Questions tagged [xss]

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

Filter by
Sorted by
Tagged with
2
votes
1answer
162 views

Is it safe to allow arbitrary image formats in comments?

I know it’s not safe to allow arbitrary images in comments without proxying. I just saw this feature. It seems that all current user agents which implement it disable scripting and external resource ...
2
votes
1answer
66 views

Stored XSS + PHP Backdoor + File upload vulnerability

I built this web application(Used PHP 5 + MySQL) where I could take advantage of file upload vulnerability and XSS. My route of attack is: Upload a PHP backdoor which I built with msfvenom Go to ...
1
vote
1answer
36 views

Having web client do requests with User's 3rd party API key?

I am trying to figure out the best way to do this. I have done some searching and all I have found is about storing API keys in a back end, nothing like my use-case where there is no back end. ...
3
votes
1answer
154 views

Safe user input HTML in 2019

(I know this topic has been discussed a lot in the past, and I've read a lot of threads here as well as OWASP, but have additional questions including the specific CSP listed below.) We want to allow ...
0
votes
0answers
49 views

DVWA DOM XSS exploit using XMLHTTPRequest

I need you help to complete this practice session of mine. I have xampp and two app : dvwa and a "fake malicious" app called dvwaexploit When I visit the malicious app, I want to execute a DOM XSS ...
2
votes
1answer
237 views

CSP: What is script-src-attr and script-src-elem?

script-src-attr and script-src-elem directives are new additions in CSP3. I am not able to understand how are they different from the script-src directive. https://w3c.github.io/webappsec-csp/#...
-1
votes
1answer
196 views

XSS - Suspicious email from Itunes - GF opened accidently

My GF received a random email from iTunes saying that she had started a new subscription, its a very convincing email until closer inspection. Anyway she clicked the link at the bottom to cancel it ...
0
votes
1answer
90 views

java script in link href=“javascript:alert(1)”

In an app I am testing they allow to input a domain name, store it, and when they print it on the browser they concatenate "http://" at the beginning of the domain. So, if you input "google.com", then ...
2
votes
2answers
3k views

XSS in HOST header

I'm able to inject JavaScript payload in HOST header, a request will look like: Host: <script>alert(document.cookie)</script> User-Agent: Mozilla/5.0 Gecko/20100101 Firefox/29.0 Cookie ...
0
votes
1answer
60 views

Best way to take javascript code as input from customer and use them on site

I am working on a SAAS app with multiple customers, on their admin panel they have option to add code to add in header. This is a textarea which can take javascript code as input and then this code ...
8
votes
2answers
2k views

How to prevent XSS in SVG file upload?

Currently assessing an application, I found out that it is possible to submit an SVG file containing JavaScript (the app is also vulnerable to XXE). I wondered if there was a method to prevent those ...
-2
votes
1answer
108 views

How to block or stop redirection with window.location?

I need to block redirection using window.location on my site. Some hacker has injected a stored XSS script into my site: if(my_username != 'Name') window.location = 'https://the url'; Now each ...
3
votes
2answers
31k views

Best Approach for removing XSS Vulnerability

I have been developing a Webobjects application, and I found that my application is vulnerable to XSS through URL, but not when malicious input like <script>alert("hi")</script> is input ...
2
votes
2answers
99 views

Is there a way to execute XSS in an HTML img tag with SVG?

Is there a working technique to execute XSS in modern browsers using a SVG file displayed on a web page with an <img src=""> tag? I know a way to execute without <script> tag, but I don't ...
0
votes
1answer
42 views

What should be header response of XSS vulnerability upon form submission?

We have a PHP web application and all of the user inputs are sanitized. We tested it within Burp tool and found no XSS vulnerabilities. One of our security adviser tells us that when you type down ...
2
votes
1answer
62 views

Are all anchor tag href attributes considered XSS vulnerabilities?

