Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [xss]

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

Filter by
Sorted by
Tagged with
0 votes
0 answers
43 views

Is it a good idea to implement an XSS blocking middleware like cloudflare? [closed]

I noticed that whenever someone tries to send XSS data, Cloudflare blocks it. So I tested it and concluded the pattern. I want to implement a Regex that detects any XSS pattern and block it. Note: I ...
3 votes
1 answer
880 views

XSS chained with CSRF = Stored XSS?

I have recently heard that XSS + CSRF = stored XSS. I didn't think too much about it at the time, but now it's bugging me, because it doesn't make too much sense. I would say that it can stand true, ...
0 votes
1 answer
39 views

Running blog under /blog, security considerations

I'd like to set up a self-hosted Ghost.org blog for a SaaS. I have two options: example.com/blog blog.example.com Everywhere I read they recommend the /blog for SEO. However, I'm concerned about the ...
0 votes
1 answer
116 views

Is it possible to trick a user into logging in to a site, then stealing a non HttpOnly cookie that will be set after they log in?

If a user has already logged in, and then the site sets a non HttpOnly cookie, then it seems possible to trick the user into doing something that would lead to the cookie being stolen. If the cookie ...
-1 votes
1 answer
541 views

XSS cookie Stealing with Character limitations

The rules also Include 1. No jQuery 2. Only through making an API AJAX request. 3.character limitation of 100 characters. Can any suggest me how I can build a payload sticking with these rules.
13 votes
4 answers
15k views

How can I execute a XSS when a web application transforms a data from lowercase to uppercase?

I'm testing a web application, when I send an input data to web application, this places the data in an onclick function, something like this: <a href="#" onclick="someFunction('dataFromServer', '...
0 votes
1 answer
462 views

How do I test for Reflected XSS in webpage titles, url parameters and javascript variables?

I have a java web app. I'm using OWASP Java Encoder to encode for html, javascript and url components to mitigate reflected XSS. I'm new to this so I'm not sure on how to test on my web app for the ...
0 votes
2 answers
345 views

What are the risks of XSS in this forms?

I recently developed a website that was operational for me ^^ However, someone came to try injections and found an XSS flaw. I have a form like this: <h2> <span>Search</span> </...
1 vote
2 answers
864 views

XSS against jQuery PortSwigger challenge

I am trying to do this jQuery XSS challenge here by PortSwigger. They have a good walkthrough for XSS attacks, however I could not find anything on jQuery, which is also a programming language I have ...
0 votes
0 answers
47 views

Overcoming Middleware: Exploiting XSS to Retrieve Data

I am attempting to perform an XSS attack on my server and have successfully bypassed the CSP. In my server code, I store all users in the following manner: .get("/users", adminReq, (req, ...
2 votes
1 answer
557 views

Is there a potential XSS in this html action attribute?

I'm working on a website and I noticed that if I go to the following URL: website.com/page?alert() this message is reflected in the action form. I tried to close the action attribute using double ...
5 votes
1 answer
300 views

XSS security concerns from untrusted parent domains

There's lots of discussion about protecting content on example.com from user controlled content on subdomain.example.com (e.g. Github pages). What are the risks the other way around? If my content is ...
1 vote
0 answers
47 views

Overcoming Cookie Theft Barrier in XSS Attack despite CSP Implementation

I have a website that includes CSP rules: .use( helmet.contentSecurityPolicy({ directives: { defaultSrc: ["'self'"], scriptSrc: [ "'self'", "cdnjs....
1 vote
1 answer
571 views

Is there any way to break the HTML attributes without using single/double quotes?

I have the following code, <li data-type="test" title="?"> test </li> Following values were Not allowed <>&*#%\'"= My goal here is to get a javascript popup to appear. is ...
2 votes
1 answer
263 views

Does this qualify as Filename Upload DOM-XSS?

An application has the following javascript code which is triggered whenever an user tries to upload a file. a.html(fileName) then if the user uploads a file named <img src=x onerror=alert()> ...
1 vote
1 answer
3k views

"One of your code blocks includes unescaped HTML." JS console security warning

I operate a blog using Google's Blogger platform about programming. I use highlight.js for syntax highlighting, and now on my posts I see the console warning: One of your code blocks includes ...
0 votes
1 answer
78 views

Bypassing CSP and implementing XSS attack

I am using Content Security Policy (CSP) rules in my code to defend against XSS attacks. Here are the CSP rules I have implemented using Helmet: .use( helmet.contentSecurityPolicy({ directives: { ...
0 votes
3 answers
3k views

Prevent URL encoding on form submit

During an engagement, I found a potential XSS vulnerability on a page. There is an HTML form that is submitted to this page (POST method) and sent parameters are reflected (without encoding) in the ...
3 votes
2 answers
3k views

Is it still possible to use HTTP TRACE for XSS in modern Web Browsers?

