same ...
- 343
1
vote
0
answers
72
views
What are the ways in which XSS can be done in innerHTML
Server has blacklisted <img> and <a> tags in input.
Server does:
var myvar = url.searchParams.get('query'))
document.getElementById("id").innerHTML = myvar
<img> and <a&...
- 111
1
vote
0
answers
122
views
Possible window.location.hash DOM XSS
I've recently gotten into web security and javascript and I think this looks like apretty promising DOM XSS:
let hastagIntentos = 0
, posAnterior = 0
, reintentosHatagPos = 0;
function ...
- 11
2
votes
1
answer
69
views
Should I call a vulnerability XSS even though it is blocked by the CSP?
Let's say the Content Security Policy looks like this:
Content-Security-Policy: default-src 'self';
It's also not possible to upload JS files on the same origin.
Now there's an exploit to write ...
- 23
1
vote
2
answers
440
views
String in JSON message body blocked by Azure WAF with OWASP 3.1 returning 403
Details
I have an application running behind an Azure Web Application Firewall (WAF) on an Azure Application Gateway (AppGW) that was previously on an on-premises server. Since moving it to Azure, ...
- 113
0
votes
0
answers
31
views
XSS reflected in a parameter via POST (Body)
In the last few days, I received a challenge. This challenge was based on an XSS vulnerability reflected in a website.
When the site makes a certain request via POST, in the body there is a parameter ...
0
votes
0
answers
31
views
XSS by methods of ASCII on servers other than Apache Tomcat
I know that Apache Tomcat can communicate with US_ASCII encoding, which gives an interesting vector to XSS, such as:
¼script¾alert(¢XSS¢)¼/script¾
Is there a request syntax that would make other ...
0
votes
3
answers
263
views
What XSS attacks could somebody perform through an iframe?
If a potential attacker was able to upload a cross-origin <iframe> element to your website as a post of some sort, what could they actually do through it? I know that cross-origin <iframe> ...
- 113
2
votes
1
answer
161
views
Can the value attribute of input tag be a DOM-XSS sink?
Can at this code the input.value be a Dom-XSS sink?
let qs=new urlsearch(location.search);
let paramValue=qs.param;
let input=document.getElementByID('inputField');
input.value=paramValue;
I tried ...
0
votes
1
answer
263
views
XSS in href attribute
I'm currently pentesting a website where I can set a URL on my profile.
I'm trying to get an XSS to fire, but my javascript knowledge is a bit limited for this use case:
Imagine this is your ...
- 50
1
vote
1
answer
135
views
Is this code code vulnerable to XSS?
I have a function that accepts the param url and passes it to exec()
function getQueryValue(url, name) {
name = name.replace(/[\[]/, "\\[").replace(/[\]]/, "\\]");
var ...
- 135
1
vote
1
answer
160
views
Reflected DOM XSS Portswigger Lab
I'm a total beginner and im trying to solve Portswigger Academy labs. I'm studying on XSS right now and im stuck in somewhere.
Lab Details:This lab demonstrates a reflected DOM vulnerability. ...
- 13
0
votes
1
answer
97
views
Can you have an <iframe> tag with no spaces?
I am looking to figure out how to create an iFrame tag without any spaces. I have found an input on a Bug Bounty program that reflects my input back into the page, and allows me to escape double ...
- 50
0
votes
1
answer
191
views
XSS payload to Send request to server without closing tag
I was testing a website which does not have XSS in their scope. So I thought it would be a good idea to escalate XSS to a bug which is valid. I need to make a request to my server but the problem is ...
1
vote
2
answers
245
views
Difference Between Reflected XSS and Reflected-DOM XSS
What's the difference between Reflected XSS (RXSS) and Reflected-DOM XSS (RDOMXSS)? After some research, I think it can be concluded that Reflected-DOM XSS is:
Similarities:
The value is reflected by ...
0
votes
0
answers
78
views
Bypass XSS filter in data- attribute
My web application allows users to make custom divs with whitelisted attributes. One of them is data-{user-input}.
Recently I have seen the following XSS payload:
[[div data-test/onmouseover=alert(1)]]...
1
vote
1
answer
699
views
"One of your code blocks includes unescaped HTML." JS console security warning
I operate a blog using Google's Blogger platform about programming. I use highlight.js for syntax highlighting, and now on my posts I see the console warning: One of your code blocks includes ...
- 111
0
votes
0
answers
46
views
Accidentally locked an XSS vulnerable input
On https://ais.osym.gov.tr/ I saw an XSS vulnerable input. I tried some payloads without malicious intent which only contained alerts or console logs. The code img \x00src=x onerror=alert(1) worked.
...
- 1
2
votes
3
answers
189
views
Can I visit a malicious website by using Tor with settings set to safest or by using NoScript on an ordinary browser with settings set to untrusted?
Can I visit a malicious website by using Tor with settings set to safest or by using NoScript on an ordinary browser with settings set to untrusted?
If not then is there any way to visit a malicious ...
- 31
1
vote
0
answers
826
views
Checkmarx Client DOM XSS Violation in ReachJS
I have this message from Checkmarx:
The application's = embeds untrusted data in the generated output with location, at line 19 of ****.js. This untrusted data is embedded straight into the output ...
- 111
1
vote
2
answers
485
views
Reflected XSS found in web application via POST request with JSON body. Is this issue exploitable?
I was testing an application recently and i came across with a Reflected XSS vulnerability via HTTP POST Request with JSON body. Although this condition can't be exploitable from his own, due respond'...
- 15
1
vote
1
answer
94
views
Risk of injecting a malicious script/code?
I was was inspecting elements in a website and I randomly stumbled onto this piece of code .
</style><meta name="add-styles-here"/><meta name="add-scripts-here"/>&...
- 23