Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [xss]

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

1
vote
1answer
107 views

Can an XSS exploit on a subdomain steal the cookies of the parent domain?

As per my understanding, if a cookie doesn't have a domain attribute (explicitly telling where this cookie can be used), by default that cookie will be used by the domain which issued it and all its ...
1
vote
1answer
147 views

XSS vulnerabilities: how dangerous are they?

A lot of articles underline that XSS vulnerabilities can be very dangerous for the website on which they exist. I wonder how much is this true when we find these XSS vulnerabilities on the frontend of ...
0
votes
1answer
82 views

Application design to avoid XSS & CSRF attacks

I am learning to design a system where it can be guarded against XSS & CSRF attack. I'll quickly list down my understanding and then raise questions. It's a simple case of fraud that I am trying ...
0
votes
1answer
106 views

CSRF and XSS protection via Header & Cookie-based JWT (tokens)?

I have built a REST API, where users login, with extra permissions in some cases (or restricted to certain areas of the site; or even admin privileges). What I've built: JWT authorization (added to ...
0
votes
2answers
43 views

Does choice of DBMS matters in the protection of XSS and other injection attacks

I have filtered into 3 most used databases, MySQL, Microsoft SQL server and mangoDB. I have to choose the most secure database from these three. Does my choice of DBMS has a role in protection ...
2
votes
1answer
80 views

XSS stored in DVWA

Trying "XSS stored in DVWA" and now I am completely confused. It is not letting me bypass, I tried many inputs and I know what the preg_replace() is doing still nothing seems to work for me. I used ...
2
votes
2answers
266 views

Are there XSS vulnerabilities while image preview before uploading it?

I wrote a JQuery tool to preview images before uploads. User A clicks the explore button to select an image selects it a change-event displays the image If user A selects a prepared SVG image as "...
1
vote
2answers
99 views

How to exploit XSS vulnerability through an iframe

Recently, I found a stored cross site scripting vulnerability in a rather large website, but I am not sure if it is dangerous or worth reporting. On this website, there is a resource section that is ...
24
votes
5answers
38k views

What is Reflected XSS?

Fed up with the following definition. Reflected attacks are those where the injected script is reflected off the web server, such as in an error message, search result, or any other response that ...
2
votes
1answer
77 views

Is it safe to let the user name an object key in JavaScript?

Recently I found a piece of code that takes input from the url. The input then get's saved into a javascript object: https://website.com/?foo=bar var x = {"foo": "bar"}; While the value doesn't ...
1
vote
0answers
50 views

WAF is set to Alert, not block. We are seeing thousands of XSS and SQL Injection attacks. How can I tell if any were actually successful?

I'm pretty inexperienced with WAFs and the events/alerts it generates. I'm wondering how I can tell if any of those were successful? For example, in the last 24 hours we saw over 50K alerts/events ...
0
votes
1answer
56 views

Is my checkNumber() function secure?

function checkNumber(number) { event = document.all ? window.event : number; key = document.all ? event.keyCode : event.which; window.event.keyCode if(key<48||key>...
0
votes
0answers
39 views

XSS vulnerability [closed]

I have a html page and a segment of PHP code. I know that is vulnerable to an XSS attack but I don't know how to perform the XSS attack. HTML <!DOCTYPE html> <html> <body> <h1&...
1
vote
1answer
58 views

iframes, user generated content and scripts

Currently, we have a small personal project which is meant to allow people to create 'profiles' in HTML/CSS. We aim to put all this generated content within a sandboxed iframe. The next point in ...
0
votes
0answers
47 views

How to bypass character filtering in XSS?

I am solving XSS challenges. I found difficulty in one that filters the character "o" both uppercase and lowercase. I can run tag. I have to call function "prettyRobot" to complete the cahllenge. But ...
0
votes
1answer
65 views

XSS: Character showing in DOM

I have created an html page that redirects user to a test site that has an XSS vulnerability. I am able to successfully execute javascript via the vulnerability. However, I have found that some of the ...
3
votes
1answer
124 views

Find security weaknesses in this website (exam question)

I am currently studying for a computer security exam and I am stuck on the following question from a past exam paper 1c <form action=”message.php” method=”get”> 2c <p>Message: <input ...
12
votes
2answers
9k views

How does BeEF work and how can it be persistent?

