Questions tagged [xss]

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

Filter by
Sorted by
Tagged with
1
vote
1answer
1k views

How to bypass sanitization of < while exploiting an XSS vulnerability?

Whatever is to the right of < is being deleted if I don't have a following >, else everything in between < and > is being deleted. Is there a way to bypass this sanitization?
2
votes
0answers
105 views
+100

Can “c:set” cause Cross Site Scripting (XSS) vulnerability?

Can this be exploited as XSS vulnerability using urls like localhost/?myVar=<script>alert(document.cookie)</script> or though any other possibility? <c:set var="myVar" value=&...
0
votes
2answers
39 views

abiliity to change elements in HubSpot iFrame forms

I recently started working on adding custom code to HubSpot forms after their form is loaded via an iFrame. Initially, I was using the following code to access the iFrame to change it: var form = ...
1
vote
1answer
4k views

CSP - Unsafe-inline or unsafe-eval for specific domain is allowed or not

Following is a CSP policy, for example derived sample response headers. The implementation below allows white-listed domains only in "script-src" directive but the 'unsafe-inline' and 'unsafe-eval' ...
0
votes
0answers
48 views

How to send a new line character "\n" through form tag in html

I wanted to write a POC for XSS through POST method. After playing a lot with html form tags, I was finally able to construct a payload except for a single character "\n". XSS requires that ...
0
votes
0answers
40 views

Need help determining if the following GET requests are XSS or CSRF [closed]

I am pretty sure below is an XSS attack due to no POST commands being used. Can someone please confirm and explain what attack is being performed in the code below?
0
votes
1answer
78 views

XSS Triggers only when pasted in

I have a XSS case that I would like to exploit as a proof of concept, however the payload seems to only be triggering when pasted in and not from the URL. Basically, I have a search box which when ...
0
votes
1answer
192 views

Single and double Encoding of parameters to bypass security filters

I was practising some labs to get better at XSS and SSRF. I found that sometimes I just encode characters once and the security filter is bypassed and occasionally I have to encode it two times. How ...
1
vote
3answers
349 views

Do browsers XSS filters protect against DOM based XSS?

Many (but not all) browsers come with built in XSS protection that can be activated with a HTTP header: X-XSS-Protection: 1; mode=block As I understand it, it prevents reflected XSS attacks by ...
0
votes
1answer
510 views

Is it possible to bypass httponly?

I read some articles about XSS and how to mitigate the flaws in a web application. I've seen the HttpOnly on Set-Cookie. Can this flag be bypassed? Or is there another way to access a session cookie? ...
0
votes
1answer
69 views

XSS injection: how to bypass a filter encoding single quotes?

I'm trying to do a XSS attack test on a website. I am using " and <> just fine and I have managed to scape the string. Now I'm trying to send my own cookie to my source code that saves it ...
0
votes
1answer
64 views

Is it still XSS if it requires user input?

I have a web app which displays what I enter in an <input> field back as HTML, but it happens all client-side in the DOM after manual input, so it can't be made into a URL which causes a payload ...
2
votes
1answer
327 views

XSS chained with CSRF = Stored XSS?

I have recently heard that XSS + CSRF = stored XSS. I didn't think too much about it at the time, but now it's bugging me, because it doesn't make too much sense. I would say that it can stand true, ...
0
votes
0answers
62 views

The input is reflected inside Javascript code between single quotes

I have started to learn about all Website Vulnerabilities lately. today I started a scan on a school website of my town with Acunetix and it have found some Xss Bug like this: URI was set to "...
4
votes
1answer
114 views

Passing a C# object to Javascript in ASP.NET MVC

Several answers on StackOverflow suggest that a C# object can be passed to JavaScript in ASP.NET MVC by the following: <script type="text/javascript"> var obj = @Html.Raw(Json....
10
votes
1answer
3k views

Is allowing blob: in Content-Security-Policy a risk?

Recently, I've set Content-Security-Policy headers for my web application. I've tried to be as strict as possible. What strikes me most is the fact that I had to allow blob: for connect-src and img-...
11
votes
2answers
2k views

How do I safely host third-party Javascript code in an iframe?

