Questions tagged [xss]

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

Filter by
Sorted by
Tagged with
27
votes
2answers
9k views

Will same-site cookies be sufficent protection against CSRF and XSS?

I must say, that I like this idea and it seems that it will bring a new form of protection against CSRF and XSS or at least it will reduce those attacks. So, how effective will this protection be? ...
0
votes
0answers
58 views

Why don't antivirus detect malicious XSS files?

I have a system with an uploading file feature and it's protected by an antivirus that scans the uploaded files. The AV detects malicious files like EICAR files, msfvenom payloads...but not a JS file ...
1
vote
1answer
199 views

HTTP header injected in meta tag

When I add the HTTP header X-Forwarded-Host: bing.com, a meta tag is injected into the site: <meta property="og:url" content="https://bing.com/argentina"/> Does this have any security impact? ...
2
votes
1answer
81 views

Are Javascript closures a useful technique to limit exposing data to XSS?

I'm wondering if using Javascript closures is a useful technique to limit exposing data to XSS? I realize it wouldn't prevent an attack, but would it reliably make an attack more difficult to execute, ...
0
votes
1answer
159 views

NONCE not supported in Asp.Net for CSP implementation

Is NONCE supported in Asp.Net when implementing Content-Security-Policy header to protect from XSS ?? I read that NONCE was not supported in Asp.Net, however I read another simple article, that shows ...
0
votes
1answer
75 views

DOM-Based cross-site scripting on window.location.pathname

A scan with Burp has identified a DOM-Based cross-site scripting vulnerability. The only script with a sink is the following. Do you think it's a false positive? (Can I make it more secure in some ...
6
votes
3answers
11k views

Use XSS vulnerability in iframe to compromise parent?

I have a site, let's call it parent.com, that embeds a third party plugin from child.com in an iframe. I have found a XSS vulnerability on child.com. The embedded page from child.com contains a form ...
2
votes
2answers
147 views

Popup alert even when a site deletes the alert function?

A website fully filter the alert function from his website, and replace it with an empty string, but I want to bypass it and still popup an alert, I am trying to solve an XSS challenge, and I figure ...
1
vote
2answers
93 views

Attacking through a malicious HTML file apart from XSS through Javascript?

I recently came across a behavior in a web application where the application (through the use of the header Content-Disposition: attachment) offers to download an HTML file instead of allowing it to ...
0
votes
0answers
58 views

Are web worker / service worker secure environments to store a password, credit card information, access tokens?

If there is a case where I wish to store sensitive data like a password, credit card information, or access tokens: Are web workers / service workers a secure environment, where such data can not be ...
0
votes
1answer
487 views

Storing encrypted tokens in LocalStorage

I am building a JavaScript application that will run in a web browser but also as a pseudo-native mobile application via Apache Cordova. It communicates via API to a separate backend service. The app ...
1
vote
1answer
60 views

Multi-byte character exploit

I read this answer, It explains how a multi-byte character exploit works in a decent way, the only way I could think of avoiding this problem is whitelisting all single-byte characters because of the ...
1
vote
0answers
41 views

What are the XSStrike metrics “Confidence” and “Efficiency”? [closed]

This is regarding the XSS scanning tool XSStrike. The tool produces three elements in a given report: XSS Payload Confidence Efficiency Does anyone know what the metrics Confidence and Efficiency is ...
2
votes
1answer
197 views

Reflected XSS in a JavaScript URL with some characters blocked

I am new to the field of Web Security and am practising labs from Portswigger Web Security Academy. In this lab, we have to call the alert function with 1337 as the parameter. The solution given on ...
0
votes
1answer
39 views

Reflected XSS in form action - understanding

I am trying to learn basics of web security vulnerabilities. I have found a website, where on reset password, you get a link in the email with a token, and when you click this link, the webpage opens ...
2
votes
4answers
2k views

Exploiting XSS in filename without using /

I am trying to exploit a vulnerability in the filename field of a file upload. The web application does not properly validate the filename of the uploaded file and as a result there is a stored cross-...
0
votes
0answers
48 views

How does this DOM xss work?

