Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [xss]

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

4
votes
0answers
167 views

XSS with escaped equal sign inside jQuery selector

Web-site uses jQuery 1.8.3 which has known XSS vulnerability in selector. (https://snyk.io/vuln/npm:jquery:20120206). It passes filtered and urldecoded document.location.hash (val2 below) value ...
4
votes
0answers
148 views

XSS security concerns from untrusted parent domains

There's lots of discussion about protecting content on example.com from user controlled content on subdomain.example.com (e.g. Github pages). What are the risks the other way around? If my content is ...
3
votes
0answers
55 views

How Can Exploit Xss and Sqli via HTTP Verb Tampering?

I was reading a paper about 'HTTP Verb Tampering' here: https://blog.jeremiahgrossman.com/2008/06/what-you-need-to-know-about-http-verb.html The author said: 2) HTTP Verb tampering is generally ...
3
votes
0answers
634 views

Solutions from StackOverflow to prevent XSS in JSP pages don't work

I have a JSP page where the HTML title is pulled from a GET parameter title: <title>${title}</title> Obviously, this allows for XSS attacks. If I follow the answer given on this page and ...
2
votes
0answers
64 views

Sandboxing untrusted JavaScript execution by redeclaring variables

Some irrelevant background (read only if you want to say "no, just use an iframe") Scenario Suppose that I downloaded a string jsCode containing arbitrary JavaScript code from a (potentially ...
2
votes
0answers
65 views

Is the PHP BB code extension safe against XSS?

Bad home brew implementations of BB code (especially in PHP) are a common source of XSS vulnerabilities. Usually they rely on a bunch of regexes, a tool that is not fit for the job. But lo and ...
2
votes
0answers
130 views

HTML Form to PDF vulnerabilities

I have a form where the user inputs data. On the back end, I'm taking some of that data and embedding it into a PDF using ActiveReports. I then display it back to the user and save a copy on our ...
2
votes
0answers
251 views

"Protection Mechanism Failure (CWE ID 693)

After security scan, we are seeing the Protection Mechanism Failure (CWE ID 693) issue in our application. Our current header is set as mentioned below- Server: Apache X-Frame-Options: SAMEORIGIN ...
2
votes
0answers
118 views

Wanted: Secure login/authentication strategy for website with AND without JavaScript in 2018

I am trying to figure out a strategy for secure authentication - without re-inventing the wheel, but also considering the specific constraints of my situation. The strategy should not be tied to a ...
2
votes
0answers
622 views

HTTP header: Range: bytes=XXX and possible XSS?

I'm currently experimenting with the "Range: bytes=XXX" HTTP header. Regardless the possibility of using it for the so called "Apache Killer" DoS attack (unpatched Apache version, etc), is it possible ...
2
votes
0answers
432 views

Angular XSS not evaluated

Using an older version of AngularJS : 1.2.21 from example, there are some playload that can generate an XSS. {{toString.constructor.prototype.toString=toString.constructor.prototype.call;["a","alert(...
2
votes
0answers
470 views

Using phpinfo() to get httponly cookies?

phpinfo() shows all cookies, even the httponly. So the question is - how can I receive users cookis on target website through xss with phpinfo? The xss will contain code that will open phpinfo page in ...
2
votes
0answers
559 views

How to validate Excel data to protect against XSS?

My application is dynamically constructing a source URL and then writing the resource file (Excel) directly to the response. The URL is read from a properties file, based on the application ...
2
votes
0answers
121 views

What percent of stored XSS attacks use external JavaScript?

What % of XSS attacks use external JavaScript. For example: <script src="http://badsite.com/maliciouscode.js"></script> Instead of: <script>alert(document.cookie);</script> ...
2
votes
0answers
859 views

XSSER get and post

I am using xsser for XSS vulnerability testing and I have a doubt about the parameters when it's a POST method. I have tried against DVWA (which uses get) with success like this: xsser -u "http://...
1
vote
0answers
60 views

WAF is set to Alert, not block. We are seeing thousands of XSS and SQL Injection attacks. How can I tell if any were actually successful?

I'm pretty inexperienced with WAFs and the events/alerts it generates. I'm wondering how I can tell if any of those were successful? For example, in the last 24 hours we saw over 50K alerts/events ...
1
vote
0answers
37 views

If and why is it safer to output JS literals into an HTML tag than JS encode them and set them directly to a JS object?

