Questions tagged [xss]
Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).
1,496
questions
0
votes
1
answer
21
views
Validating XSS script with success response with expected data in REST API
I am performing security testing on a REST API and it is a POST method. I injected an XSS script in a body parameter and the API responded with '200 success' response with the actual expected data.
If ...
CommunityBot
- 1
0
votes
1
answer
32
views
XSS bypass in url
I have a website: https://bugbounty.com/test/"injection inside js", but " is escaped with \ and I'm trying to inject </script><script>alert() but https://bugbounty.com/test/&...
- 2,265
1
vote
2
answers
7k
views
XSS: window.location.href and window.open
I'm working through all issues that the static security analysis tool Fortify found in our internal Angular application. There is one particular issue I'm not confident of how to work with. Please see ...
- 2,265
1
vote
2
answers
77
views
xss: is it possible to continue javascript code execution after a "throw new Error()" line?
there is this javascript file that a can inject code after throw new Error("error string") line. But it seems that after the throw statement, no code can be executed.
throw new Error("...
- 481
1
vote
1
answer
429
views
XSS - Anyway to bypass double quotes in href of anchor?
I have an anchor that has href attribute populated by my input. I am trying to input javascript, but it always renders it useless since it always appears between double quotes.
So far, I have tried ...
- 126k
1
vote
2
answers
115
views
What exactly are Hidden HTTP Parameters?
I read a lot of reports where 'hackers' potentially exploited a 'Hidden HTTP Parameter'. There are also tons of tools which are developed for this exact purpose.
Example : https://blog.yeswehack.com/...
CommunityBot
- 1
1
vote
1
answer
83
views
How is a XSS attack possible in this context?
I'm testing a website, which is vulnerable to XSS.
<input type="hidden" id="referer" name="referer" value="INJECTION_POINT">
<script>
document....
- 10.8k
0
votes
1
answer
55
views
What are the risks of XSS in this forms?
I recently developed a website that was operational for me ^^
However, someone came to try injections and found an XSS flaw.
I have a form like this:
<h2>
<span>Search</span>
</...
CommunityBot
- 1
4
votes
2
answers
422
views
How to exploit XSS and SQL injection via HTTP verb tampering?
I was reading a paper about 'HTTP verb tampering' here:
https://blog.jeremiahgrossman.com/2008/06/what-you-need-to-know-about-http-verb.html
The author said:
HTTP verb tampering is generally used in ...
CommunityBot
- 1
1
vote
0
answers
18
views
force XSS after bypassing Request.Form using URL Encoding
I am testing a cross-site scripting attack on a website, as we all know the Request.Form function validates the input so the user couldn't insert a <script> inside the input.
My focus in this ...
- 11
2
votes
3
answers
191
views
Can I visit a malicious website by using Tor with settings set to safest or by using NoScript on an ordinary browser with settings set to untrusted?
Can I visit a malicious website by using Tor with settings set to safest or by using NoScript on an ordinary browser with settings set to untrusted?
If not then is there any way to visit a malicious ...
- 217
0
votes
0
answers
34
views
Is storing access token in private data, refresh token in http-only cookie safe?
Backend: Django / Django Rest Framework, would be hosted at GCP k8s
Frontend: Angular, would be hosted at some CDN e.g Vercel
Authentication: JWT (https://github.com/jazzband/djangorestframework-...
1
vote
1
answer
55
views
How to alert cookie in 30 character XSS payload?
The application allows user to enter a 30 character long username.
I tried the following XSS payload and it worked, but the triager is asking if I can alert cookie. But script tags and src keyword is ...
- 65.1k
0
votes
0
answers
44
views
XSS payload with html Encoding
I was reading about XSS Contexts on Portswigger and it has a section about the use of HTML-Encoding in bypassing input validation.
What i understand is :
The browser html decodes the entities before ...
1
vote
0
answers
30
views
Understanding browser text input value rendering for combatting XSS
If you use inspect in the developer tools for Chrome the values for the two input boxes below will look the same.
<input name="test1" type="text" value="<script>alert(...
0
votes
1
answer
49
views
How do browsers defend the user against XSS?
I'm learning about the different mitigations employed by browsers against XSS vulnerabilities.
Let's say, the developer made a mistake and there is a XSS vulnerability on a site. Unfortunately, a ...
CommunityBot
- 1
2
votes
3
answers
1k
views
Does OpenID Connect provide CSRF and XSS protection?
I've been reading several articles recently about how storing JWTs in local or session storage is inherently insecure. The mitigation is apparently to implement a "session ID pattern", i.e. ...
