Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [xss]

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

0
votes
0answers
9 views

CSRF and XSS protection via Header & Cookie-based JWT (tokens)?

I have built a REST API, where users login, with extra permissions in some cases (or restricted to certain areas of the site; or even admin privileges). What I've built: JWT authorization (added to ...
2
votes
1answer
57 views

XSS stored in DVWA

Trying "XSS stored in DVWA" and now I am completely confused. It is not letting me bypass, I tried many inputs and I know what the preg_replace() is doing still nothing seems to work for me. I used ...
3
votes
2answers
180 views
+100

Is this hybrid (cookie, jwt) authentication method for web applications known and practical?

I have been working with web applications for a while, some months ago I found a possible approach to get the security advantages from Browsers while using cookies for authenticating requests, with ...
-1
votes
0answers
113 views
+50

What are the latest same-origin bypasses in Flash Player about?

Looking for an example of such vulnerability in ActionScript 3, I quickly found: cve‑2014‑0580 cve‑2014‑0531 cve‑2014‑0533 cve‑2016‑7890 cve‑2015‑7628 In each case I was unable to gather further ...
1
vote
1answer
71 views

Can XSS be exploited this way?

As per my understanding, if a cookie doesn't have domain attribute (explicitly telling where this cookie can be used) By default that cookie will be used by the domain which issued it and all its ...
0
votes
1answer
37 views

Is it worth using a client-side XSS-focused library like DOMPurify?

That may not be the best way to phrase the question, but gives the basic idea. If everything client-side is malleable, is it even worth it to use a JS library for sanitization? I've seen DOMPurify ...
-1
votes
1answer
88 views

Can running javascript from the console be considered as XSS?

I did it from the console. Is this a security issues?
0
votes
1answer
28 views

How to filter HTML Event in Native PHP7

i want to creating xss filter for my own project, this is for html event filtering preg_replace("/ on\w+='[^']*'/i", '', preg_replace('/ on\w+="[^"]*"/i', '', $framed)); but considering to more ...
0
votes
2answers
75 views

XSS possible inside the value field of input tag when double quote is filtered?

Is it possible to get XSS in the value field of Input tag when the application filters out double quote? <input type="hidden" name="something" id="somenthing" value="my_input_goes_here"> input ...
1
vote
0answers
48 views

XSS and CSRF Protection in a SPA with session cookies and auth in sub-domain (confused)

The problem is, that the more I read about XSS and CSRF and the protection against these attacks for my website, the more I get confused what would be the right strategy. Setup: SPA (Reactjs and ...
1
vote
1answer
41 views

XSS using SVG: Is AllowScriptAccess attribute ignored?

I was experimenting with some Anti-XSS solutions, and during my research, I found following the XSS vector in a cheatsheet: <EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH ...
3
votes
1answer
79 views

How to prevent XSS in user-generated content (html) without disabling scripts and CSS [duplicate]

Is there a way to somehow sandbox user-generated content? I'm working on webapp which will contain a lot of user-generated content. Only "trusted" users will be able to publish the content, but I want ...
0
votes
1answer
72 views

XSS vulnerability in display message

I have a webpage in which Email is given as input. It will then display "your email is abc@xyz.com". I am then changing the email in URL to <script>alert(1)</script> and send tbe request ...
0
votes
0answers
30 views

Stealing csrf token With Event Handlers xss [on hold]

I am testing site which was vulnerable to xss https://www.example.com/search/test" onfocus="alert(1)" autofocus=" Reflecting area <input class="" name="search" id="search" placeholder="Enter ...
2
votes
0answers
33 views

Sandboxing untrusted JavaScript execution by redeclaring variables

Some irrelevant background (read only if you want to say "no, just use an iframe") Scenario Suppose that I downloaded a string jsCode containing arbitrary JavaScript code from a (potentially ...
-1
votes
0answers
43 views

Redirecting and getting XSS error

hiddentextbox = 12 response.redirect("page.aspx?ID=" + hiddentextbox) This is giving me the error that it unvalidated (even though it's chosen based on a click choice). How do I fix it? The problem ...
0
votes
1answer
55 views

Blind XSS via cookie?

