Questions tagged [xss]

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

Filter by
Sorted by
Tagged with
0
votes
2answers
74 views

Bypassing htmlentities() for XSS attack

I'm only a beginner so if any more info is needed just request and i'll update the question. For one of my modules we are covering cross-site scripting and I have been given a series of PHP files that ...
0
votes
1answer
35 views

Does CSP mitigate against client prototype pollution XSS and DOM XSS?

DOM XSS and client prototype pollution-based XSS have one thing in common, we are modifying the pre-existing JavaScript code to popup an alert(1). Will CSP mitigate XSS in this case? Theoretically, ...
0
votes
0answers
62 views

How to evade Angular HTML sanitizer for XSS

I'm trying to evade the HTML sanitizer in a field I found more vulnerable in my application to test some XSS injection. The field that I'm trying to exploit is a dropdown with the following code. The ...
0
votes
0answers
56 views

Is my browser been exploited via CSS? [closed]

I've been looking at some Web tools as I had some suspicions. The css looks as though it does not come from Youtube. I've seen code from github and other sources. A large portion is commented out and ...
1
vote
1answer
46 views

Getting an abnormal amount of firewall warnings on web server

I just had a look at the firewall status and saw it had blocked over 300 requests from TOR, Python Urllib, and some script called aabbccdd.xss.ht/pigeonburger.xyz (pigeonburger.xyz being my website). ...
0
votes
1answer
53 views

XSS without angle brackets

I would like to run the following script inside an input tag when the page loads. I know how this can be fixed by using onfocus and autofocus. But how do I get the expression document.cookie in there? ...
28
votes
6answers
6k views

Is splitting a REST API server from a Web server considered a security threat?

I am participating in a project that involves a JavaScript SPA that provides a service and is intended to interact via REST APIs with one of our servers. Initially, I proposed to work on the two ...
0
votes
0answers
38 views

Should you even bother trying to hide authentication from XSS?

I read a comment on here that goes something like "trying to hide user authentication from an XSS attack is like reinforcing your fridge against a nuclear bomb; at that point, you've got much ...
1
vote
0answers
42 views

Can “c:set” cause Cross Site Scripting (XSS) vulnerability?

Can this be exploited as XSS vulnerability using urls like localhost/?myVar=<script>alert(document.cookie)</script> or though any other possibility? <c:set var="myVar" value=&...
0
votes
1answer
53 views

XSS: What parts of the javascript code can the xss attack access?

I understand that XSS attacks can access all globals (like cookies, storage, etc) within the context of the running javascript code, but i would like to understand if they could also have access to ...
1
vote
0answers
39 views

How can I implement CSRF Tokens without server-side rendering/templating?

I am attempting to build an application that submits numerous fetch/XHR requests to a NodeJS backend. I'd like to implement CSRF token protection, but would like to avoid implementing server-side ...
0
votes
0answers
46 views

Sanitising data for a flutter application

I am having trouble with some user input security. I have a Flutter app where users can submit comments that can contain text e.g. a-z characters, numbers, symbols and emojis. These are stored in a ...
0
votes
1answer
65 views

It's possible to trigger a XSS in url context without this following caracter ' : '?

I try to bypass a XSS filter to trigger a XSS in url context. But the problem this following char is blacklist ' :' The site allow the user to use some basic html balise like h1, h2, h3, p, a, u, etc ...
1
vote
1answer
55 views

XSS in a variable assignment when <>" are escaped

SCENARIO: user input is reflected inside a variable. For example url.com/?a=hello is reflected as shown below var test="hello"; I tried to evade from the variable with payload like hello&...
1
vote
0answers
47 views

Do object-src and base-uri bypasses still work on Content-Security-Policies?

