A message from our CEO about the future of Stack Overflow and Stack Exchange. Read now.

Questions tagged [xss]

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

Filter by
Sorted by
Tagged with
0
votes
0answers
24 views

Letting attacker control content-type, why is this safe?

I found a strange behavior of Shopify, where an attacker can change the extension on a URL and the backend will send back an HTTP content-type matching that extension, for each of these extensions: ...
12
votes
2answers
2k views

Secure HTTP Headers - where should be implemented, WAF or code level?

I have a REST API exposed to the Internet and another application with form-based authentication. These apps are behind a Web Application Firewall. Question is, where I should implement the below ...
0
votes
0answers
42 views

JS Input Validation and XSS

I have an html form that allows a user to change their password. I have been reading up on XSS and have been adding protection where I can. Most of that has been server side. I am curious (and I think ...
0
votes
1answer
41 views

Potential DOM Based XSS?

I am currently working on exploiting a potential DOM based XSS on a web app. Currently all of my XSS attempts have been thwarted by Internet Explorers XSS auditor, even after disabling it. While ...
1
vote
1answer
56 views

Is encrypting localStorage data more secure?

I'm building an SPA app and I have to use an access token to make requests to an API. The most common way to store the JSON Web Tokens is to use localStorage, but I have always thought that was a bad ...
1
vote
2answers
70 views

Preventing XSS by filtering data from the server to the client

Before you immediately comment "you can't trust the client!", please read the whole question. I've been reading about how to prevent XSS attacks lately, and everything I've found says that the server ...
0
votes
1answer
109 views

Is there a vulnerability other than XSS which can result in client side script execution?

If the intention of attacker is to execute an arbitrary client side script in the context of a web application, is XSS the only possible attack other than compromising the server with an RCE or a sub-...
0
votes
1answer
79 views

XSS with requestbin.net

I am trying to steal the admin cookie using an XSS attack for a challenge. The vulnerable page is a page where a user can post a comment. When I enter <script>alert("ok")</script> in ...
5
votes
1answer
80 views

What was the real reason for dropping reflected-xss directive from CSP?

There were two response headers which could be set by servers to instruct browsers to enable heuristics based reflected XSS detection and prevention in the past. X-XSS Protection: 1; mode=block ...
1
vote
1answer
137 views

Is this a XSS vulnerability? I can't figure out why it's not working

I was working on a web app and as I was building the front-end for a search function I tried to see if it would be vulnerable to XSS. After pressing the search button, the js code will generate a ...
-3
votes
1answer
100 views

What led to the prominence of storing JWTs in localstorage?

Could somebody explain how and why a majority of new webapps are storing their JWTs/tokens in localStorage? It doesn't seem to be by chance, anyone familiar with this history and perhaps factors from ...
0
votes
2answers
98 views

How to prevent XSS attacks in ASP web application [closed]

In my web application, while doing the penetration testing two XSS vulnerabilities identified in some text input. that field testing using followin cheets, <script src="http://192.168.1.122:3000/...
0
votes
1answer
48 views

Single and double Encoding of parameters to bypass security filters

I was practising some labs to get better at XSS and SSRF. I found that sometimes I just encode characters once and the security filter is bypassed and occasionally I have to encode it two times. How ...
2
votes
1answer
78 views

XSS chained with CSRF = Stored XSS?

I have recently heard that XSS + CSRF = stored XSS. I didn't think too much about it at the time, but now it's bugging me, because it doesn't make too much sense. I would say that it can stand true, ...
0
votes
0answers
43 views

What to consider for determining something as a security flaw?

Recently, I found an iframe injection vulnerability on a website. This website allows users to create projects and name them. So I successfully injected an iframe on the naming function that can ...
2
votes
0answers
47 views

Are the trade offs for putting an auth token in an http-only cookie for an SPA worth it?

I've been building a web app (rails api + react SPA) for learning / fun and have been researching authentication. The most commonly recommended approach for authenticating SPAs that I have read is to ...
-2
votes
1answer
142 views

Is editing a link using inspect element a valid XSS attack?