CommunityBot
- 1
1
vote
1
answer
2k
views
Storing encrypted tokens in LocalStorage
I am building a JavaScript application that will run in a web browser but also as a pseudo-native mobile application via Apache Cordova. It communicates via API to a separate backend service.
The app ...
CommunityBot
- 1
4
votes
1
answer
587
views
XSS in HTML Context without < and >
I have a webpage that blindly removes < and > as hardcoded rule. I know XSS doesn't always need < and > since it is not needed in HTML attribute and javascript contexts.
But is it ...
CommunityBot
- 1
1
vote
2
answers
248
views
Difference Between Reflected XSS and Reflected-DOM XSS
What's the difference between Reflected XSS (RXSS) and Reflected-DOM XSS (RDOMXSS)? After some research, I think it can be concluded that Reflected-DOM XSS is:
Similarities:
The value is reflected by ...
CommunityBot
- 1
2
votes
1
answer
784
views
Can a malware steals my Facebook c_user, xs, and datr Cookies?
Just as the title suggests. I have a PasswordStealer on my PC and I'm afraid that it can do that. AFAIK, that malware can record keystrokes and steal saved passwords which I don't mind because I don't ...
CommunityBot
- 1
24
votes
3
answers
5k
views
Why is it called cross-site scripting? (XSS)
Why is Cross-site scripting called Cross-site scripting? The term implies to me (a non-native English speaker) that there is some other web site involved that attacks your web site, but most of the ...
- 1
2
votes
1
answer
165
views
Can the value attribute of input tag be a DOM-XSS sink?
Can at this code the input.value be a Dom-XSS sink?
let qs=new urlsearch(location.search);
let paramValue=qs.param;
let input=document.getElementByID('inputField');
input.value=paramValue;
I tried ...
CommunityBot
- 1
0
votes
0
answers
67
views
CSP for Single Page App: Use client-side nonce for securing iframe content
Goal I'd like to tighten my Content Security Policy.
Situation
I have a single page react application (= All code and styles are bundled together into a bundle.js file). The file is simply placed on a ...
- 101
0
votes
1
answer
54
views
Why do you think this code isn't firing?
I don't have a lot of knowledge about xss so im kinda confused, why this is not popping up an alert box?
- 3,609
0
votes
0
answers
25
views
I clicked what looked like an Amazon email, but it (maybe) was from an Amazon affiliate. Ended up at Amazon.com anyway. Can I safely investigate? [duplicate]
In a case of clicking too fast, I clicked on a picture that looked like it was from Amazon. However this was not the case. I did end up at Amazon, but I'm aware that other things could've taken place ...
- 1
3
votes
2
answers
11k
views
XSS prevention via JavaScript
I am working on a XSS prevention via Javascript. I am using the following JS-Code for that:
(function () {
/*
XSS prevention via JavaScript
*/
var XSSObject = new Object();
XSSObject.lockdown = ...
- 126k
3
votes
1
answer
652
views
XSS chained with CSRF = Stored XSS?
I have recently heard that XSS + CSRF = stored XSS. I didn't think too much about it at the time, but now it's bugging me, because it doesn't make too much sense.
I would say that it can stand true, ...
CommunityBot
- 1
26
votes
3
answers
78k
views
How to launch XSS code from an INPUT HTML tag upon page load?
Say I have the a website with the following code on it:
<input type="text" id="search-text" name="query" value="?" />
Double quotes aren't escaped so I can break out of the value attribute, ...
0
votes
1
answer
391
views
XSS cookie Stealing with Character limitations
The rules also Include
1. No jQuery
2. Only through making an API AJAX request.
3.character limitation of 100 characters.
Can any suggest me how I can build a payload sticking with these rules.
CommunityBot
- 1
3
votes
2
answers
234
views
Can someone bypass this XSS filter
During our Red/Blue team practice my friend made a web forum application where people can post messages.
What he did was filtering:
The equal sign
The key words: "javascript", "alert&...
CommunityBot
- 1
0
votes
1
answer
140
views
Vulnerabilities in img src
It is known that in modern browsers you can't run XSS in img src(assuming quotes are escaped), because neither javascript: protocol, nor svg will execute the code. But does it mean that trusted data ...
- 42.9k
0
votes
1
answer
255
views
How do I test for Reflected XSS in webpage titles, url parameters and javascript variables?
I have a java web app. I'm using OWASP Java Encoder to encode for html, javascript and url components to mitigate reflected XSS. I'm new to this so I'm not sure on how to test on my web app for the ...