I'm assessing the security level of a webapp and one of the test cases is the CSP header. I always use the Google CSP evaluator to assess the header. Let's consider the following CSP header: Content-...
0
votes
0answers
54 views

XSS on port other than 80 not working

I am currently doing a boot2root VulnHub machine and I have found an XSS entry point to steal admin cookies. The strange thing is that if I run my SimpleHTTPServer on port 80 then the following ...
0
votes
1answer
84 views

ASP.Net XSS - How does this vulnerability work

I have been tasked with fixing a XSS issue in an ASP.Net application, but I have never seen this kind of attack before so first it would be great if I could understand how this is working and then I ...
1
vote
0answers
88 views

Self-XSS From File Upload Name

I encountered this type of vulnerability a couple of times but was not able to fully exploit it. This vulnerability is a self-xss which is triggered from file names. E.g. If I were to upload a file ...
1
vote
2answers
103 views

Open Backdoor in web browser using xss?

I am trying to learn about of xss attack and so I far, I understood that a successful attack result in the attacker capable of injecting malicious js in the victim's browser. If my understanding is ...
0
votes
0answers
30 views

Secure authentication for sites which allow user to modify js/html

We have a site builder, allows users to add/modify JS/HTML/CSS. Is it possible to provide a global authentication for it? I mean users login once but can interact with all sites as their own names. ...
1
vote
1answer
63 views

Is nonce useless when user input is reflected within an inline script?

I stumbled upon a web app which is accepting user input and putting it into a variable within script tag. The script tag does have a nonce attribute. As am working on bypassing the XSS filter, I had ...
4
votes
1answer
131 views

Split a JWT between payload and signature

Context: I'm looking at storage solutions for JWT tokens on a single page application. Storing the JWT in the local storage is unsafe and prone to XSS attacks. Storing the JWT in a secure / HTTP only ...
1
vote
1answer
46 views

Reflected XSS monitoring

There is a lot of information on how to avoid or detect XSS, but I couldn't find much information on how to monitor for reflected XSS. Is there a way to automatically detect reflected XSS in my ...
0
votes
0answers
54 views

How to do and XSS on angle brackets, single, double quotes, backslash and backticks Unicode-escaped

I am doing some xss challenges and I have a challence that has angle brackets, single, double quotes, backslash and backticks Unicode-escaped when I enter them in the search box. How can I bypass this ...
1
vote
1answer
80 views

XSS - Setting Values and Attributes w/ jQuery

I was looking at the answer here and got curious if a function I use may be susceptible to XSS. Mostly because of this statement: Some HTML attributes are inherently dangerous. This includes href, ...
1
vote
1answer
78 views

Unrestricted file upload in chat

I am currently doing a bug bounty program and found a possible file upload vulnerability, but I am not so sure about it. The vulnerability is on the chat function. In the chat function, users are ...
0
votes
1answer
75 views

XSS in script tags application/json - possible?

Is there way to execute alert box if " is not correctly escaped and can be injected in example below? <script type="application/json">{"requests":{"postClicked"...
0
votes
1answer
47 views

Shared Text Content - XSS Safe

I have a bulletin on my site that all valid users have access to (read and write). User input posted to this bulletin is stored in JSON. Because of these qualities there is definitely some concern for ...
0
votes
0answers
37 views

Is there a potential XSS in this html action attribute?

I'm working on a website and I noticed that if I go to the following URL: website.com/page?alert() this message is reflected in the action form. I tried to close the action attribute using double ...
0
votes
1answer
196 views

How to prevent XSS attack on selected window.location in javascript

This is my code where i have a userId in a method SwitchUser_Click. I need to prevent or somehow encode the return value from the switchUser_Click as it includes the UserId of a user vulnerable to ...
1
vote
1answer
55 views

XSS Prevention Code [closed]

I was just wondering if this code is enough to prevent XSS vulnerability in my web app? /** * Escape HTML string to prevent XSS. */ export const escapeHtml = (string: string): string => { if (...
0
votes
0answers
38 views

URL Encoding leading to invalid flag

I'm currently completing an XSS challenge in a CTF. I successfully redirect the admin cookie to my request bin, but the flag is said to be invalid. I am told this is because the flag string gets ...
1
vote
1answer
88 views

XSS in my Web App? [closed]

I have developed web app, and my customer is saying this piece of code is vulnerable: <a href="#" onclick="count.it('count', 9); console.log(1);">Click "9" is ...
0
votes
0answers
44 views

XSS injection into javascript string

Is XSS attack possible in this scenario? As you can see I am able to inject JS by not properly escaped backslash. <script type="text/javascript">(function () { random.random(); random....
1
vote
0answers
43 views

Can input value escape a JSON object?

