Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

learn more… | top users | synonyms

-4
votes
1answer
33 views

Is possible to get password with stored XSS?

Is it possible to get password from a site with stored XSS? I have a forum where I can put JavaScript not directly but inside HTML (like <div onclick="alert()">CLICK</div>). Is it possible ...
-1
votes
0answers
15 views

Vulnerability in site when XSS attempts cause a button to dissappear

On a site e.g. http://security.stackexchange.com/questions/ask after XSS like this http://security.stackexchange.com/questions/ask,onmouseover="alert('Zep')" a button on that site got affected ...
1
vote
0answers
18 views

JavaScript variable evasion when quote is escaped, but not newline

I'm searching a way to properly evade from a JavaScript variable to perform XSS. A normal user input will give var a='<b>user input</b>'. a isn't eval anywhere and is not usable. ...
0
votes
1answer
28 views

Does removing user interaction create a secure sandbox that nullifies XSS?

Say there is a service online that takes as input a DOM string, loads that DOM in a browser on their server, and returns a screenshot. Would it be possible for the online service to completely ...
1
vote
1answer
43 views

XSS Page Cannot be Displayed

When I try XSS on various websites, such as inserting " onmouseover="alert(1) in a search box, I either get a message saying You don't have permission to access this page or This page cannot be ...
1
vote
1answer
39 views

DOM based XSS: jQuery(“#HiddenReferral”).val(jQuery(location).attr('href'));

DOM based XSS has been reported by Burp Suite and showed this query as vulnerable: The application may be vulnerable to DOM-based cross-site scripting. Data is read from location and passed to ...
2
votes
1answer
40 views

Having malicious code stored in your DB

Let's say that there is a website which has an input field from which the input is saved to a database and then displayed somewhere else on the website. Is it safe to only sanitize/escape the ...
0
votes
1answer
37 views

XSS to overcome HTML entities

In a search box (<input value=" *insert search term here* "...>), when I input " onmouseover="alert(1), the double quotes are converted to their entities, so it's not possible to break out of ...
4
votes
2answers
76 views

Is this codes usage of document.location.toString() a DOM based XSS vulnerability?

I have come across the following JS code in multiple web applications. I think the reason for the popularity of this code snippet is this accepted answer on SO. Developers seem to be using this code a ...
-1
votes
0answers
13 views

Beef installation problem in Windows 10 - 64 bit [migrated]

I am trying to install Beef in a WIndows 10 - 64 bit PC. I followed the instructions provided in the following link: https://github.com/beefproject/beef/blob/master/INSTALL.txt But I keep getting ...
2
votes
0answers
46 views

Angular XSS not evaluated

Using an older version of AngularJS : 1.2.21 from example, there are some playload that can generate an XSS. ...
2
votes
2answers
57 views

Why do I have to do manual XSS testing in addition to using tools such as Burp Suite/XXSer/Xenotix?

At what point does manual testing for XSS come preferred to an automated attack like one through Burp Suite? Looking through bug bounties and various exploits and it's not clear where there is a ...
1
vote
1answer
75 views

XSS works when I save generated HTML to file, but not directly in browser

The hints of XSS game's level2 say that Entering a tag on this level will not work. Try an element with a JavaScript attribute instead. When entering <script>alert(1)</script> ...
-1
votes
1answer
51 views

Svg width element XSS

I'm working on a svg image generator. Now I want to set the user width and height value. Can a user exploit this element tags? And what should I do to make this secure? <?php $user_input = ...
-1
votes
1answer
77 views

Can this prevent XSS?

In PHP, I've always used this to represent inputs and textareas: $foo = trim(htmlentities($_POST['foo'], ENT_QUOTES); // the trim is to prevent empty submissions Can it also be valid to prevent SQL ...
0
votes
1answer
36 views

Site stores cookie name and user id in script tag after login. Is this an issue for either xss or session highjack?

Upfront I will say that this is not my website and that I am simply doing a general audit (for non security issues), but ran across this in the source after logging in. Another script tag for ...
9
votes
5answers
319 views

Is XSS possible when < is not escaped, but also not displayed if followed by a character?

