Questions tagged [xss]

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

Filter by
Sorted by
Tagged with
1 vote
0 answers
30 views

Is the ability to inject arbitrary CSS styles in an img tag a security vulnerability?

I've discovered a behavior in a popular service's markdown parser that allows the 'style' attribute to be used within 'img' tags through some crafted markdown code. This allows for the application of ...
LunaXenon's user avatar
0 votes
0 answers
17 views

Does other frontend framework have similar issue like AngularJS?

I'm reading an article that talks about XSS exploitation on AngularJS, AngularJS will render the template in ng-html, and it bypasses sanitize-html. My questions, I'm wondering if other frameworks ...
daisy's user avatar
  • 2,057
0 votes
0 answers
27 views

Can you inject permanent code into a website by client-side XSS? [closed]

Is there a way to permanently add code to a website vulnerable to client-side XSS? so if you refresh the page, it is still changed? if you can, how?
Trazerman's user avatar
1 vote
1 answer
32 views

Is it safe to store the OIDC token in a private field of a javascript object?

I would like to initialise a React application with an OIDC token. This token will be stored in a private field of the "api client" object. This object will be used to execute API calls and ...
Marco Altieri's user avatar
0 votes
1 answer
95 views

Is this a type of XSS attack?

I have been exploring customer support in a website as part of bug bounty program. I then started a chat with their customer support and pasted the following in the box: <!--<img src="-->...
Testing Graphics's user avatar
0 votes
0 answers
46 views

Security frontend side

Hi i´m a frontend developer and next week we will have a security audit i need to be sure that frontend side is secure and dont have vulnerabilities, so my question is, ¿What would you recommend or ...
David Medina's user avatar
0 votes
1 answer
740 views

Why can't we close some tags for cross site scripting purposes?

There's a webstore that i am trying to find a XSS vulnerability for BUG BOUNTY. On that store is a search bar that i can send anything https://www.examplestore.com/blog/?s=</title><script>...
Victor Lucas Mazzotti's user avatar
0 votes
3 answers
101 views

is a stored xss possible if user input is not saved?

I was wondering if a stored cross-site scripting attack is possible if the user input is not saved. If a website is vulnerable to an xss attack, can someone put in a code or something that stores a ...
Trazerman's user avatar
2 votes
0 answers
40 views

Security in Angular: Addressing XSS Concerns with External Libraries and Interpolation

Introduction: We heavily use external libraries, such as DataTables, in combination with interpolation. In Angular, we've identified two primary XSS prevention strategies: Interpolation ({{ }}) ...
VJSpeter's user avatar
0 votes
0 answers
58 views

How to abuse the onerror method to get XSS?

In the book Javascript for hackers, Gareth Heyes overwrites the window.onerror method with eval, used to execute a function. From my understanding, the following snippet run in a browser console ...
Riccardo D's user avatar
0 votes
0 answers
34 views

Safe Sinks js confusion

Have some confusion regarding safe sinks in javascript. The DOMpurify library linked in the OWASP article does not explicitly mention the .files and .valueAsDate of an HTMLInputElement as safe sinks, ...
okzoomer's user avatar
  • 101
0 votes
0 answers
64 views

CSP script-scr blob

What are the risks to allow a "blob:" directive to the script-src CSP? Is it safe? I have a list of allowed domains defined in script-src, but nonetheless I got an error specifying the ...
Giuseppe Canto's user avatar
0 votes
2 answers
66 views

Simple XSS Example Involving AJAX not Firing

In creating a simple demonstration of XSS I'm failing to see the result of the injected code, and I'm wondering what simple thing I've overlooked. This is the code that handles the AJAX request after ...
Stephen's user avatar
  • 175
2 votes
2 answers
398 views

CVSS3 score for XSS leading to account takeover

Let's say there is a XSS vulnerability in a web application. The XSS allows an attacker to hijack the user's session. Within the session, the attacker can view/modify the user's credit card and ...
mateleco's user avatar
0 votes
0 answers
152 views

XSS Payload That Can Bypass Special Character Check

I developed the following C# algorithm to prevent XSS attacks: private bool Is_There_XSS_Payload(string arg) { Regex regex = new Regex(@"^[a-zA-Z0-9]+$"); bool result = ...
KosD's user avatar
  • 1
0 votes
0 answers
33 views

XSS: bypassing html entity encoding of <,>,& characters [duplicate]

I am currently testing a webapplication that is sanitizing user input by html entity encoding special characters. E.g. <script>alert(1)</script> becomes &lt;script&gt;alert(1)&...
Pascal3366's user avatar
0 votes
1 answer
351 views

Using window.open('',"_blank") can this be XSS exploited?