I'm doing a lab on portswigger.com, this one to be specific, https://portswigger.net/web-security/cross-site-scripting/dom-based/lab-document-write-sink-inside-select-element var store = (new ...
1
vote
1answer
3k views

CSP - Unsafe-inline or unsafe-eval for specific domain is allowed or not

Following is a CSP policy, for example derived sample response headers. The implementation below allows white-listed domains only in "script-src" directive but the 'unsafe-inline' and 'unsafe-eval' ...
0
votes
0answers
45 views

Is unicode character encoding a safe alternative for html encoding when rendering unsafe user input to html?

I am building a web application in which a third party library is used, which transforms the user input into JSON and sends it to an controller action. In this action, we serialize the input using the ...
0
votes
1answer
85 views

SQL injection and XSS prevention

I would kindly ask you to review the following code and tell me if it's enough to prevent most of SQL injection and XSS attacks. SQL injection: treated via PDO prepared statements; XSS: All user's ...
0
votes
0answers
49 views

Can someone explain the 'IE No Open' X-Download-Options Header, as enforced by Helmet.js?

I've been preparing to deploy an Express server using Helmet.js for some added security. I've been reading through their docs to make sure I understand what I am doing here, and I don't understand one ...
9
votes
1answer
25k views

How to make Firefox ignore the X-XSS-Protection response header?

I have two questions: How can I make Firefox ignore the X-XSS-Protection header? I have a website which sends an X-XSS-Protection: 1 header and I want my Firefox to ignore that header, because it ...
1
vote
1answer
54 views

Is this considered DOM-XSS or self-XSS or both?

SCENARIO: A web page shows an error login page using these javascript lines <script> let queryParams = new URLSearchParams(window.location.search); document.getElementById("message")....
0
votes
0answers
39 views

How was this mXSS on Google Search carried out?

I was reading about bug bounties that have been reported in the past and this one caught my eye as it seemed interesting. Mutation XSS in Google Search According to what I could understand, this is ...
0
votes
1answer
67 views

How to come out of href attribute using xss?

I was learning about XSS and found a website that takes my input say PAYLOAD and converts it to <a href = "example.com/search/PAYLOAD" > Link </a> After hit and trial, I found that it ...
2
votes
1answer
113 views

XSS on <script src=“”

I'm trying to solve @kinugawamasato xss challenge https://vulnerabledoma.in/xss_2020-06/ It's a php script that receives a argument, escapes it and create he following tag on the html: <script ...
0
votes
0answers
60 views

XSS Bruteforcing results in 500 internal server error

I've been trying to trigger xss in a website with the following url https://website.com/login/error?username_or_email=xyz%40gmai.com&redirect_after_login=%2wall While trying different payloads ...
0
votes
0answers
30 views

URL editing shows success message, but doesn't carry out function

I've been looking into my college's internal alumni network. In that we can send connections to users and when you send a connection request, you're taken to a url which is: https://www.website.com/...
1
vote
1answer
1k views

XSS works when I save generated HTML to file, but not directly in browser

The hints of XSS game's level2 say that Entering a tag on this level will not work. Try an element with a JavaScript attribute instead. When entering <script>alert(1)</script> ...
1
vote
1answer
86 views

Bypass frontend ampersand encoding and perform XSS

I just started learning something about web app pentesting and I was trying my hand on a website (which I'm allowed to test on). I found this potential stored XSS: <div title="hello">hello</...
0
votes
1answer
47 views

XSS cookie Stealing with Character limitations

The rules also Include 1. No jQuery 2. Only through making an API AJAX request. 3.character limitation of 100 characters. Can any suggest me how I can build a payload sticking with these rules.
22
votes
4answers
17k views

Cross Site Scripting without special chars

I'm testing a web application and I found a XSS vulnerability. I can break a tag and inject some code to the application but nothing potentialy dangerous for the client. The application has a filter ...
0
votes
0answers
32 views

Open redirection (DOM-based) on ASP.NET 4.7 Web Forms

A scan with Burp Suite has reported a possible vulnerability on all the pages of my application, which is based on ASP.NET 4.7 WebForms. the issue is: The application may be vulnerable to DOM-based ...
-1
votes
1answer
69 views

Is it Possible XSS in <h1> tags without using “<” [closed]

In example website "<" character is filtered.Is it possible to find XSS in h1 XSS h1
0
votes
1answer
39 views

Is it possible to bypass escape() when document.getElementByName gets the value?

