Questions tagged [xss]

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

Filter by
Sorted by
Tagged with
3
votes
0answers
54 views

Is this XSS filter for HTML comments safe?

HTML comments can be notoriously tricky from an XSS standpoint, and the standard recommendation seems to be to never put untrusted user data in them. But shouldn't it be possible to strip out a few ...
2
votes
1answer
274 views

Can an XSS exploit on a subdomain steal the cookies of the parent domain?

As per my understanding, if a cookie doesn't have a domain attribute (explicitly telling where this cookie can be used), by default that cookie will be used by the domain which issued it and all its ...
0
votes
1answer
125 views

Application design to avoid XSS & CSRF attacks

I am learning to design a system where it can be guarded against XSS & CSRF attack. I'll quickly list down my understanding and then raise questions. It's a simple case of fraud that I am trying ...
1
vote
0answers
44 views

XSS Vulnerability Reproduction

I have a Qualys web application scan report that says I have a XSS vulnerability. It explains this was detected by requesting a malicious payload and evaluating the response. When I make the same ...
0
votes
3answers
76 views

Xss payload with onpointerover?

I bypassed a WAF and found an XSS vulnerability using the onpointerover event handler. In the page where I found the vulnerability, there's also a login page. What XSS payload can I use with the ...
0
votes
1answer
76 views

Is there a danger to client port scanning?

Are there any security risks associated with client-side port scanning? Or, more specifically, a "trusted" site (e.g., banking website) loading javascript trying to connect to various localhost ports? ...
1
vote
1answer
320 views

Is it safe to call an untrusted service with jquery.ajax and dataType 'jsonp'

From what I understand, the JSON-P technique generates a script tag into the DOM of an HTML page to get across the single-origin restrictions imposed on the XMLHttpRequest JavaScript API for AJAX ...
0
votes
0answers
47 views

How to make a HTTPrequest in JSONP callback?

I'm trying an XSS challenge. I found an exploit that breaks CSP by using a JSONP callback. I can get an alert to pop up by putting something like: <script src="https://whitelisted.jsonp?callback=...
2
votes
2answers
306 views

Can a site vulnerable to XSS be used to attack a site with a CSRF vulnerability?

I heard of the attacks Cross Site Scripting (XSS: An attack where an attacker injects malious client side code (For example: JavaScript) into a web application.) and Cross Site Request Forgery (CSRF: ...
1
vote
0answers
77 views

Is there any way to break the HTML attributes without using single/double quotes?

I have the following code, <li data-type="test" title="?"> test </li> Following values were Not allowed <>&*#%\'"= My goal here is to get a javascript popup to appear. is ...
10
votes
4answers
2k views

Is XSS possible when < is not escaped, but also removed if followed by a character?

I have figured out that < wasn't encoded as &lt;. However it is removed if followed by anything but a blank space. For example, <a will get removed but not < a> (note the space), which ...
2
votes
1answer
130 views

iframes, user generated content and scripts

Currently, we have a small personal project which is meant to allow people to create 'profiles' in HTML/CSS. We aim to put all this generated content within a sandboxed iframe. The next point in ...
1
vote
0answers
235 views

Angular JS alternative xss payload?

Basically, I have a situation right now where the registration website allow to register via email address and then redirects me to another website (subdomain) of the original website. The subdomain ...
0
votes
2answers
76 views

Does choice of DBMS matter for protection against XSS and other injection attacks?

I am choosing between the three most used databases, MySQL, Microsoft SQL Server and MongoDB. I have to choose the most secure database from these three. Does my choice of DBMS has a role in ...
1
vote
1answer
51 views

Avoid cross site scripting in XML namespace

We have a legacy application on spring mvc and we have a web service exposed (SOAP protocol) for some reporting client app. This service was tested by a security team and the report indicates that the ...
1
vote
1answer
75 views

Ingesting markup from WYSIWYG text editors

Maybe I'm missing something obvious here... The development landscape is littered with client-side WYSIWYG text editors (for example, TinyMCE), all of which seem to want to send raw HTML back to my ...
8
votes
1answer
227 views

XSS with escaped equal sign inside jQuery selector

Web-site uses jQuery 1.8.3 which has known XSS vulnerability in selector. (https://snyk.io/vuln/npm:jquery:20120206). It passes filtered and urldecoded document.location.hash (val2 below) value ...
5
votes
2answers
918 views

Is directly echoing the user agent in PHP a security hole?