I've got an app which allows users to customize the "thank you" message that is displayed to users when a form is submitted. For the "thank you" message contents I've whitelisted allowable HTML tags ...
1
vote
1answer
79 views

Performing multiline xss

I am playing one pentesting game theres a task where i need to perform multi line xss to print cookies. I was able to make xss that print "x" because one line is too short for entire command so this ...
0
votes
1answer
53 views

Server error when entering a percent symbol in search? [closed]

Fuzzing a website and came across an odd behavior. The site has a search bar, it sends queries via a GET request with the standard ?q= parameter. When I try the standard XSS payloads such as <...
0
votes
3answers
100 views

Information gathering on website [closed]

I'm pretty new to pentesting and everything about it. This question is primarily for web servers. I'd like to know for you pentesters out there, what information are you looking for when you are ...
2
votes
0answers
56 views

Are XSS attacks, or any other where a third party script is used as the attack vector, Living Off the Land (LOtL) Attacks?

I'm an intern at a big company and my education is in Security Risk Analysis but I somehow got put on a software development team and am basically relegated to research. I'm surrounded by software dev'...
4
votes
2answers
212 views

CVSS Score for self-XSS (stored XSS)

I have a web application which is vulnerable to stored, self-XSS attack. Proper encoding is not done In the place where the data from a database (set by the same user) is added to response. However, ...
0
votes
1answer
81 views

When should you give up on attempting a xss on part of a website? [closed]

I'm wondering when do you give up on some type of user input to exploit? What are the things that go through your head and that you check off, that makes you think that the input is properly sanitized?...
5
votes
4answers
341 views

Why doesn't XSS vulnerability from the site launching the CSRF attack make the Synchronizer Token Pattern insecure?

I was reading this question about using Synchronizer Token Pattern to protect against CSRF and the comments of the answer intrigued me. Of course, as the last comment says, if your site has an XSS ...
0
votes
2answers
76 views

Is there another way than session hijacking to access user account through XSS?

If I have discovered an XSS vulnerability, is there another way of gaining access to an account without session hijacking? Mainly because on most of the sites I test, the HttpOnly and Secure flags are ...
41
votes
1answer
5k views

Why do I need two parameters in an HTTP parameter pollution attack?

I'm reading about HTTP parameter pollution and I'm confused about one thing. If there is an endpoint like this, https://security.stackexchange.com/editpost/?postuid=19348 and you tried a HPP attack, ...
1
vote
1answer
124 views

How would someone XSS into a WebView?

There are several articles about XSS vulnerabilities in Android/iOS WebViews. By WebView I mean the 'real' webview not SFSafariViewController or Chrome Custom Tabs. I understand the main concept of ...
45
votes
4answers
16k views

How does CORS prevent XSS?

I recently learned about CORS and got the impression that its purpose is to prevent XSS. With CORS, the browser blocks requests to different domains, unless particular headers are in place. But if a ...
0
votes
0answers
109 views

Requests logged in Cloudflare as “XSS, HTML Injection - Body”

Rule name: XSS, HTML Injection - Body Rule: 100096BHTML Since about a week ago, requests matching this WAF rule have strongly increased on a customer's website. This is an example graph showing only ...
0
votes
1answer
672 views

CSP - Unsafe-inline or unsafe-eval for specific domain is allowed or not

Following is a CSP policy, for example derived sample response headers. The implementation below allows white-listed domains only in "script-src" directive but the 'unsafe-inline' and 'unsafe-eval' ...
0
votes
0answers
60 views

Angular application security error: Sanitizing unsafe style value

In my angular app, initially, I used bypassSecurityTrustStyle(value: string) and it worked but in security testing of my application, it gave error Angular Usage of Unsafe DOM Sanitizer. In this ...
0
votes
0answers
32 views

What's the impact of UXSS in open redirect vulnerability?

i am well aware of the impact of reflected, dom and stored XSS. Recently i discovered what Universal XSS is and i am a bit confused by it. i know it executes locally in the browser, but is it possible ...
12
votes
3answers
11k views

Content-Security-Policy hash of script

<?php header("Content-Security-Policy: default-src 'sha256-".base64_encode(hash('sha256', 'console.log("Hello world");', true))."'"); ?> <script>console.log("Hello world");</script> ...
3
votes
1answer
65 views

javascript eval() clarification

I've read this article about eval security issues. I need a clarification about this particular situations: For example, imagine we had a web app with a text field input that we were running eval()...
-2
votes
1answer
136 views

How to protect my site from XSS

I own a chat site {https://trixac.com}. It uses BoomChat's code. Recently I banned a troll and now he is back and hes running XSS injections against my site and it's working for some odd reason. I've ...
0
votes
0answers
68 views

xss attack on value field by bypassing encoded double quotes

consider a website that handles search query like this: <input class="something" type="search-field" value="SEARCHQUERY"> if i try to inject this script it doesnt work... " onerror="alert(0) ...
1
vote
4answers
134 views

can XSS attacks be nullified by prepending a backward slash to all external links?