BeEF - the browser exploitation framework. I think (thought) I had a basic working understanding of how it works. Recently, though, I was watching, this DEFCON talk, where a hacker used a man-in-the-...
0
votes
0answers
28 views

What are the risks with leaving the offending anchor portion of an URL in a failed client-side XSS attack?

As a simple example, let's assume that I have implemented a key-value lookup within a pre-populated, static JavaScript dictionary. Let's say that the dict is: a = { 'one': 'uno', 'two': 'dos' }; The ...
1
vote
1answer
127 views

Bypass a simple XSS filter that only looks at <

Say, I have a page where the input from the user is taken and is passed through a simple client-side XSS filter. That filter only replaces < characters with ''. in = in.replace(/[<]/g, ''); ...
0
votes
1answer
79 views

Bypassing htmlspecialchars() for XSS (Reflected) and using an event handler is not an option in this case

I am trying to bypass high security XSS on DVWA. So the vulnerable code(I highly doubt that is it really vulnerable?) is:- <?php if(!array_key_exists ("name", $_GET) || $_GET['name'] == NULL || $...
59
votes
9answers
12k views

How hard should I try to prevent a user from XSSing themselves?

Let's say a user can store some data in a web app. I'm now only talking about that sort of data the user can THEMSELVES view, not that is intended to be viewed by other users of the webapp. (Or if ...
0
votes
1answer
78 views

Is it possible to bypass this Xss Filter?

Everyone, I was creating this XSS filter for my node plugin and I want to know is it possible to bypass this? function xSSFilter(str) { return str .replace(/&/g, '&amp;') ...
1
vote
0answers
29 views

If and why is it safer to output JS literals into an HTML tag than JS encode them and set them directly to a JS object?

From ASP .NET Core docs about preventing XSS: Before putting untrusted data into JavaScript place the data in an HTML element whose contents you retrieve at runtime. If this isn't possible, then ...
36
votes
9answers
11k views

How dangerous is XSS?

I am a software engineer and have been watching a lot of videos about XSS. But I fail to understand how is it dangerous if it runs on the client side and does not execute on the server side which ...
0
votes
0answers
32 views

Finding hidden parameters manually for XSS

I am researching about XSS and Google helped me a lot about learning like how to bypass XSS filters, POST and GET based XSS . I am really curious to know how to find hidden parameters manually for ...
1
vote
4answers
800 views

How to prevent self-XSS?

I am creating a website which solely uses REST api for all the features and functionality, from signup and login to fetching data and populating the webpage using Mustache as template engine for ...
10
votes
2answers
4k views

Facebook's warning of self-xss

I happened to open my browser console on Facebook recently and was greeted with the following message. Stop! This is a browser feature intended for developers. If someone told you to copy and ...
0
votes
2answers
51 views

Is eval() in JavaScript considered self-XSS?

I found eval() in the JavaScript code of a site in HackerOne. I could not find the where the function is called, so to test the vulnerability I went to console in Chrome and wrote the method and a ...
0
votes
4answers
138 views

Is XSS and HTML injection the same?

When doing a XSS, we usually put the JavaScript code between the <script> tags. I have noticed that HTML injections are very similar because you are doing almost the same thing, but using ...
2
votes
1answer
7k views

XSS - Bypass this RegExp

How could this anti-xss regexp be bypassed: /<(?:\w+)\W+?[\w]/ I am working on it but I can't find a way. Just to be sure that I have understood it correctly, this regexp search for a pattern ...
5
votes
1answer
2k views

Why isn't this XSS working?

I'm learning DOM XSS and I have this code : <html> <body> Select your language: <select> <script> document.write("<OPTION value=1>"+document....
13
votes
1answer
950 views

Is XSS in canonical link possible?