I would like to know if its possible to test blind XSS via a cookie value. That is I send the server some cookie that has a blind XSS payload. Or is blind XSS only exploitable if a human interacts ...
0
votes
0answers
81 views

Is this script vulnerable to xss? If yes, how can i get an alert box?

I think this code may be vulnerable to dom based xss but i wasn't able to get an alert box. I am able to control the userTitle field, i tried using </script> but it get changed to u003c/...
0
votes
0answers
26 views

How to deploy your web server's Web Application Firewall while limiting false positives

For objective discussion: We deploy several Web Application Firewalls where I work. I know that one particular on-prem product uses Apache [reverse] Proxy & ModSecurity to match HTTP POST traffic ...
0
votes
2answers
194 views

Prevent javascript cross-origin redirect by window.location.href

Following this question, is there a way to prevent this code from redirecting users to domains not whitelisted? const form = document.getElementsByTagName('form')[0]; form.addEventListener('submit', ...
2
votes
0answers
55 views

Is the PHP BB code extension safe against XSS?

Bad home brew implementations of BB code (especially in PHP) are a common source of XSS vulnerabilities. Usually they rely on a bunch of regexes, a tool that is not fit for the job. But lo and ...
1
vote
1answer
49 views

Can XSS mitigate all anti-CSRF protections?

Say a website has the following form on their sign-up page: <form method="POST" action="https://example.com/login/"> <input type="hidden" name="x-csrf-token" value="[token]"/> <input ...
2
votes
1answer
72 views

Can the Internet Achive capture anything malicious?

I have been using the site Internet Achive when I was researching a domain name and found an older version of the domain I was investigating turned out to be a NSFW web site it seemed like it was ...
0
votes
0answers
27 views

Is this code vulnerable to DOM based XSS? jquery wrap()

Data is read from window.location and passed to the wrap() function of function of jQuery via the following statement: t.Location.wrap(window.location) The version of jQuery in use is the 1.12.1 - ...
0
votes
0answers
30 views

Best way to take javascript code as input from customer and use them on site

I am working on a SAAS app with multiple customers, on their admin panel they have option to add code to add in header. This is a textarea which can take javascript code as input and then this code ...
3
votes
3answers
123 views

Encoding output in JSON HTTP API

I'm the author of a JSON REST API. This REST API is consumed by various clients, such as HTML/JS-clients, .NET clients (console applications) and Ruby clients. The output of the API is in JSON format, ...
1
vote
0answers
65 views

Angular JS alternative xss payload?

Basically, I have a situation right now where the registration website allow to register via email address and then redirects me to another website (subdomain) of the original website. The subdomain ...
1
vote
0answers
26 views

Where to store encryption based tokens in Encryption based Token Pattern?

Reading OWASP encrypted tokens pattern they describe the flow as follow: After successful authentication, the server generates a unique token comprised of the user's ID, a timestamp value and a ...
0
votes
1answer
98 views

CSP - Unsafe-inline or unsafe-eval for specific domain is allowed or not

Following is a CSP policy, for example derived sample response headers. The implementation below allows white-listed domains only in "script-src" directive but the 'unsafe-inline' and 'unsafe-eval' ...
3
votes
3answers
140 views

Are jQuery vulnerabilities exposed by the file being served from the server of by usage of the vulnerable code?

I've recently been asked to update a legacy web application, installed on numerous client servers, to use the current version of jQuery 3.3.1, rather than 1.10.2 which has a number of vulnerabilities. ...
4
votes
0answers
107 views

XSS with escaped equal sign inside jQuery selector

Web-site uses jQuery 1.8.3 which has known XSS vulnerability in selector. (https://snyk.io/vuln/npm:jquery:20120206). It passes filtered and urldecoded document.location.hash (val2 below) value ...
0
votes
1answer
43 views

How is security risk of storing authentication token in localStorage compared with cookies?

I've read that it's a bad idea to save Single Page App's encrypted authentication token in browser's localStorage because this makes your app vulnerable to XSS attack, and when the token is stolen, ...
1
vote
2answers
135 views

How do web browsers detect XSS attempts when the X-XSS-Protection header is enabled?