Is this script vulnerable to PHP or JS code injection? In my quick test I changed the useragent to a PHP script but it will not be executed just printed. If change the user agent to a javascript code ...
0
votes
1answer
445 views

Potentially dangerous request loads the page

I hosted an application in ASP.NET 4.0 webforms. When I am browsing hostname/DressDetail.aspx?<script>alert(313)</script>&category=1&code=76 it is showing an error message like: ...
1
vote
1answer
90 views

Why does javascript not show an alert box? [closed]

I'm trying to insert javascript:alert(1) inside tag. There is some kind of filter for javascript, so I tried using javascrip%74:alert(1) and that url is accepted. However when i click on it it ...
1
vote
1answer
59 views

Sending multiple Content-Length headers in a HTTP POST request using Javascript

I'm playing around with a self-xss bug that I believe I can escalate with a CSRF attack. However, the exploit relies on sending two identical Content-Length headers in a single POST request. ...
0
votes
1answer
71 views

How can i get an alert box from this?

While testing a website i noticed that the value of parameter username is reflected inside the javascript code of the response. It's insert into a variable like this one: var valueUser = "my-...
1
vote
1answer
85 views

Exploiting stored XSS on Android app?

I'm testing Android app which is vulnerable to HTML injection, but I'm having problem escalating it to a stored XSS vulnerability. I have tried these, and many more: <script>alert(1)</...
3
votes
2answers
161 views

XSS with <a> tag with target="_blank`

Basically, I am having an <a> tag with target set to _blank, where an attacker has control over the href parameter, thus possible inserting a javascript tag, like the following: <a target="...
2
votes
0answers
110 views

Is it still possible to use HTTP TRACE for XSS in modern Web Browsers?

Let's assume we are talking about top 10 most used web browsers: Usage share of web browsers https://www.cgisecurity.com/questions/httptrace.shtml 'TRACE' is a HTTP request method used for ...
1
vote
2answers
153 views

Terminate a javascript without “continuous” < and / [closed]

So I am testing a website and found out I can inject most characters, here is what I have found: " is always escaped with \" < and > are not escaped Interestingly, / is only escaped with / if < ...
1
vote
1answer
117 views

Is there an XSS exploit to overcome stringification of all user input?

Question: Is stringifying all user input with something like JSON.stringify enough to prevent xss attacks? If not, is there an example of a xss exploit that overcomes this? Edit for clarification: ...
1
vote
1answer
103 views

XSS in iframe can't access document cookies

I know of a website, lets call it website.com, that has these vulnerabilities: iframe injection: I can inject an iframe with a src attribute, but cannot inject any script directly. Lets say that this ...
0
votes
1answer
38 views

Character filtration in globalisation supported application

I am working on building an application which will be used in various language , to secure from attacks like xss, SQL injection I thought implementing character filteration (whitelisting/blacking) but ...
4
votes
3answers
552 views

CVSS Score for self-XSS (stored XSS)

I have a web application which is vulnerable to stored, self-XSS attack. Proper encoding is not done In the place where the data from a database (set by the same user) is added to response. However, ...
2
votes
1answer
123 views

XSS stored in DVWA

Trying "XSS stored in DVWA" and now I am completely confused. It is not letting me bypass, I tried many inputs and I know what the preg_replace() is doing still nothing seems to work for me. I used ...
2
votes
2answers
333 views

Are there XSS vulnerabilities while image preview before uploading it?

I wrote a JQuery tool to preview images before uploads. User A clicks the explore button to select an image selects it a change-event displays the image If user A selects a prepared SVG image as "...
2
votes
2answers
77 views

Understanding POST based XSS

I have been trying to learn about XSS, more specifically, POST based XSS. But I am unsure if I actually understand how POST based XSS works. With a GET, you can do XSS with the URL parameters, but to ...
1
vote
0answers
50 views

Finding XSS vulnerabilities [closed]

My hosting company have pulled my Drupal website because modsecurity highlighted Pattern match "(?:\b(?:(?:type\b\W?\b(?:text\b\W?\b(?:j(?:ava)?|ecma|vb)|application\b\W*?\bx-(?:java|vb))script|c(?:...
3
votes
3answers
12k views