I'm building a website where users, among other things, can add embeds (YouTube, Google Forms, Airtable...) and show those embeds to other people. Embeds are snippets of HTML that can include <...
0
votes
1answer
661 views

Potentially dangerous request loads the page

I hosted an application in ASP.NET 4.0 webforms. When I am browsing hostname/DressDetail.aspx?<script>alert(313)</script>&category=1&code=76 it is showing an error message like: ...
0
votes
0answers
49 views

Stored XSS cookie stealing, but a loop of redirection

I found a stored xss vulnerability on a comment section of a fun site and I wanted to steal cookies using xss attack. So on my remote server I run an HTTP server with Flask using python where there is ...
38
votes
2answers
14k views

Will same-site cookies be sufficient protection against CSRF and XSS?

I must say, that I like this idea and it seems that it will bring a new form of protection against CSRF and XSS or at least it will reduce those attacks. So, how effective will this protection be? ...
0
votes
2answers
545 views

XSS in script tags application/json - possible?

Is there way to execute alert box if " is not correctly escaped and can be injected in example below? <script type="application/json">{"requests":{"postClicked"...
0
votes
1answer
70 views

Securing a Websocket Connection in case of XSS Vulnerability

Goal Authenticate the Client via HTTP Request. Authenticate the Client's WebSocket connection. Prevent exploitation of WebSocket connection(when a XSS Vulnerability is present on website). How I'm ...
0
votes
0answers
45 views

Taking html, js, css input from the user

We are building a multitenancy web app with Laravel (+Blade), each user can create a store (tenancy), and have a control panel where they can edit the store settings and styling, to edit the store ...
0
votes
1answer
59 views

Flask XSS prevention

I'm trying to fix a possible XSS vulnerability in WebApp (Flask) and I'm not sure what is the best way to prevent XSS without breaking functionality. For example, I have the following code block: ... ...
0
votes
0answers
57 views

Exploit an XSS without <> and valid encoding

I'm making a web penetration test, so I trying to exploit a XSS, I've looked that if I use a payload like the following: <script>alert(document.domain)</script> The output in the page ...
2
votes
1answer
55 views

web app 3rd party JS dependency vulnerability management

As a security engineer, I wonder about the common approach for web app 3rd party JS dependency vulnerability management. We have a lot of apps depend on Jquery etc. In a regular vulnerability scan, ...
1
vote
1answer
219 views

Keycloak's Angular quickstart : XSS vulnerable?

We are using Keycloak for the authentication of our server-side rendered applications (Java/Spring/Thymeleaf), and now we want to use it for our Angular applications. Using the Angular quickstart, ...
0
votes
2answers
201 views

Prevent URL encoding on form submit

During an engagement, I found a potential XSS vulnerability on a page. There is an HTML form that is submitted to this page (POST method) and sent parameters are reflected (without encoding) in the ...
3
votes
1answer
89 views

Is it better to disable X-XSS-Protection header or set the header as X-XSS-Protection: 0?

Because X-XSS-Protection header is now not supported by major browsers I wonder what option is better, to delete this header or to set the header as X-XSS-Protection: 0? Because browsers do not ...
1
vote
2answers
416 views

Is it possible to read and extract HTTP request headers via JavaScript while performing XSS & CSRF? If so, how?

Is it possible to read and extract HTTP request headers via JavaScript? i.e. something like; var req = new XMLHttpRequest(); req.open(‘GET’, document.location, false); req.send(null); var headers = ...
7
votes
2answers
12k views

Bypassing browsers URL encoding to do reflected XSS from query parameter?

I tried to get reflected XSS in vulnerable website with a request to the following URL: https://vulnerable.website/dir/dir?param1=test"><svg/onload=alert(1)> The browser URL encode the ...
0
votes
0answers
50 views

How to reliably detect Browser Exploitation Attacks with BeEF and other JavaScript hooking packages?

"Unlike other security frameworks, BeEF looks past the hardened network perimeter and client system, and examines exploitability within the context of the one open door: the web browser. BeEF ...
0
votes
2answers
234 views

read etc/passwd using XSS

by trying the XSS room on THM, I try was trying to read the /etc/passwd using the following cmd: <iframe src="/etc/passwd"></iframe> However what I got is an error code as shown ...
3
votes
2answers
1k views

How can I read local files from blind XSS?