From ASP .NET Core docs about preventing XSS: Before putting untrusted data into JavaScript place the data in an HTML element whose contents you retrieve at runtime. If this isn't possible, then ...
1
vote
0answers
173 views

XSS and CSRF Protection in a SPA with session cookies and auth in sub-domain (confused)

The problem is, that the more I read about XSS and CSRF and the protection against these attacks for my website, the more I get confused what would be the right strategy. Setup: SPA (Reactjs and ...
1
vote
0answers
133 views

Angular JS alternative xss payload?

Basically, I have a situation right now where the registration website allow to register via email address and then redirects me to another website (subdomain) of the original website. The subdomain ...
1
vote
0answers
37 views

Where to store encryption based tokens in Encryption based Token Pattern?

Reading OWASP encrypted tokens pattern they describe the flow as follow: After successful authentication, the server generates a unique token comprised of the user's ID, a timestamp value and a ...
1
vote
0answers
240 views

Android WebView JavaScript Enabled

I recently found an Android application, which uses a WebView with enabled JavaScript. In this webview I am able to browse from their provided FAQ page to twitter, and from twitter basically ...
1
vote
0answers
319 views

Should sensitive tokens be stored in localStorage or an HTTPOnly cookie?

In the context of a web application... should sensitive tokens, such as those used for sessions, authentication and/or authorization, be stored in localStorage or an HTTPOnly cookie; or are they both ...
1
vote
0answers
154 views

Understanding XSS

So, I am trying to understand how XSS works and I gathered some information online and crafted the code. Following is the snippet. When I enter some value in the text field and submit, the script ...
1
vote
0answers
194 views

Bypassing double quote in DOM based XSS?

I am trying to generate a POC for DOM XSS exploit. I could inject a code using the following link: <a href="wepage.jsp" target='&quot;><script> alert(document.cookie)</script>&...
1
vote
0answers
756 views

How can I steal all cookies from reflected XSS?

I just found a website with a XSS vulnerability. When I visit the following URL, a pop up occurs: https://example.com/article/HALLOWEEN"><script>alert(1);</script> I have a ...
1
vote
0answers
198 views

How did the recent British Airways hack go down?

How did the Magecart group manage to inject their malicious code into the source code of the BA ticketing site? I have read two articles, one of which said, it could be because BA was not checking ...
1
vote
0answers
62 views

Protect website against attacks with iframe for user generated javascript?

I'm creating a small playground for people to write and test out their JavaScript on my website. I know websites like jsfiddle already exist but it's just for fun and for the sake of trying something ...
1
vote
0answers
715 views

Is allowing blob: in Content-Security-Policy a risk?

Recently, I've set Content-Security-Policy headers for my web application. I've tried to be as strict as possible. What strikes me most is the fact that I had to allow blob: for connect-src and img-...
1
vote
0answers
126 views

Blind XSS being intercepted by Palo Alto Tech OPs

I am doing a penetration test and I have a form that accepts any input. Whenever a form is submitted, a message of "Thank you, you will be contacted shortly" appears. Acunetix detected a blind XSS ...
1
vote
0answers
92 views

Exploiting XSS when attack vector is passed in Javascript context after being HTML encoded?

My attack vector is being passed in three contexts. HTML element: <p>injection</p> HTML attribute value: <input value="injection"> Javascript: <script> var a = "...
1
vote
0answers
104 views

Protecting an api-token with cookie authentication only

I have a webpage that will provide an JSON object of an api-token if a valid session cookie of a logged in user is provided. If an attacker gets this api-token then they now have full control over ...
1
vote
0answers
522 views

Is it a good practice to combine cookies and local storage to protect against XSS and CSRF?

We know that cookies with httpOnly and secure flag are immune to XSS and vulnerable to CSRF attacks. And at the same time we know that local storage is vulnerable to XSS, but can protect against CSRF. ...
1
vote
0answers
465 views

Bypass XSS filter

So i found a website that encloses every thing i searched in double quotes("searched term" ) and places it in a value parameter i tried following vectors hoping that first i would close the double ...
1
vote
0answers
546 views

custom payload list in xssValidar and burp suite limited to 32

I use the intruder extension xssValidator in burp suite pro to test for XSS vulnerabilities. My problem is that when I set my payloads list in the xssValidator tab, just the first 32 lines will be ...
1
vote
0answers
159 views

Safe to have specific RESTful API endpoint without CSRF tokens?