I have figure out that < wasn't encoded as &lt;. Instead of that, it is simply not sent by the server if it is directly followed by something. For example, <a will display nothing. But I'm ...
3
votes
2answers
168 views

Can you exploit an XSS vulnerability on one page to run code on another page?

Lets say that page A is vulnerable to XSS, but contain nothing of interest to an attacker. Page A links to page B that is not vulnerable to XSS, but contains a high value target for an attacker (such ...
0
votes
1answer
35 views

Null byte injection to run PHP?

A website accepts form input and outputs it to the screen, but replaces every <? to <--? turning them to comments. Let's say I POST the following: <?php echo "xy"; /* arbitrary php code */ ...
3
votes
2answers
106 views

Preventing Browser from BeEF Exploitation

BeEF is a great exploitation Browser based tool. But in some cases, unknowingly people get Hooked due to beef when it's hook.js is kept in Invisible Iframe of an HTML source. So How, can we detect ...
2
votes
1answer
56 views

How and why does case insensitive XSS work, given that JavaScript is case sensitive?

I found a lot of instances where XSS scripts like the following work: <iMg SrC=x OnErRoR=window.location=123> Given that JavaScript is a case sensitive language, how is the browser able to ...
2
votes
1answer
67 views

Will same-site cookies be sufficent protection against CSRF and XSS?

I must say, that I like this idea and it seems that it will bring a new form of protection against CSRF and XSS or at least it will reduce those attacks. So, how effective will this protection be? ...
0
votes
0answers
27 views

Executing JS script in Bootstrap popover without “<” and “>” characters (XSS) [duplicate]

In the system that I am working on I have a simple form. In the form there is an input called "ID". The contents of the input is than displayed in a Bootstrap popover (after clicking the "i" icon) ...
0
votes
2answers
88 views

How to detect XSS in GET requests?

How to detect XSS in HTTP/1.1 GET requests? A request can be malicious and I want to know how to detect if the GET request to a server is trying to XSS my website?
5
votes
4answers
330 views

Is it safe to redirect to URL parameter without filtering?

A webpage redirects to an URL given in parameter redirect without filtering it, like this: $newURL=$_GET["redirect"]; header('Location: '.$newURL); login.php?redirect=home.php If it echoes the ...
2
votes
2answers
67 views

XSS on a single page web application

I'm practicing stored XSS attacks on my vulnerable single page web application. I want to achieve some kind of DoS attack, where the page keeps reloading from the server. I can easily inject ...
0
votes
1answer
44 views

XSS between tags when only < and > are encoded? [duplicate]

Let's say we have <span></span>. Our website takes the value of a query parameter and adds it between the tags so we have <span>Hello!</span>. If we sanitize the parameter by ...
2
votes
1answer
59 views

Bypass char filtering - security shephard

I'm stuck in the XSS part of the security shephard OWASP app. I am not looking for someone to tell me the solution, I just need to learn how to find it myself, I'm a bit rusty on XSS. So what I know ...
1
vote
1answer
142 views

exploiting XSS in jQuery selector

My static code analyser flags this piece of Javascript on my client's web site as a potential DOM based XSS: var x = $('#' + window.location.hash.substr(1)) ...
8
votes
3answers
974 views

Is a HTML form tag more exploitable than a HTML link in user submitted content?

I have a content editor in a web application which allows administrators to add and edit content in certain areas of the application. The editor component I have used automatically removes any script ...
3
votes
1answer
92 views

Is it possible for XSS to occur in src attribute?

I'm working on XSS vulnerability and understanding it. I know in following cases cross site script injection happen in Javascript context Inside <script> tag. Inside html tag in event handler ...
4
votes
2answers
81 views

Why would a modern browser allow internal resources to be loaded from an external page

Recently someone announced that several Arris surfboard models lacked any form of authentication to perform functions such as reboot and factory reset a modem with a single http call. Read more on ...
3
votes
1answer
35 views

Exploiting an XSS vulnerability

This question is related to a class project involving a team of 2 students against another team of two students. We both have servers with a default plugin that we have a week to patch vulnerabilities ...
-2
votes
1answer
79 views

Clicking a lot of website links in Google Maps, then sent through multiple URL redirects, and lastly to a page that made my laptop start beeping?

