Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [xss]

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

0
votes
0answers
7 views

How to get admin cookie with Persistent XSS?

Two parts to this question. Let's say there is a site which accepts my input and sends it in XML format to server. When I enter the input as shown here: https://ghostbin.com/paste/hc5n6 The reason I ...
0
votes
3answers
107 views

Why doesn't XSS execute when bypassing HTML encoding?

I am trying to execute an XSS payload on a search field that takes my input like this: <input name="q" id="gsasearch" type="text" value="My Input"></input> Observations: <, > and "...
1
vote
1answer
32 views

What are a JSON rest api's responsibilities to prevent XSS? [duplicate]

I'm building a rest API that serves exclusively JSON. It might one day be consumed by a browser based app. Is there anything I should do on my end to prevent XSS attacks?
1
vote
0answers
50 views

Should sensitive tokens be stored in localStorage or an HTTPOnly cookie?

In the context of a web application... should sensitive tokens, such as those used for sessions, authentication and/or authorization, be stored in localStorage or an HTTPOnly cookie; or are they both ...
0
votes
1answer
53 views

Can registration forms be used for an XSS attack?

In most websites that have account logins, there are at least two fields: Email Password Could either of these fields be used to mount an XSS attack (assuming no character encoding)? For example, ...
0
votes
4answers
95 views

XSS payload shorter than 20 character

For an university project I have to perform an analysis on a web application to find out XSS vulnerabilities. After this I have to report and create automatic test to prove vulnerabilities that I have ...
0
votes
1answer
51 views

Can Arbitrary Code Execution be done using CSS Injection?

As part of our class project, we are studying the attacks that could be done using CSS Injection. In our threat model, attacker can manipulate any CSS file on the server. If attacker replaces original ...
0
votes
1answer
46 views

Is the following javascript code vulnerable to DOM XSS? [duplicate]

I have the following javaScript code in an application, which BURP flags as being possibly vulnerable. However, i have had no luck trying to get it to execute. var hash = window.location.hash; if(...
0
votes
2answers
102 views

'=' and '(' are bypassed XSS [on hold]

How can I add = in my script when return input.replace (/ [= (] /g, ''); is replacing it? This is only for education purpose solving CTF. Used HTML codes but not working.
0
votes
1answer
62 views

Not convinced on the security of a JWT Token + CSRF Token

Lets suppose I have a web application that uses JWT tokens and CSRF Tokens in its authentication scheme. As I understand it, it works like this: When a user logs in, the client sends a login request. ...
1
vote
2answers
112 views

What to do about vulnerability in a SaaS product I buy?

I work for a university, where I am part of the team responsible for integrating a SaaS Learning Management System (eg: Moodle, Canvas) with the rest of the university's systems. Two months ago, I ...
-2
votes
0answers
38 views

How to Bypass Backslash Escaping before any suspicious character?

I'm trying to bypass some XSS filtering. Every time I insert a suspicious character like slash or double quote, I get a backslash before it, as shown below: My payload source : ‍"></script>&...
1
vote
1answer
78 views

XSS in custom, user-supplied CSS

Users of our web app would like to use custom CSS to customize parts of UI. I've came up with some kind of blacklist for CSS "bad words" and I'm curious whether it is sufficient or if I need to ...
0
votes
3answers
107 views

XSS: Code payload gets displayed on the screen as a string

I am new to security and trying to improve. Sometimes when I try to find XSS vulnerabilities on a website my payload just get displayed on the screen but nothing happens. The whole payload just gets ...
2
votes
2answers
93 views

Content Security Policy Header not stopping attack

I created a simple test web application to test the use of the content security policy header. I included a vulnerability in my test app, such that submitting a basic XSS payload with script tags ...
0
votes
1answer
60 views

Inject JavaScript code into websites requested by an Android app? [closed]

How can I add custom scripts to pages I'm opening on Android via Chrome, Firefox or any other internet browsing app?
0
votes
2answers
73 views

XSS alert not working with concatenated string

I've noticed that the following Stored XSS does not execute, whereas in the JS console it works: <img src=0 onerror=alert(document.domain+": "+Date.now())> This doesn't prompt an alert box. ...
0
votes
1answer
43 views

Reflected XSS in multiline script block

I am trying to exploit a reflected cross site scripting in a GET request where the reflection is in the first multi line script block. It seems I can use every character but <, > and " and the ...
0
votes
3answers
216 views

How can I exploit a XSS vulnerability which doesn't allow me to type < and > symbols and puts my input in double quotes?