Say I have the following script var a = document.getElementById('in').value; escape(a); Is it possible to bypass the escape function to do some XSS? I have tried );alert(1); to no avail. I have ...
0
votes
1answer
99 views

How to bypass sanitization of < while exploiting an XSS vulnerability?

Whatever is to the right of < is being deleted if I don't have a following >, else everything in between < and > is being deleted. Is there a way to bypass this sanitization?
0
votes
0answers
29 views

Google Gruyere - Ajax Json Stored Xss

I was doing the google security challenges here: http://google-gruyere.appspot.com/part2 I don't understand the solution for the Ajax Stored Xss part. So here's the problem summarized: Every user ...
-1
votes
1answer
68 views

Multi Reflection XSS filter Bypass: Bypass this XSS filter and generate a popup

$input = $_GET['user_name']; echo(remove_xss($input)); remove_xss($input){ convert $input to lowercase remove all "script" remove all double and single quotes remove all img, iframe, onclick, body, ...
11
votes
4answers
3k views

JSON API response flagged as XSS by vulnerability scanner. Is this a false positive?

When a user attempts to access any URL without authentication (including a non-existent URL), my web service returns an HTTP 401 response. This response is JSON encoded, and the body of this response ...
6
votes
1answer
171 views

DOM Based XSS and Adding HTML Elements

So as a rule of thumb I once learned that adding or removing HTML with JavaScript/JQuery (.html(),.append(), etc) leaves yourself wide open for DOM Based XSS Attacks. It is now my understanding that ...
1
vote
1answer
34 views

Ways to exploit a form action value when it s reflected from URI on React-Django

I am working on a security testing project, where I have noticed that the form action of a login page takes whatever is fed to URI as a parameter, the respective part of the login page is as follows: ...
1
vote
1answer
53 views

IFrame Vulnerability Classification

I was participating in a bug bounty on a website we will call example.com, when I ran into a very strange edge case which I am not sure I should report. The website uses ads and tracking similar to ...
0
votes
1answer
150 views

Application design to avoid XSS & CSRF attacks

I am learning to design a system where it can be guarded against XSS & CSRF attack. I'll quickly list down my understanding and then raise questions. It's a simple case of fraud that I am trying ...
0
votes
1answer
95 views

Single and double Encoding of parameters to bypass security filters

I was practising some labs to get better at XSS and SSRF. I found that sometimes I just encode characters once and the security filter is bypassed and occasionally I have to encode it two times. How ...
13
votes
4answers
7k views

How can I execute a XSS when a web application transforms a data from lowercase to uppercase?

I'm testing a web application, when I send an input data to web application, this places the data in an onclick function, something like this: <a href="#" onclick="someFunction('dataFromServer', '...
1
vote
1answer
77 views

Possible to bypass this regex for XSS?

When testing for XSS, is it at all possible to bypass the below regex? I doubt it because it only accepts uppercase and lowercase letters, but maybe? /^[A-Za-z]+$/
0
votes
0answers
53 views

Ionic local storage store sensitive data for private app

I'm new to the ionic framework and have some basics of it and currently I'm developing a private app for my family only that store some sensitive information in the localstorage. I used some crypto ...
2
votes
1answer
126 views

XSS chained with CSRF = Stored XSS?

I have recently heard that XSS + CSRF = stored XSS. I didn't think too much about it at the time, but now it's bugging me, because it doesn't make too much sense. I would say that it can stand true, ...
3
votes
3answers
834 views

XSS with <a> tag with target="_blank`

Basically, I am having an <a> tag with target set to _blank, where an attacker has control over the href parameter, thus possible inserting a javascript tag, like the following: <a target="...
1
vote
0answers
31 views

performing authenticated scan for xss using selenium and xsstrike tool

I'm automating XSS security test, I automated XSS reflected and stored, now for automating XSS dom I'm required to use XSSStrike tool (https://github.com/s0md3v/XSStrike/wiki/Usage). Im using ...

1
2 3 4 5
26