I was in Google maps clicking on all the website links listed in the side panel, looking at every website really fast. Note, they were all tattoo parlors. One of the links I clicked bounced me through ...
3
votes
2answers
112 views

Can CSRF protection work even if an XSS vulnerability exists?

Need for CSRF protection that withstands an XSS attack One of the big dangers of XSS is that it can often bypass CSRF protection and thus perform any action the victim can perform. If it would be ...
0
votes
1answer
82 views

Is JWT in cookies with any CSRF solution just as vulnerable to XSS as JWT in localStorage?

I've read that JWT tokens shouldn't be stored in localStroage because XSS attacks can read them. The proposed solution is to store JWT tokens in HTTPOnly cookies and use anti-CSRF w/ double-submit ...
0
votes
0answers
52 views

Using phpinfo() to get httponly cookies?

phpinfo() shows all cookies, even the httponly. So the question is - how can I receive users cookis on target website through xss with phpinfo? The xss will contain code that will open phpinfo page in ...
0
votes
3answers
58 views

Typical 'search box' XSS attack

When I develop a site, I'm always conscious of security flaws, but I'm struggling to see how a search box could ever be used to inject script that could be ran on a page of mine. So I understand ...
-1
votes
1answer
30 views

Is this XSS filter safe or not?

I have a classified site, I was wondering if this is secure enough or not, between I got this filter from a friend of mine. var a = window.location.hash.replace(/[^\w\-#]/g, "_"); a = a + ...
1
vote
0answers
95 views

Can an attacker bypass this DOM XSS filter? [closed]

I'm not asking to break someone's security, but can an attacker bypass this filter? What should I add to secure it more or it is enough? var target = window.location.hash.replace(/[^\w-_]/g, ''); ...
1
vote
1answer
51 views

Is this a secure method for dynamically setting X-Frame-Options? (multiple domains)

X-Frame-Options header will prevent your site from being iFramed by other domains. On browsers that accept the ALLOW-FROM directive you are limited to specifying only a single origin. You could use a ...
1
vote
2answers
57 views

XSS in GET request not decoded on backend

So I am pretty sure I know the answer to this question but I want to be 100% sure so I am looking for some input here. A vulnerability was reported to a site of mine that looks something like this: ...
1
vote
3answers
74 views

Safely downloading user submitted content

TL;DR We save the request payload and Content-Type header in a database. It should be JSON or CSV but may be malformed. Support users download the request payload as a file in their browsers using ...
1
vote
1answer
45 views

Stealing user cookies with flash/actionscript

I know I am asking a dumb question here, but pardon me, I am learning. I found two questions viz, How do I access cookies within Flash? and How to Make a button send an email using AS3 ...
4
votes
1answer
92 views

Is this sanitization method secure?

I implemented this sanitization fix: function san($str, $type="full") { switch ($type) { case "full": $str = preg_replace("/[^a-zA-Z0-9_\-]/i", "", $str); break; ...
2
votes
3answers
66 views

Unable to upload a file on xss vulnerable page

I was wondering, if I have a php script, which could upload a file, What if I inject it in a page which is vulnerable to Xss. So, I created one and Here is the code of index.php <html> ...
3
votes
2answers
148 views

How can I execute a XSS when a web application transforms a data from lowercase to uppercase?

I'm testing a web application, when I send an input data to web application, this places the data in an onlcick function, something like this: <a href="#" onclick="someFunction('dataFromServer', ...
3
votes
2answers
84 views

Does DOM XSS work on pages that don't use js?

Can an XSS attack be done on a static page that doesn't use any JavaScript?
3
votes
1answer
57 views

How to prevent data from Interception?

I am a web developer. A few days ago, I used Burp, to intercept facebook's official App over network, by setting up proxy. I noticed that the data was encrypted. While I have been using Json to ...
1
vote
1answer
95 views

Setting the HTTP header X-Frame-Options DENY for static assets

I am checking the security of my Django application through a security scanner and I wonder if it useful to set the X-Frame-Options DENY header on static assets like CSS, images or JS files? I guess ...