Using inspect element, I can edit a link opens a popup in edge with the text "1". Is it a possible XSS attack?
-2
votes
3answers
135 views

Can a URL contain executable JavaScript?

I am learning about "Session fixation" and have read the corresponding OWASP page. In their Example 2 in the above page, they describe an attack via JavaScript, that is embedded in the URL like: ...
1
vote
1answer
148 views

Which symbols can I whitelist to remain safe against SQL injection, XSS, and all other injections attacks?

I have an input field in a web that is being saved. This field can be shown in other systems that I do not have control over and that's why I would like to limit what is allowed in this field, ...
0
votes
0answers
52 views

Method to bypass \n in WAF (\n vulnerability)

I have this application that has an input box where the data is going to be sent in a JSON format. The JSON payload might look like this {“message”: “hello\nmy name is andi”} But the problem is the ...
1
vote
1answer
69 views

Is this javascript vulnerable to dom based XSS?

I was testing example.com and i found a js reflection point. If i send the following request: https://example.com/?token=test%22test="'-confirm(1)-' I can see the following in server response: <...
1
vote
1answer
81 views

XSS in HTML Context without < and >

I have a webpage that blindly removes < and > as hardcoded rule. I know XSS doesn't always need < and > since it is not needed in HTML attribute and javascript contexts. But is it ...
2
votes
1answer
71 views

Is it possible to get XSS without event handlers inside <img> Payload?

I am pentesting a super strange website and was trying to get Stored XSS on their main website. After some hours of testing i found that it is possible to inject sucesfully without any encoding: <...
0
votes
0answers
53 views

How much damage can JavaScript do? [duplicate]

I've tried to find an answer to this question for quite a bit of time, but I can only find example of how an XSS attack is accomplished. My question is, once JS is successfully injected into a site, ...
0
votes
1answer
40 views

XSS and Content Security Policy, and existing CSS

I have done the first development of a website and deployment. Scanning the server with an online security evaluation tool I was recommended that I add a Content security Policy to the website, and I ...
1
vote
1answer
70 views

Would HTTP Header injection allow for an XSS vulnerability if content-type is application/force-download?

I am currently conducting a pentest and I found an application vulnerable to http header injection, where the user input is reflected after the Content-Type header, and the Content-Type is set to ...
2
votes
1answer
133 views

XSS inside JavaScript string literal without single quotes?

As a pentester I came across this scenario: <script type="text/javascript"> URL = 'http://example.com?x=input'; I am able to insert a new line with %A0, spaces and almost anything except '. ...
2
votes
0answers
57 views

Is it possible to launch XSS if only the left angle bracket is encoded

I find some website only encode the left angle bracket of inserted HTML tag, for example: <div style="position:absolute;left:63.35px;top:108.41px" class="cls_002"><span class="cls_002">&...
1
vote
0answers
17 views

How editing html and javascript of a website makes it vulnerable? [duplicate]

I was practicing web pentesting on this level of ctf2 and I was supposed to edit the HTML and the Javascript to get rid of the input validation and < > sanitization. I succeded after looking up ...
-2
votes
1answer
100 views

Client-side protection bypass for XSS [closed]

Let's assume an application has a function for XSS protection just on the client-side. How can I create proof of concept attack for this?
0
votes
0answers
65 views

Is bypassing client-side protections a XSS vulnerability?

While I am attending the private bug bounty program, I realized the web application has a hidden element and its value is an empty string in HTML code. The app is using this element's value in some ...
-1
votes
2answers
57 views

How does a Content Security Policy help with preventing XSS and other injection vulnerabilities? [closed]

I was reading up on CSP's and I did some testing on a site which had one implemented, I found an xss vulnerability even though it was using a CSP.
28
votes
1answer
5k views

Is Dom based XSS still a valid security concern in modern browsers?