Stored Cross-Site Scripting Without Parentheses or Spaces

I'm testing a commenting application that takes a link of the form http://google.com and puts it in an href tag as so: <a rel="nofollow" href="http://google.com"> The resulting comment is ...
1
vote
1answer
114 views

Bootstrap 3.3.7 XSS [closed]

I found that Bootstrap 3.3.7 is vulnerable to Cross-Site Scripting (XSS) via the data-target, data-template, data-content, data-title and data-viewport attributes. How can I inject the XSS into these ...
2
votes
2answers
78 views

XSS Mitigation using regex

I am allowing following character in regex that is dash, tilde, attherate, a-z, A-z, 0-9 [A-za-z_0-9.,\t\r()\\[\\]@ ~/[-]+$] Is there any possibility to bypass these regex? Actually, whenever ...
3
votes
2answers
130 views

What does The input is reflected inside a tag parameter between double quotes mean?

A recent scan of Acunetix has shown some vulnerability on one of my pages. I tried reproducing it but i can not find any vulnerability. The so called vulnerably is titled The input is reflected inside ...
3
votes
1answer
12k views

Enable X-XSS-Protection in an ASP.Net MVC Web app

Most of the browsers supports the X-XSS-Protection header to prevent XSS atatcks. How we can enable this header in a ASP.Net MVC application? Do we need to enable it in the application or do we need ...
81
votes
8answers
44k views

What could an “<img src=” XSS do?

Most WAFs when blocking XSS will block obvious tags like script and iframe, but they don't block img. Theoretically, you can img src='OFFSITE URL', but what's the worse that can happen? I know you ...
1
vote
2answers
195 views

Is it possible to bypass this Xss Filter?

I was creating an XSS filter for my node plugin. Is there any way to bypass it? If yes How can i prevent it? function xSSFilter(str) { return str .replace(/&/g, '&amp;') ...
6
votes
1answer
302 views

Risk of allowing the string “xss” in query string

A former employee, put the following in our "global.axas" if (url.Contains("xss")){ response.StatusCode = 404; response.end(); } I get he was trying to prevent cross site scripting, but other than ...
1
vote
1answer
134 views

data:// uri XSS - using wrappers

Is there any way to load html data uri: data:text/html,<html><svg/onload=confirm(1)></html> with this scheme: data:// i have seen this payload going around: data://text/javascript,...
0
votes
2answers
71 views

is it possible to bypass cookie protection to perform a CSRF on HUAWEI HG531 v1 router?

the AJAX login script var xhr1 = new XMLHttpRequest(); xhr1.open("post", 'https://192.168.1.1/index/login.cgi', false); xhr1.send("Username=admin&Password=...
0
votes
1answer
80 views

How to fix XSS in rails

I am able to inject javascript:alert `1` or javascript:alert(1) into the href field of the rails app and it is getting executed as JavaScript. Html encoding is already implemented but it doesnt encode ...
0
votes
2answers
110 views

Is acquiring the csrftoken alone sufficient for performing any security exploits?

I have confirmed the presence of reflected XSS vulnerability in my website and I see the csrftoken present in one of the cookies when injecting a document.cookie in javascript. We don't have the user-...
1
vote
1answer
64 views

Is using default-src * safe?

I have a website to do security testing. The CSP is as follows. default-src * ; style-src 'self' 'unsafe-inline' data: https://netdna.bootstrapcdn.com/ http://s3.amazonaws.com/ https://s3.amazonaws....
0
votes
0answers
80 views

Is throwing malicious strings in json_encode a good way to evade Stored XSS?

I'm aware that filtering strings doesn't go this way, but when encoding xss payloads into json format in php and storing that information temporary in classes, the result in the browser, it will show ...
3
votes
1answer
188 views

Is it safe to allow arbitrary image formats in comments?

I know it’s not safe to allow arbitrary images in comments without proxying. I just saw this feature. It seems that all current user agents which implement it disable scripting and external resource ...
2
votes
1answer
124 views

Stored XSS + PHP Backdoor + File upload vulnerability

I built this web application(Used PHP 5 + MySQL) where I could take advantage of file upload vulnerability and XSS. My route of attack is: Upload a PHP backdoor which I built with msfvenom Go to ...