Simple question but hard to understand how web browsers make the distinction between legitimate and malicious code when mode=block is enabled? Of course, I would like to know how each rendering ...
0
votes
1answer
214 views

XSS code not fetching back script

I am doing a XSS challenge on HTB and have run into an issue. I have the unvalidated field that is vulnerable to XSS and so far I have got the below line to successfully call back to a python server ...
1
vote
0answers
124 views

Android WebView JavaScript Enabled

I recently found an Android application, which uses a WebView with enabled JavaScript. In this webview I am able to browse from their provided FAQ page to twitter, and from twitter basically ...
2
votes
2answers
727 views

What are the common features to identify XSS attack from Apache log file?

I have tried some XSS vulnerability on web application such as webgoat, OWASP mutillidae, bWAPP. I want to know the features/keywords/footprints of cross site scripting attack in apache log file and ...
1
vote
1answer
71 views

HTML payloads work on burp but not on browser

I was looking into bWAPP. In the HTML GET Injection section, I entered %25%33%63%25%36%38%25%33%31%25%33%65%25%36%31%25%37%30%25%37%30%25%36%63%25%36%35%25%33%63%25%32%66%25%36%38%25%33%31%25%33%65 ...
2
votes
2answers
135 views

Can hacker delete my server files and database where I am using below function?

I want to know how to protect my website from hackers. I am a php-mysql developer. For fetching data from databases I always use MySQLi. For preventing my website from SQL injection, I always use PHP'...
1
vote
1answer
101 views

Is this code vulnerable to DOM based XSS jquery animate? [duplicate]

Is this code vulnerable to DOM based XSS? The application is using jQuery 1.12.4 and i noticed that Data is read from window.location.hash and passed to $() via the following statements: var target_ ...
0
votes
1answer
75 views

Prevent javascript cross-origin write

Let's assume an attacker manages to inject this script in a login page: const form = document.getElementsByTagName('form')[0]; form.addEventListener('submit', stealCredentials); function ...
0
votes
1answer
132 views

Is this code vulnerable to dom based XSS? [duplicate]

Is this code vulnerable to DOM based XSS? The application is using jQuery 3.3.1 and i noticed that Data is read from window.location.hash and passed to $() via the following statements: var hash = ...
2
votes
2answers
129 views

CSRF methods: img vs iframe vs form/javascript

I have a questions concerning methods for executing CSRF. I did the CSRF Prompt By-pass lesson in WebGoat (Lessons -> Cross-site Scripting -> CSRF Prompt By-pass). The lesson requires you to craft an ...
0
votes
1answer
269 views

Exploit: Send cookie to another server from url

I'm testing a web application and found that url contains "redirect=" where it navigates to new location once logged in. http://IPAddress/?redirect_uri=test I'm trying to exploit the cookie using ...
0
votes
3answers
439 views

Injecting <script>alert(“1”)</script> to OWASP Juice shop doesn't work

I've just learned the theory behind XSS attacks and now I would like to test my knowledge in a legal way. I wanted to "hack" OWASP Juice shop by following steps from this book section "Perform a ...
0
votes
1answer
163 views

How to get admin cookie with Persistent XSS?

Two parts to this question. Let's say there is a site which accepts my input and sends it in XML format to server. When I enter the input as shown here: https://ghostbin.com/paste/hc5n6 The reason I ...
0
votes
3answers
222 views

Why doesn't XSS execute when bypassing HTML encoding?

I am trying to execute an XSS payload on a search field that takes my input like this: <input name="q" id="gsasearch" type="text" value="My Input"></input> Observations: <, > and "...
1
vote
1answer
90 views

What are a JSON rest api's responsibilities to prevent XSS? [duplicate]

I'm building a rest API that serves exclusively JSON. It might one day be consumed by a browser based app. Is there anything I should do on my end to prevent XSS attacks?
1
vote
0answers
167 views

Should sensitive tokens be stored in localStorage or an HTTPOnly cookie?

In the context of a web application... should sensitive tokens, such as those used for sessions, authentication and/or authorization, be stored in localStorage or an HTTPOnly cookie; or are they both ...
0
votes
1answer
74 views

Can registration forms be used for an XSS attack?

In most websites that have account logins, there are at least two fields: Email Password Could either of these fields be used to mount an XSS attack (assuming no character encoding)? For example, ...
0
votes
4answers
239 views

XSS payload shorter than 20 character

For an university project I have to perform an analysis on a web application to find out XSS vulnerabilities. After this I have to report and create automatic test to prove vulnerabilities that I have ...