I have the following script: function filter() { const inputstring = JSON.stringify(document.getElementById('input').value) .replace(/[<]/g, '%lt') .replace(/[>]/g, '%gt'); ...
1
vote
1answer
80 views

Bypassing XSS filter replacing characters?

Is it possible to bypass an XSS filter that replaces the malicious characters? I've prepared this filter: searchTextField.replace(/</g, " ") .replace(/>/g, " ") .replace(/"/g, " ") ...
0
votes
2answers
34 views

Can an xss vulnerability without authentication be exploited?

I am confused about the attack surface made possible by an XSS vulnerability. Suppose I have a simple web application that does not involve authentication (perhaps a "word of the day" kind of thing). ...
1
vote
0answers
66 views

Understanding XSS

So, I am trying to understand how XSS works and I gathered some information online and crafted the code. Following is the snippet. When I enter some value in the text field and submit, the script ...
0
votes
0answers
57 views

XSS : How to bypass htmlentities when < > " & is escaped and no input is inside a tag attribute with single quote? (the page is UTF8)

So lets say we have a website where they use htmlentities and everything like < > " & is escaped but not ' (single quote), but the problem is the only input available inside a tag is inside a ...
0
votes
1answer
99 views

How does OWASP ZAP find Reflected XSS?

What I'm doing: I'm using OWASP Zap to find vulnerabilities in a site (I have the owner's consent) and Zap came up with a Reflected XSS Vulnerability after I did an active scan on a POST request. It ...
3
votes
1answer
92 views

How to safely allow scripts but preventing XSS?

We are trying to find the best way to allow JavaScript in a web application while being safe against XSS. Site admins have the privilege to insert JavaScript to control the site templates, and ...
3
votes
2answers
176 views

Use XSS vulnerability in iframe to compromise parent?

I have a site, let's call it parent.com, that embeds a third party plugin from child.com in an iframe. I have found a XSS vulnerability on child.com. The embedded page from child.com contains a form ...
2
votes
2answers
85 views

Do browsers XSS filters protect against DOM based XSS?

Many (but not all) browsers come with built in XSS protection that can be activated with a HTTP header: X-XSS-Protection: 1; mode=block As I understand it, it prevents reflected XSS attacks by ...
1
vote
1answer
67 views

Remote code execution and XSS vulnerabilities. What steps should be taken to secure a server once these are discovered and patched?

I've just been notified of a remote code execution vulnerability and an xss vulnerability on a site that I run. I've fixed the responsible code, but I'm wondering what steps should be taken afterwards ...
2
votes
2answers
133 views

Does rendering of user supplied content imply an xss vulnerability?

I am working on a chat program in my spare time. If a user inputs html it will be rendered, for example, <a href="example.com">link</a> will render a hyperlink. At the same time, if you ...
3
votes
1answer
93 views

Why the following XSS vectors work without closing bracket?

The following XSS injections will execute without the accompanying closing tag (see this demo): <body/onload=alert(1) <svg/onload=alert(1) <iframe/onload=alert(1) I just need to know why ...
0
votes
1answer
124 views

What would be the impact of a CVE-2015-9251 vulnerability?

I've seen that in jQuery versions older than jQuery 3 there is the CVE-2015-9251 vulnerability which can result in cross-site scripting. Is this a limited vulnerability? What could be its possible ...
15
votes
3answers
4k views

Does incognito/private browsing prevent XSS attacks?

When starting an incognito/private browsing session, no cookies from other browsing profiles should exist. For example, if I am logged in to a site on my main browsing profile, then start a new ...
0
votes
1answer
105 views

Is XSS exploit always illegal? [closed]

I recently got a great deal of $$ stolen by scammers. I am trying to use XSS exploitation to find his real identity (IMSI, IMEI, External IP, Internal IP, any computer unique ID) Is it legal? I am ...
2
votes
2answers
67 views

What is client side non-DOM XSS?