If I have javascript that opens a window using the code below, the content is a user supplied variable that is not sanatized. Is there any security risk in this situation. The content will only be ...
Henry's user avatar
  • 113
3 votes
1 answer
556 views

Why is the browser not sending cookies with cross-domain WebSocket handshake request?

If I have understood Cross-Site WebSocket Hijacking (CSWSH) attack correctly [1][2][3][4], the attack relies on two things (examples are from the first reference): the browser sending the cookies set ...
sherlock's user avatar
  • 559
0 votes
1 answer
83 views

Is <img :src="require`${JSON.parse(string)}`"> in electron vue is safe from XSS?

I am inspecting a client's application written with Vue.js and I found there a following construction. // Somewhere else in the code var data = JSON.parse(jsonString); // In the vue component <...
Max's user avatar
  • 101
1 vote
1 answer
430 views

XSS in document.write(location.href)

Let's say a website contains the following <script> tag and does not have a CSP blocking any execution here. <script type="text/javascript"> document.write(location.href) </...
J Heschl's user avatar
  • 113
1 vote
0 answers
110 views

Reflected XSS but no Content-Type is specified

I have found parameter that simply reflects into response body, but no Content-Type is specified by server. It doesn't use any XSS-protection mechanisms like CSP or X-XSS-Protection. However, I was ...
ksenia pi's user avatar
2 votes
1 answer
328 views

Why don't Internet browsers allow me to fetch a JSON file from raw.githubusercontent.com, but they allow me to fetch .psm files from there?

When I was making my PicoBlaze Simulator in JavaScript, I added 6 examples of how to use it. Those examples are on my GitHub profile, they are the .psm (PicoBlaze Assembly) files. I decided not to ...
FlatAssembler's user avatar
0 votes
0 answers
44 views

Are there any html Sanitizer() API configs that allow javascript execution?

I'm talking specifically about the HTML Sanitizer API: https://developer.mozilla.org/en-US/docs/Web/API/HTML_Sanitizer_API The API allows you to configure the sanitizer with a list of allowed elements ...
user1131308's user avatar
0 votes
1 answer
136 views

With Response header having content-type: application/json, is it still possible to trigger XSS?

The application is responding using the user supplied request but the content type is set as application/json. Is it possible to trigger still XSS? This is a language neutral question, it can be Java,...
warrior-oo7's user avatar
0 votes
2 answers
74 views

What defines an XSS vulnerability? (my case) [closed]

I was in a bug bounty. I can't be sure of this problem because it's all over the website. Will this be harmful for the organization? When I exit the angular brackets and paste the payload, it pops up ...
Wade Thrillson's user avatar
1 vote
1 answer
85 views

Is this code vulnerable to DOM XSS?

const scriptElement = document.createElement('script'); // Set the source (src) attribute scriptElement.src = '/evil.js?'+decodeURI(urlParams['sync']); // Append the script element to the HTML ...
Spiderman Khalifa's user avatar
0 votes
1 answer
66 views

XSS not executing properly

Instead of receiving Alert(XSS) I get [object Object] The application is expecting a .csv file and the name of the file is being reflected. I put the original .csv file and then I remove it in order ...
ilich262's user avatar
3 votes
1 answer
2k views

Is it safe to use font-src with data: in a Content Security Policy?

I'm currently experiencing an issue where base64 encoded fonts are being blocked by CSP on my website (note that I replaced the base64 with abcdefg in this example: Refused to load the font 'data:font/...
x3nr0s's user avatar
  • 133
1 vote
0 answers
110 views

HTML tags converting into entity characters in XSS [closed]

When I type xss in a search box, it's reflecting and when I inspect it, it's showing as <h1>Search results for: xss</h1>. So I tried to inject script <img src=x onerror=alert(1)> and ...
Noob Hunter's user avatar
1 vote
2 answers
430 views

XSS in a href with target=_blank

I have found out that in most browsers the following code won't execute: <a href="javascript:alert(1)" target=_blank>click</a> But the same code without blank will. My question ...
The Modern Gamer's user avatar
1 vote
1 answer
104 views

JS bug is stopping my xss payload to exeute

The XSS vector is at the * but the function issue_type is not declared hence my payload is not getting executed. following is the instance of the vulnerable code:- <select name="sub_subissues&...
joao silva's user avatar
1 vote
2 answers
263 views

Reflected XSS detected by Burp Suite not working

Burp Suite detected a reflected XXS, if I use the Repeater and send the request the payload shows up in the response unfiltered, but if I visit the url it gets filtered, is there a way to bypass it or ...
Samuele Giovanetti's user avatar
0 votes
1 answer
325 views

XSS bypass in url

I have a website: https://bugbounty.com/test/"injection inside js", but " is escaped with \ and I'm trying to inject </script><script>alert() but https://bugbounty.com/test/&...
Edward Akina's user avatar
1 vote
2 answers
359 views

xss: is it possible to continue javascript code execution after a "throw new Error()" line?

there is this javascript file that a can inject code after throw new Error("error string") line. But it seems that after the throw statement, no code can be executed. throw new Error("...
nv92Cczb1's user avatar
1 vote
1 answer
177 views

How is a XSS attack possible in this context?