CommunityBot
- 1
0
votes
1
answer
65
views
Jsoup XSS attack with URL encoded input
I'm having a Spring Web Application that exposes REST APIs.
I have implemented XSS filter using Jsoup that strips the input using Safelist.NONE.
The penetration testing team raised a concern where the ...
- 10.8k
1
vote
0
answers
31
views
Storing auth token in html
Current projects webs application utilises a cookie based approach to store users auth token. Implemented with secure and http-only attributes set. All traffic over https. The application loads third ...
- 11
1
vote
0
answers
98
views
Client-side Javascript injection by assinging the output of window.location.href.substr to a variable
Sample code:
function winLoad() {
var sessionId = '';
if (window.location == window.top.location) {
var semicolonIndex = window.location.href.indexOf(';');
if (semicolonIndex !=...
- 11
3
votes
3
answers
32k
views
Typical 'search box' XSS attack
When I develop a site, I'm always conscious of security flaws, but I'm struggling to see how a search box could ever be used to inject script that could be ran on a page of mine.
So I understand that,...
CommunityBot
- 1
2
votes
1
answer
61
views
Can I use a ServiceWorker to prevent an XSS attacker from gaining access to private user data?
I run a small blogging platform, and I want my users to be able to embed javascript that runs on their blogs (to manipulate the DOM, etc. as you might if you were hosting your own website). However, I ...
- 125
2
votes
1
answer
988
views
Self-XSS From File Upload Name
I encountered this type of vulnerability a couple of times but was not able to fully exploit it.
This vulnerability is a self-xss which is triggered from file names. E.g. If I were to upload a file ...
CommunityBot
- 1
5
votes
1
answer
246
views
XSS security concerns from untrusted parent domains
There's lots of discussion about protecting content on example.com from user controlled content on subdomain.example.com (e.g. Github pages). What are the risks the other way around?
If my content is ...
CommunityBot
- 1
1
vote
1
answer
359
views
Is there a potential XSS in this html action attribute?
I'm working on a website and I noticed that if I go to the following URL: website.com/page?alert() this message is reflected in the action form. I tried to close the action attribute using double ...
CommunityBot
- 1
2
votes
1
answer
768
views
Is it possible to launch XSS if only the left angle bracket is encoded
I find some website only encode the left angle bracket of inserted HTML tag, for example:
<div style="position:absolute;left:63.35px;top:108.41px" class="cls_002"><span class="cls_002">&...
CommunityBot
- 1
1
vote
1
answer
947
views
Should sensitive tokens be stored in localStorage or an HTTPOnly cookie?
In the context of a web application...
should sensitive tokens, such as those used for sessions, authentication and/or authorization, be stored in localStorage or an HTTPOnly cookie; or are they both ...
CommunityBot
- 1
1
vote
1
answer
207
views
Is there any way to break the HTML attributes without using single/double quotes?
I have the following code,
<li data-type="test" title="?"> test </li>
Following values were Not allowed
<>&*#%\'"=
My goal here is to get a javascript popup to appear.
is ...
CommunityBot
- 1
2
votes
1
answer
153
views
Does this qualify as Filename Upload DOM-XSS?
An application has the following javascript code which is triggered whenever an user tries to upload a file.
a.html(fileName)
then if the user uploads a file named <img src=x onerror=alert()> ...
CommunityBot
- 1
1
vote
1
answer
729
views
"One of your code blocks includes unescaped HTML." JS console security warning
I operate a blog using Google's Blogger platform about programming. I use highlight.js for syntax highlighting, and now on my posts I see the console warning: One of your code blocks includes ...
CommunityBot
- 1
3
votes
2
answers
2k
views
Is it still possible to use HTTP TRACE for XSS in modern Web Browsers?
Let's assume we are talking about top 10 most used web browsers: Usage share of web browsers
https://www.cgisecurity.com/questions/httptrace.shtml
'TRACE' is a HTTP request method used for ...
CommunityBot
- 1
1
vote
1
answer
6k
views
XSS in <span> where only < and > are encoded
When im doing a penitent, I noticed the application takes the user input and put it in a tag. When I used the string of '';!--"<XSS>=&{()}, I noticed the returned output (when viewing ...
CommunityBot
- 1
0
votes
2
answers
92
views
Check for special characters in request parameters
Our system is accepting requests including special characters, see parameter2.
Request [
{
"reqHeader": {
"parameter1": "abc",
"...
CommunityBot
- 1
15
votes
1
answer
5k
views
SQL injection inside XSS
Is it possible to perform an SQL injection inside an XSS attack?
And if so, where can I find information on this or some examples?
- 126k