I've been reading on the new categories of XSS. According to OWASP, they're no longer just reflected, stored and DOM-based XSS, but rather server/client side, and then subdivided into reflected/stored....
2
votes
1answer
81 views

Are unescaped backslashes dangerous in terms of XSS?

I thought the \ (backslash) character was a dangerous character that you needed to filter out/properly encode to protect against XSS attacks (OWASP says so, too), and I still do, but why? I found a ...
0
votes
1answer
110 views

How can I execute a XSS on 302 redirect and the body on the page?

Is there a way to execute XSS? on 302 redirect and the body on the page? <HTML><HEAD> <TITLE>302 Moved Temporarily</TITLE> </HEAD> <BODY> The document has moved &...
1
vote
0answers
68 views

Bypassing double quote in DOM based XSS?

I am trying to generate a POC for DOM XSS exploit. I could inject a code using the following link: <a href="wepage.jsp" target='&quot;><script> alert(document.cookie)</script>&...
0
votes
1answer
46 views

DOMXSS - Is Input Field Content an Attack Vector?

A typical example for DOMXSS is that vulnerable code carelessly processes the part after the hash mark as in https://www.example.org/path/param1=val1&...#PAYLOAD_HERE without validation. For ...
1
vote
1answer
145 views

MageCart attack on Newegg

I am reading about an attack that occurred during August of this year conducted by the group MageCart through the use of "card skimming" to steal credit card info from Newegg users. While reading ...
1
vote
2answers
124 views

Can a site vulnerable to XSS be used to attack a site with a CSRF vulnerability?

I heard of the attacks Cross Site Scripting (XSS: An attack where an attacker injects malious client side code (For example: JavaScript) into a web application.) and Cross Site Request Forgery (CSRF: ...
1
vote
1answer
79 views

Is XSS via MIME sniffing a Stored or Reflected XSS?

The title says it all. I understand how to exploit XSS via MIME sniffing, but the question is, do you call this type of XSS stored or reflected? OWASP says Stored attacks are those where the ...
1
vote
0answers
103 views

How can I steal all cookies from reflected XSS?

I just found a website with a XSS vulnerability. When I visit the following URL, a pop up occurs: https://example.com/article/HALLOWEEN"><script>alert(1);</script> I have a ...
1
vote
0answers
152 views

How did the recent British Airways hack go down?

How did the Magecart group manage to inject their malicious code into the source code of the BA ticketing site? I have read two articles, one of which said, it could be because BA was not checking ...
32
votes
7answers
6k views

How do hackers make the victim access an XSS attack URL?

As I understand it, the basic idea of XSS is to let the user's browser execute some malicious code created by the hackers. Say, if a page has a vulnerability of loading arbitrary script when user ...
4
votes
3answers
1k views

Is this code vulnerable to Reflected XSS?

I'm doing a pentest and came by this code: (function() { var subdomain = (function() { var query = /[?&]css=([^&#]*)/i.exec(window.location.search); if(...
-1
votes
1answer
227 views

Is it dangerous to use javascript:window.open in href tags?

I have a website and would like to create a link to share information on a third-party site. Is it safe to use the javascript:window.open() function to do this? If unsafe, are there any ways this ...
1
vote
1answer
71 views

Does escaping/cutting of <> prevents you from XSS [duplicate]

I have an input, which displays a value (Firstname) in a box on the page. On the server side, the input is escaped by following rule (vb.net): Public Function UnescapeString(strValue As String) As ...
3
votes
2answers
220 views

Why does “<!--<script>” in a JS string cause a broken page/denial of service for that page?

I was under the impression that all I needed to do to make inline JSON safe was to break any closing </script> tags in strings, e.g. escape the / like <\/script>. However I found a weird ...
1
vote
1answer
36 views

How does Software Defined Perimeter (SDP) protect against certains attack that happen in the browser?

I have been doing a bit of research on SDP (Software Defined Perimeter) but it's still a bit unclear to me how it protects against certain types of attacks. On Wikipedia it says that it can protect ...
2
votes
1answer
60 views

What stops us from using an <antiscript> tag to stop XSS?

I am aware of various ways to prevent XSS attacks, such as escaping and encoding, which are prone to issues, and using a Content Security Policy which requires extraction of all scripts. However, what ...