When I do one of these payloads, I can see /etc/passwd: <iframe src=file:///etc/passwd></iframe> <img src="xasdasdasd" onerror="document.write('<iframe src=file:///etc/...
2
votes
2answers
1k views

NONCE not supported in Asp.Net for CSP implementation

Is NONCE supported in Asp.Net when implementing Content-Security-Policy header to protect from XSS ?? I read that NONCE was not supported in Asp.Net, however I read another simple article, that shows ...
1
vote
0answers
36 views

Does this qualify as Filename Upload DOM-XSS?

An application has the following javascript code which is triggered whenever an user tries to upload a file. a.html(fileName) then if the user uploads a file named <img src=x onerror=alert()> ...
0
votes
1answer
113 views

Is it possible to bypass this csp?

Today I created a web application. I'm using this csp to avoid xss attacks. CSP: Content-Security-Policy", `child-src 'none'; connect-src 'none'; default-src 'none'; font-src 'none'; frame-src '...
0
votes
1answer
448 views

XSS without angle brackets

I would like to run the following script inside an input tag when the page loads. I know how this can be fixed by using onfocus and autofocus. But how do I get the expression document.cookie in there? ...
42
votes
2answers
18k views

Is including the data scheme in your Content Security Policy safe?

I have a Cordova app that transforms some images to base64. This violates CSP with this message: Refused to load the image 'data:image/svg+xml;charset=US-ASCII,%3C%3Fxml%20version%3D%221.0%22%...
0
votes
1answer
182 views

How do I bypass a regex filter that filters all html to avoid xss?

How do I bypass a regex filter that filters all html to avoid xss? I've tried using things like &lt;img src="aa" onerror="alert(1)"&gt; but still no luck. This is for a CTF ...
1
vote
0answers
150 views

NodeJS, unrestricted file upload, RCE [closed]

I'm testing on application which runs on NodeJS, and discovered unrestriced file upload vulnerability, path traversal is not possible. Uploaded file is visitable, I can upload .html to perform XSS ...
9
votes
2answers
3k views

Is it sufficient to convert ', < and > to avoid XSS in JavaScript strings?

Is it sufficient to convert ' to &#039; , > to &gt; and < to &lt; to avoid XSS when inserting untrusted data into a JavaScript string as below? <script> param='payload'; </...
1
vote
2answers
188 views

Does OpenID Connect provide CSRF and XSS protection?

I've been reading several articles recently about how storing JWTs in local or session storage is inherently insecure. The mitigation is apparently to implement a "session ID pattern", i.e. ...
0
votes
1answer
40 views

is XSS in Content-Disposition possible?

There is a web application that can upload HTML files and also download the uploaded file. When I upload an HTML file containing the script tag and download it, the response is as follows. HTTP/1.1 ...
5
votes
4answers
7k views

XSS scripts in console

Well i need to know is it possible to enter xss script through console of developer's tools(e.g. : firebug of firefox)? Is this a proper way ?
3
votes
1answer
3k views

XSS via -confirm()-

I was reading this article here, in the middle I saw the author used -confirm()- as the payload. I'd like to know what is this payload? I mean what's the difference between -confirm()- and <script&...
-1
votes
1answer
48 views

XSS Inside the text part of an <a> tag [closed]

How do I xss inside <a href="https://gooogle.com">here</a> ? I have tried normally using alert() but it didn't work
0
votes
1answer
1k views

Storing encrypted tokens in LocalStorage

I am building a JavaScript application that will run in a web browser but also as a pseudo-native mobile application via Apache Cordova. It communicates via API to a separate backend service. The app ...
0
votes
0answers
49 views

Security issues in xhr DOM update

I'm writing a javascript code that update DOM with html/javascript from XMLlHttpRequest response (A sort of JQuery's $.load() function), depending on some client side condition (e.g. which browser ...
1
vote
1answer
261 views

Can a malware steals my Facebook c_user, xs, and datr Cookies?

Just as the title suggests. I have a PasswordStealer on my PC and I'm afraid that it can do that. AFAIK, that malware can record keystrokes and steal saved passwords which I don't mind because I don't ...

1
2 3 4 5
29