During regular pentesting of my site I discovered that I can close double quotes in a canonical link tag and enter an onerror attribute with a simple javascript alert(1). It is visible in source ...
0
votes
1answer
87 views

XSS triggered but chrome didn't show popup. What exactly was going on?

Related to my previous question on XSS in canonical link. At the beginning I turned off Chrome's XSS auditor and tried executing XSS with just onload event using following payload which did not ...
3
votes
1answer
492 views

Character escape sequences for “>”

OWASP gives all character escape sequences for "<". Where can I find a similar list for ">"?
0
votes
1answer
95 views

xss payload “-confirm``-” [duplicate]

I found -confirm``- this payload on xsstrike while scanning one of my websites. I want to know more about it.
0
votes
0answers
15 views

Bypassing < > XSS filter on a website [duplicate]

<a href="https://website.com"><span style="color: black;">text</span></a> I am trying to bypass an XSS filter but it is not working since given <, > are filtered and become ...
0
votes
1answer
225 views

Is there a way to exploit jquery 1.12.4 vulnerability?

According to https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=jquery+1.12.4 and https://snyk.io/test/npm/jquery/1.12.4, I see that jQuery 1.12.4 has medium serevrity vulnerability. I checked on ...
-1
votes
0answers
69 views

Deobfuscation Malicious Javascript Codes

I want to deobfuscate malicious code where they are embedded in the URL. I have these URLs downloaded from here, where the URLs are embedded with malicious JavaScript. URL
3
votes
2answers
228 views

Is this hybrid (cookie, jwt) authentication method for web applications known and practical?

I have been working with web applications for a while, some months ago I found a possible approach to get the security advantages from Browsers while using cookies for authenticating requests, with ...
2
votes
2answers
6k views

Bypass Asp.Net 4.6 “A potentially dangerous Request.QueryString value was detected from the client”

I'm testing an application where the application does not handle special characters but request validation in ASP.NET picks it up and throws an exception. There have been some different ways to ...
-1
votes
1answer
96 views

Can running javascript from the console be considered as XSS?

I did it from the console. Is this a security issues?
0
votes
1answer
49 views

Is it worth using a client-side XSS-focused library like DOMPurify?

That may not be the best way to phrase the question, but gives the basic idea. If everything client-side is malleable, is it even worth it to use a JS library for sanitization? I've seen DOMPurify ...
0
votes
1answer
28 views

How to filter HTML Event in Native PHP7

i want to creating xss filter for my own project, this is for html event filtering preg_replace("/ on\w+='[^']*'/i", '', preg_replace('/ on\w+="[^"]*"/i', '', $framed)); but considering to more ...
0
votes
2answers
160 views

XSS possible inside the value field of input tag when double quote is filtered?

Is it possible to get XSS in the value field of Input tag when the application filters out double quote? <input type="hidden" name="something" id="somenthing" value="my_input_goes_here"> input ...
1
vote
0answers
80 views

XSS and CSRF Protection in a SPA with session cookies and auth in sub-domain (confused)

The problem is, that the more I read about XSS and CSRF and the protection against these attacks for my website, the more I get confused what would be the right strategy. Setup: SPA (Reactjs and ...
5
votes
3answers
256 views

How to safely allow scripts but preventing XSS?

We are trying to find the best way to allow JavaScript in a web application while being safe against XSS. Site admins have the privilege to insert JavaScript to control the site templates, and ...
1
vote
1answer
45 views

XSS using SVG: Is AllowScriptAccess attribute ignored?

I was experimenting with some Anti-XSS solutions, and during my research, I found following the XSS vector in a cheatsheet: <EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH ...
3
votes
1answer
121 views

How to prevent XSS in user-generated content (html) without disabling scripts and CSS [duplicate]

Is there a way to somehow sandbox user-generated content? I'm working on webapp which will contain a lot of user-generated content. Only "trusted" users will be able to publish the content, but I want ...
0
votes
1answer
84 views

XSS vulnerability in display message

I have a webpage in which Email is given as input. It will then display "your email is abc@xyz.com". I am then changing the email in URL to <script>alert(1)</script> and send tbe request ...