I am trying to understand how DOM based XSS work, e.g. from this post, I managed to reproduce it in IE11, but e.g. Chrome and Firefox are immune at least against this exact example. What happens is ...
1
vote
0answers
55 views

XSS filter evasion

if <> tags are html-escaped but " is not escaping, can I have xss? I have already tried " onmouseover="alert('xss');" but doesn't seem like it is working. I have a feeling that xss resides in it ...
0
votes
0answers
63 views

XSSI, CSRF attackin REST API's POST method

I'm on a course and there is a bank application which I need to attack by getting users visit my site which instantly transfers X amount of money to my balance. Their transaction form posts the ...
0
votes
1answer
55 views

can you have reflective xss through a POST parameter?

While testing a dummy app, I noticed that the XSS done through POST parameters was getting stored in the form (the alert('XSS') would show every time I loaded the page where I had injected the payload)...
5
votes
1answer
213 views

Is it possible to get XSS through uploading an image via the filename?

I just wanted to know if its possible... If i have an image i.e abc.jpeg and i rename it to an XSS vector such as <img src=x onerror=alert(1)>.jpeg will it successfully produce the XSS or is ...
1
vote
1answer
106 views

HTTP header injected in meta tag

When I add the HTTP header X-Forwarded-Host: bing.com, a meta tag is injected into the site: <meta property="og:url" content="https://bing.com/argentina"/> Does this have any security impact? ...
-1
votes
1answer
70 views

I found an XSS site while searching [duplicate]

I found a site where XSS is running I want to report this site because it is dangerous for others Where should I report it?
-1
votes
1answer
112 views

XSS protection - escape symbols

Lets say we have private math/developers forum website made with asp.net. Users can post text-messages in topics. Based on OWASP articles we should escape symbols like: ' " < > / to prevent XSS ...
0
votes
1answer
175 views

Storing encrypted tokens in LocalStorage

I am building a JavaScript application that will run in a web browser but also as a pseudo-native mobile application via Apache Cordova. It communicates via API to a separate backend service. The app ...
0
votes
0answers
58 views

Can a corrupted image/video become a XSS vector?

Let's suppose that I allow users to upload an image or a video. Obviously, I rename it on the server side. Can an attacker use it to conduct an XSS attack? I show images in this way: <img src="...
0
votes
0answers
40 views

how to bypass URL encoding on XSS [duplicate]

I typed following script on the search input on the website alert() but website converted this script into &lt;script&gt;alert()&lt;/script&gt; in HTML content, is there any ...
3
votes
0answers
85 views

Is this XSS filter for HTML comments safe?

HTML comments can be notoriously tricky from an XSS standpoint, and the standard recommendation seems to be to never put untrusted user data in them. But shouldn't it be possible to strip out a few ...
2
votes
1answer
97 views

XSS Vulnerability Reproduction

I have a Qualys web application scan report that says I have a XSS vulnerability. It explains this was detected by requesting a malicious payload and evaluating the response. When I make the same ...
0
votes
3answers
111 views

Xss payload with onpointerover?

I bypassed a WAF and found an XSS vulnerability using the onpointerover event handler. In the page where I found the vulnerability, there's also a login page. What XSS payload can I use with the ...
0
votes
1answer
86 views

Is there a danger to client port scanning?

Are there any security risks associated with client-side port scanning? Or, more specifically, a "trusted" site (e.g., banking website) loading javascript trying to connect to various localhost ports? ...
0
votes
0answers
62 views

How to make a HTTPrequest in JSONP callback?

I'm trying an XSS challenge. I found an exploit that breaks CSP by using a JSONP callback. I can get an alert to pop up by putting something like: <script src="https://whitelisted.jsonp?callback=...
1
vote
0answers
82 views

Is there any way to break the HTML attributes without using single/double quotes?

I have the following code, <li data-type="test" title="?"> test </li> Following values were Not allowed <>&*#%\'"= My goal here is to get a javascript popup to appear. is ...
1
vote
1answer
128 views

Avoid cross site scripting in XML namespace

We have a legacy application on spring mvc and we have a web service exposed (SOAP protocol) for some reporting client app. This service was tested by a security team and the report indicates that the ...