Let's assume we are talking about top 10 most used web browsers: Usage share of web browsers https://www.cgisecurity.com/questions/httptrace.shtml 'TRACE' is a HTTP request method used for ...
1 vote
1 answer
12k views

XSS in <span> where only < and > are encoded

When im doing a penitent, I noticed the application takes the user input and put it in a tag. When I used the string of '';!--"<XSS>=&{()}, I noticed the returned output (when viewing ...
0 votes
0 answers
77 views

Does other frontend framework have similar issue like AngularJS?

I'm reading an article that talks about XSS exploitation on AngularJS, AngularJS will render the template in ng-html, and it bypasses sanitize-html. My questions, I'm wondering if other frameworks ...
0 votes
1 answer
579 views

XSS bypass in url

I have a website: https://bugbounty.com/test/"injection inside js", but " is escaped with \ and I'm trying to inject </script><script>alert() but https://bugbounty.com/test/&...
0 votes
0 answers
52 views

Cross Site Scripting with URL protocol schema javascript

I'm testing a web application and I found a XSS vulnerability. I can inject schemas like data:// or tel:// but they have blocked the javascript:// schema. On current browsers the origin is null if I ...
-1 votes
1 answer
116 views

How to sanitize $_SERVER url variables?

An attacker used the HTTP_REFERER variable to inject Javascript by sending the following in the Header: Referer: &#x6a;&#x61;&#x76;&#x61;&#x73;&#x63;&#x72;&#x69;&#...
0 votes
2 answers
53 views

Is There a way to exploiting / Make exploit scenario for Header based reflected XSS?

I've found a reflected XSS, but the problem is that the attack vector is the header (any header). Is there a way to develop an exploit scenario based on this?
101 votes
8 answers
119k views

What could an "<img src=" XSS do?

Most WAFs when blocking XSS will block obvious tags like script and iframe, but they don't block img. Theoretically, you can img src='OFFSITE URL', but what's the worse that can happen? I know you ...
0 votes
1 answer
198 views

Is <img :src="require`${JSON.parse(string)}`"> in electron vue is safe from XSS?

I am inspecting a client's application written with Vue.js and I found there a following construction. // Somewhere else in the code var data = JSON.parse(jsonString); // In the vue component <...
5 votes
2 answers
612 views

How to exploit XSS and SQL injection via HTTP verb tampering?

I was reading a paper about 'HTTP verb tampering' here: https://blog.jeremiahgrossman.com/2008/06/what-you-need-to-know-about-http-verb.html The author said: HTTP verb tampering is generally used in ...
2 votes
3 answers
802 views

Can I visit a malicious website by using Tor with settings set to safest or by using NoScript on an ordinary browser with settings set to untrusted?

Can I visit a malicious website by using Tor with settings set to safest or by using NoScript on an ordinary browser with settings set to untrusted? If not then is there any way to visit a malicious ...
2 votes
1 answer
143 views

Secure way to output encoding HTML for insert raw html via javascript

I want to be 100% secure, I create raw html this way: const template = document.createElement('template') template.innerHTML = html_raw const cloned = template.content.cloneNode(true) document....
0 votes
1 answer
85 views

Preventing HTTP requests containing XSS in nodeJS

I want my expresJS server to detect and stop any request containing XSS input before it gets saved in the database, as my website does not utilize any html input, and it does not need to. What is the ...
2 votes
1 answer
183 views

web app 3rd party JS dependency vulnerability management

As a security engineer, I wonder about the common approach for web app 3rd party JS dependency vulnerability management. We have a lot of apps depend on Jquery etc. In a regular vulnerability scan, ...
1 vote
1 answer
159 views

Is this a type of XSS attack?