I'm testing a website, which is vulnerable to XSS. <input type="hidden" id="referer" name="referer" value="INJECTION_POINT"> <script> document....
Hyper's user avatar
  • 11
1 vote
0 answers
272 views

force XSS after bypassing Request.Form using URL Encoding

I am testing a cross-site scripting attack on a website, as we all know the Request.Form function validates the input so the user couldn't insert a <script> inside the input. My focus in this ...
syk's user avatar
  • 11
0 votes
0 answers
61 views

Is storing access token in private data, refresh token in http-only cookie safe?

Backend: Django / Django Rest Framework, would be hosted at GCP k8s Frontend: Angular, would be hosted at some CDN e.g Vercel Authentication: JWT (https://github.com/jazzband/djangorestframework-...
Ahmad Bilal Khalid's user avatar
1 vote
0 answers
57 views

Understanding browser text input value rendering for combatting XSS

If you use inspect in the developer tools for Chrome the values for the two input boxes below will look the same. <input name="test1" type="text" value="<script>alert(...
tony's user avatar
  • 111
1 vote
1 answer
610 views

How to alert cookie in 30 character XSS payload?

The application allows user to enter a 30 character long username. I tried the following XSS payload and it worked, but the triager is asking if I can alert cookie. But script tags and src keyword is ...
alisa's user avatar
  • 11
0 votes
1 answer
98 views

Validating XSS script with success response with expected data in REST API

I am performing security testing on a REST API and it is a POST method. I injected an XSS script in a body parameter and the API responded with '200 success' response with the actual expected data. If ...
sowmiya's user avatar
1 vote
3 answers
955 views

What exactly are Hidden HTTP Parameters?

I read a lot of reports where 'hackers' potentially exploited a 'Hidden HTTP Parameter'. There are also tons of tools which are developed for this exact purpose. Example : https://blog.yeswehack.com/...
Just.a.tech's user avatar
0 votes
2 answers
217 views

What are the risks of XSS in this forms?

I recently developed a website that was operational for me ^^ However, someone came to try injections and found an XSS flaw. I have a form like this: <h2> <span>Search</span> </...
Lynow's user avatar
  • 1
0 votes
0 answers
422 views

CSP for Single Page App: Use client-side nonce for securing iframe content

Goal I'd like to tighten my Content Security Policy. Situation I have a single page react application (= All code and styles are bundled together into a bundle.js file). The file is simply placed on a ...
DarkTrick's user avatar
  • 101
0 votes
0 answers
127 views

XSS payload with html Encoding

I was reading about XSS Contexts on Portswigger and it has a section about the use of HTML-Encoding in bypassing input validation. What i understand is : The browser html decodes the entities before ...
Shoaib Wani's user avatar
0 votes
1 answer
68 views

Why do you think this code isn't firing?

I don't have a lot of knowledge about xss so im kinda confused, why this is not popping up an alert box?
fiirat's user avatar
  • 1
0 votes
0 answers
26 views

I clicked what looked like an Amazon email, but it (maybe) was from an Amazon affiliate. Ended up at Amazon.com anyway. Can I safely investigate? [duplicate]

In a case of clicking too fast, I clicked on a picture that looked like it was from Amazon. However this was not the case. I did end up at Amazon, but I'm aware that other things could've taken place ...
Moochcar's user avatar
0 votes
1 answer
97 views

How do browsers defend the user against XSS?

I'm learning about the different mitigations employed by browsers against XSS vulnerabilities. Let's say, the developer made a mistake and there is a XSS vulnerability on a site. Unfortunately, a ...
Loresim's user avatar
1 vote
1 answer
312 views

Jsoup XSS attack with URL encoded input

I'm having a Spring Web Application that exposes REST APIs. I have implemented XSS filter using Jsoup that strips the input using Safelist.NONE. The penetration testing team raised a concern where the ...
Yuval Simhon's user avatar
1 vote
0 answers
73 views

Storing auth token in html

Current projects webs application utilises a cookie based approach to store users auth token. Implemented with secure and http-only attributes set. All traffic over https. The application loads third ...
Sam's user avatar
  • 11
1 vote
0 answers
406 views

Client-side Javascript injection by assinging the output of window.location.href.substr to a variable

Sample code: function winLoad() { var sessionId = ''; if (window.location == window.top.location) { var semicolonIndex = window.location.href.indexOf(';'); if (semicolonIndex !=...
jne's user avatar
  • 11

1
2 3 4 5
31