I have a RESTful API. There are two ways to authenticate to it: a user/password-centric model, and OAuth2. Although user/password-authenticated users can make requests to this specific API endpoint, ...
1
vote
0answers
106 views

Load non-existent flash file through service worker

Using Service Workers it is possible to load non-existent files with the fetch event handler, however this does not seem to work when loading flash files. Is there any way in any browser to do this ...
1
vote
0answers
499 views

url-encoded original URL in error page via og:url meta tag - Risk assessment?

I'm asked to advise on a scenario where meta tags in a 404 error page include the Open Graph og:url, which is (I'm told) being populated by React libraries. The full url as presented to the server is ...
1
vote
0answers
179 views

XSSF cookie stealer not working

I am playing with XSSF with Metasploit and attacking Mutilldae(security 0). I was able to get the generic XSS inject working. The inject was added to the Mutilldae blog. However, when I try to get the ...
1
vote
0answers
203 views

XSS encode / decode strange char interpretation

Can anyone tell me why I can't get this XSS to reflect? Or why is this Filtered or not rendering? The Post sent is: ... Content-Length: 91 add=1&reference=A</><img src=a onalert=alert(...
1
vote
0answers
479 views

XSS Vectors for new Image()

What are possible XSS vectors to this JavaScript code new Image().src = encodeURI('[user url here]'); Let's assume two cases: [user url here] is some string provided by user (with no validation) [...
1
vote
0answers
1k views

How safe is Apache's Commons StringEscapeUtils.escapeXml function to prevent XSS

I am using escapeXML StringEscapeUtils.escapeXml to prevent XSS in my Java application. But I am wondering if it resolves XSS to the fullest. I have tried some XSS attack vectors, and escapeXml seems ...
1
vote
0answers
258 views

Hacking attempts: SQL injection adding script in.js

A client of mine keeps getting hacked by seemingly SQL injection where a script tag containing a link to an in.js file is added. Sometimes from a domain called sportserve.co.uk, other times from ...
0
votes
0answers
55 views

xss attack on value field by bypassing encoded double quotes

consider a website that handles search query like this: <input class="something" type="search-field" value="SEARCHQUERY"> if i try to inject this script it doesnt work... " onerror="alert(0) ...
0
votes
0answers
47 views

Requests logged in Cloudflare as “XSS, HTML Injection - Body”

Rule name: XSS, HTML Injection - Body Rule: 100096BHTML Since about a week ago, requests matching this WAF rule have strongly increased on a customer's website. This is an example graph showing only ...
0
votes
0answers
45 views

XSS PoC for JSON

When I am requesting for a password reset, it's making a request like this -> {"eval":"uiFormNotify('messageDiv', 'info', 'msg.email_reset_to_existing', 10);Metronic.unblockUI('#forgotPwdForm');$('#...
0
votes
0answers
41 views

How to ignore htmlentities() to steal cookies in php page

I have a messageboard running at http://10.8.0.240/a9q2/messageboard.php. I can use my 'student' login to login the messageboard and post messages which can be seen by the admin and other students. ...
0
votes
0answers
39 views

jQuery-1.11.0 xss p0c

I have a web application at the workshop that uses the old jQuery-1.11.0 library, where jQuery.globalEval (text); hence every text/javascript responses gets executed, and in my case it looks like: &...
0
votes
0answers
43 views

Is it possible to extract data from api response from main domain?

I found an XSS on subdomain.example.com, is it possible to use that xss to extract the response of an api request from the main domain example.com/api/xyz? The xss is on subdomain.example.com and I'd ...
0
votes
0answers
31 views

Keycloak's Angular quickstart : XSS vulnerable?

We are using Keycloak for the authentication of our server-side rendered applications (Java/Spring/Thymeleaf), and now we want to use it for our Angular applications. Using the Angular quickstart, ...
0
votes
0answers
47 views

What do these vulnerabilites/exploits mean for XSStrike

Could someone explain how to use the exploit I found, if I have found one? I may have potentially found an xss exploit on my church's website and want to notify the church website admin if I really ...