I have been exploring customer support in a website as part of bug bounty program. I then started a chat with their customer support and pasted the following in the box: <!--<img src="-->...
0 votes
1 answer
192 views

Validating XSS script with success response with expected data in REST API

I am performing security testing on a REST API and it is a POST method. I injected an XSS script in a body parameter and the API responded with '200 success' response with the actual expected data. If ...
1 vote
1 answer
13k views

DOM based XSS using window.location.hash

Target code: if($(location.href.split("#")[1])) { var target = $('#'+location.href.split("#")[1]); if (target.length) { $('html,body').animate({ scrollTop: target.offset().top - 160 //...
0 votes
1 answer
109 views

React chars to HTML encode?

I've observed that React can HTML encode specific characters to prevent XSS vulnerabilities in certain contexts. For instance, consider the following code in App.jsx: function App() { const ...
8 votes
3 answers
10k views

XSS inside anchor tag (<a>) without user interaction?

Is it possible to inject a payload inside <a> tag such that the script runs without user interaction? The injection is inside the href attribute. I can inject onmouseover or onclick attributes, ...
0 votes
2 answers
118 views

Does CSP protect against XSS in url?

If I have a web app that is vulnerable to XSS in the url (reflected XSS), does CSP protect against this type of XSS? Ex: when I run www.example.com/<script>alert(1);</script> in the ...
1 vote
1 answer
458 views

CSP script-scr blob

What are the risks to allow a "blob:" directive to the script-src CSP? Is it safe? I have a list of allowed domains defined in script-src, but nonetheless I got an error specifying the ...
3 votes
2 answers
894 views

CVSS3 score for XSS leading to account takeover

Let's say there is a XSS vulnerability in a web application. The XSS allows an attacker to hijack the user's session. Within the session, the attacker can view/modify the user's credit card and ...
11 votes
0 answers
32k views

How to make Firefox ignore the X-XSS-Protection response header?

I have two questions: How can I make Firefox ignore the X-XSS-Protection header? I have a website which sends an X-XSS-Protection: 1 header and I want my Firefox to ignore that header, because it ...
2 votes
1 answer
378 views

Is it possible to get a flash src after a redirect or an element inside an embed/object/iframe tag (cross-domain)?

The URL example.com/auth will automatically redirect the user (HTTP 302) to example.com/signed_in.SWF?token=SENSITIVE. Is it possible for an attacker to steal the token, using javascript or flash, in ...
1 vote
0 answers
149 views

Vue HTML escape

I have done a code scan and fail to understand whether there is a real problem. For both cases I get "Vue HTML escaping is disabled.". Case 1: <a :href="return.url"> doesn't ...
8 votes
2 answers
2k views

Security Headers: Access-Control-Allow-Origin vs. Cross-Origin-Resource-Policy (CORP)

Can someone explain the difference between the Access-Control-Allow-Origin header and the Cross-Origin-Resource-Policy header? According to MDN: The Access-Control-Allow-Origin response header ...
1 vote
1 answer
2k views

Storing encrypted tokens in LocalStorage

I am building a JavaScript application that will run in a web browser but also as a pseudo-native mobile application via Apache Cordova. It communicates via API to a separate backend service. The app ...
4 votes
1 answer
717 views

XSS in HTML Context without < and >

I have a webpage that blindly removes < and > as hardcoded rule. I know XSS doesn't always need < and > since it is not needed in HTML attribute and javascript contexts. But is it ...
1 vote
0 answers
152 views

When we url encode (") will become (%22), is there any way we can decode (")?

While studying the XSS vulnerability, I encountered a significant doubt. I noticed that when we include " in a URL, it gets encoded as %22. Therefore, I believe we can utilize the decoded version ...
0 votes
1 answer
147 views

is <script>javascript:alert(document.domain); a valid script for xss?

I have submit the following text <script>javascript:alert(document.domain); in a feedback of a restaurant listed on a website and feedback is sent to website not restaurant. I want to verify but ...
1 vote
2 answers
1k views

Difference Between Reflected XSS and Reflected-DOM XSS

What's the difference between Reflected XSS (RXSS) and Reflected-DOM XSS (RDOMXSS)? After some research, I think it can be concluded that Reflected-DOM XSS is: Similarities: The value is reflected by ...
2 votes
1 answer
2k views

Can a malware steals my Facebook c_user, xs, and datr Cookies?

Just as the title suggests. I have a PasswordStealer on my PC and I'm afraid that it can do that. AFAIK, that malware can record keystrokes and steal saved passwords which I don't mind because I don't ...

1
2 3 4 5
31