I am passing value from input filled directly into a script function inside a JSON object. I was thinking, is it possible that this input can escape this object and can lead to XSS or something. <...
0
votes
2answers
63 views

What attack vectors does arbitrary JS on a user profile allow?

Consider a site for frontend devs/designers to host their portfolio apps - pages with arbitrary JS, each hosted on a user's separate profile. What attack vectors would that enable against the site? ...
0
votes
1answer
41 views

XSS possibility in user isolated app?

By user isolated, I mean that users interact with server and have some personalized data and they can read, update, delete their data but they will never see another user made data (like facebook, ...
7
votes
2answers
224 views

Why is the use of TAB (%09) characters in the middle a 'javascript:' URL valid?

Some context: I was assinged on a pentest and found an application that let me place my own links in an a tag's href attribute. As expected, all strange values like javascript: were correctly filtered ...
0
votes
0answers
66 views

Why don't antivirus detect malicious XSS files?

I have a system with an uploading file feature and it's protected by an antivirus that scans the uploaded files. The AV detects malicious files like EICAR files, msfvenom payloads...but not a JS file ...
2
votes
1answer
99 views

Are Javascript closures a useful technique to limit exposing data to XSS?

I'm wondering if using Javascript closures is a useful technique to limit exposing data to XSS? I realize it wouldn't prevent an attack, but would it reliably make an attack more difficult to execute, ...
0
votes
0answers
83 views

Are web worker / service worker secure environments to store a password, credit card information, access tokens?

If there is a case where I wish to store sensitive data like a password, credit card information, or access tokens: Are web workers / service workers a secure environment, where such data can not be ...
1
vote
1answer
75 views

Multi-byte character exploit

I read this answer, It explains how a multi-byte character exploit works in a decent way, the only way I could think of avoiding this problem is whitelisting all single-byte characters because of the ...
1
vote
2answers
138 views

Attacking through a malicious HTML file apart from XSS through Javascript?

I recently came across a behavior in a web application where the application (through the use of the header Content-Disposition: attachment) offers to download an HTML file instead of allowing it to ...
1
vote
0answers
58 views

What are the XSStrike metrics “Confidence” and “Efficiency”? [closed]

This is regarding the XSS scanning tool XSStrike. The tool produces three elements in a given report: XSS Payload Confidence Efficiency Does anyone know what the metrics Confidence and Efficiency is ...
2
votes
2answers
164 views

Popup alert even when a site deletes the alert function?

A website fully filter the alert function from his website, and replace it with an empty string, but I want to bypass it and still popup an alert, I am trying to solve an XSS challenge, and I figure ...
0
votes
1answer
113 views

Reflected XSS in form action - understanding

I am trying to learn basics of web security vulnerabilities. I have found a website, where on reset password, you get a link in the email with a token, and when you click this link, the webpage opens ...
0
votes
0answers
51 views

How does this DOM xss work?

I'm doing a lab on portswigger.com, this one to be specific, https://portswigger.net/web-security/cross-site-scripting/dom-based/lab-document-write-sink-inside-select-element var store = (new ...
0
votes
0answers
49 views

Is unicode character encoding a safe alternative for html encoding when rendering unsafe user input to html?

I am building a web application in which a third party library is used, which transforms the user input into JSON and sends it to an controller action. In this action, we serialize the input using the ...
0
votes
0answers
136 views

Can someone explain the 'IE No Open' X-Download-Options Header, as enforced by Helmet.js?

I've been preparing to deploy an Express server using Helmet.js for some added security. I've been reading through their docs to make sure I understand what I am doing here, and I don't understand one ...
1
vote
1answer
107 views

Is this considered DOM-XSS or self-XSS or both?

SCENARIO: A web page shows an error login page using these javascript lines <script> let queryParams = new URLSearchParams(window.location.search); document.getElementById("message")....

1
2 3 4 5
27