In my website I noticed my developers had set it up so certain form data was past from the URL to the content of the website. E.G ?email="email" The obvious vulnerability means that I can put ?email=...
1
vote
1answer
67 views

XSS vulnerability in a module that doesn't exist

We did a vulnerability scan on our systems and received a vulnerability: Basit Submit Module Cross Site Scripting Vulnerability. We are not even aware of this application on our system. We filed a ...
2
votes
1answer
81 views

Blind XSS Payload for xml file?

I think i may have found a blind XSS. I can only upload xml files that are opened inside the backend. My questions is: How can i turn this payload into a blind xss payload to receive a ping to my ...
3
votes
2answers
99 views

How to chain XSS payloads?

I found a parameter on a website that is vulnerable to XSS. The website is a game and the parameter in question is the name of a player team. However, the parameter is limited to only 20 characters. ...
1
vote
1answer
110 views

Presistent XSS Filter Bypass Question

I was testing out a stored XSS on a test site I made which is vulnerable so the problem is when I tried executing the usual "><script>alert('XSS')</script> It did not work instead. But ...
0
votes
1answer
69 views

I want to inject XSS payload in an anchor tag, but the double quotes are being converted into %22

The tag works like this: <a ref="http://googl.com%22 onclick=alert(124)">http://google.com" onclick=alert(124)</a> Here, the double quote I put is turned into %22. Is there a way to ...
0
votes
0answers
48 views

XSS PoC for JSON

When I am requesting for a password reset, it's making a request like this -> {"eval":"uiFormNotify('messageDiv', 'info', 'msg.email_reset_to_existing', 10);Metronic.unblockUI('#forgotPwdForm');$('#...
0
votes
2answers
5k views

XSS payload without - &<>"=()

Is it possible to construct a XSS payload without the use of these chars - &<>"=()? The server is not doing any output encoding. Consider both the cases where the user input is being put into ...
1
vote
1answer
86 views

Can this be turned into dom xss? [closed]

I am testing a bug bounty website and i reached a support ticket creation functionality. I registered with email address {{15*15}}@testemail.com. I created a ticket but when i try to open the ticket i ...
3
votes
1answer
32k views

Reflected XSS script passing through URL how to make it work and what are the preconditions for it to work?

Trying to learn about security I set up the most simple website on my localhost consisting of one html page that a apache server serves. I first started trying and appending the JS script that would ...
0
votes
2answers
90 views

Cross Site Scripting href=/\evil

I've seen <base href=/\evil> and <base href=//0> as a vector to use XSS. Could someone make an example using these vectors and explain me if "/\" is the same as http:// or has some ...
1
vote
1answer
205 views

Can an XSS exploit on a subdomain steal the cookies of the parent domain?

As per my understanding, if a cookie doesn't have a domain attribute (explicitly telling where this cookie can be used), by default that cookie will be used by the domain which issued it and all its ...
0
votes
1answer
107 views

Application design to avoid XSS & CSRF attacks

I am learning to design a system where it can be guarded against XSS & CSRF attack. I'll quickly list down my understanding and then raise questions. It's a simple case of fraud that I am trying ...
1
vote
1answer
52 views

Why is not checking the origin of postMessage insecure?

Typically, within the onmessage handler, you would have something like this: window.onmessage = function(e) { if (e.origin != "www.example.com") return; //Do stuff }; The check for e....
0
votes
0answers
43 views

jQuery-1.11.0 xss p0c

I have a web application at the workshop that uses the old jQuery-1.11.0 library, where jQuery.globalEval (text); hence every text/javascript responses gets executed, and in my case it looks like: &...