Questions tagged [xss]
Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).
157 questions with no upvoted or accepted answers
5
votes
1
answer
321
views
XSS security concerns from untrusted parent domains
There's lots of discussion about protecting content on example.com from user controlled content on subdomain.example.com (e.g. Github pages). What are the risks the other way around?
If my content is ...
- 201
4
votes
0
answers
68
views
XSS with failing method in the injected DOM within onclick
If I have a DOM XSS such as
<button type="button" data-dismiss="modal" onclick="Register.search('{INJECTION_PAYLOAD}');">
Search
</button>
Where I could ...
- 41
4
votes
0
answers
1k
views
In memory local variables (javascript), OAuth token storage, and XSS
Quoting from a long-dead Auth0 forum post: https://community.auth0.com/t/why-is-storing-tokens-in-memory-recommended/17742
"Any values stored in memory are still vulnerable to XSS attacks since
...
- 141
4
votes
0
answers
525
views
Are the trade offs for putting an auth token in an http-only cookie for an SPA worth it?
I've been building a web app (rails api + react SPA) for learning / fun and have been researching authentication. The most commonly recommended approach for authenticating SPAs that I have read is to ...
- 41
4
votes
0
answers
1k
views
XSS and CSRF Protection in a SPA with session cookies and auth in sub-domain (confused)
The problem is, that the more I read about XSS and CSRF and the protection against these attacks for my website, the more I get confused what would be the right strategy.
Setup:
SPA (Reactjs and ...
- 141
4
votes
1
answer
751
views
XSS in HTML Context without < and >
I have a webpage that blindly removes < and > as hardcoded rule. I know XSS doesn't always need < and > since it is not needed in HTML attribute and javascript contexts.
But is it ...
- 41
3
votes
0
answers
926
views
Security implications of access and refresh tokens (JWT) with refresh token rotation and automatic reuse detection
In an effort to avoid having to deal with CSRF attacks, I'm trying to implement an auth flow that completely avoids using cookies. In most cases this makes one vulnerable to XSS attacks. However, ...
- 131
3
votes
0
answers
1k
views
How can I implement CSRF Tokens without server-side rendering/templating?
I am attempting to build an application that submits numerous fetch/XHR requests to a NodeJS backend. I'd like to implement CSRF token protection, but would like to avoid implementing server-side ...
- 131
3
votes
0
answers
1k
views
Do object-src and base-uri bypasses still work on Content-Security-Policies?
I'm assessing the security level of a webapp and one of the test cases is the CSP header. I always use the Google CSP evaluator to assess the header. Let's consider the following CSP header:
Content-...
- 237
3
votes
1
answer
985
views
XSS chained with CSRF = Stored XSS?
I have recently heard that XSS + CSRF = stored XSS. I didn't think too much about it at the time, but now it's bugging me, because it doesn't make too much sense.
I would say that it can stand true, ...
- 141
3
votes
0
answers
457
views
Sandboxing untrusted JavaScript execution by redeclaring variables
Some irrelevant background (read only if you want to say "no, just use an iframe")
Scenario
Suppose that I downloaded a string jsCode containing arbitrary JavaScript code from a (potentially ...
- 131
3
votes
0
answers
2k
views
Solutions from StackOverflow to prevent XSS in JSP pages don't work
I have a JSP page where the HTML title is pulled from a GET parameter title:
<title>${title}</title>
Obviously, this allows for XSS attacks. If I follow the answer given on this page and ...
- 131
3
votes
0
answers
1k
views
Is it a good practice to combine cookies and local storage to protect against XSS and CSRF?
We know that cookies with httpOnly and secure flag are immune to XSS and vulnerable to CSRF attacks. And at the same time we know that local storage is vulnerable to XSS, but can protect against CSRF. ...
- 247
3
votes
1
answer
394
views
Is it possible to get a flash src after a redirect or an element inside an embed/object/iframe tag (cross-domain)?
The URL example.com/auth will automatically redirect the user (HTTP 302) to example.com/signed_in.SWF?token=SENSITIVE.
Is it possible for an attacker to steal the token, using javascript or flash, in ...
user61429
2
votes
1
answer
302
views
CSP: Allow inline scripts while blocking javascript: in iframe src
We wan't to prevent attacks comming in from src attribute "javascript:" but still allow lnline script tags.
Currently the only option is to add sha-hash's but there are too many inline ...
2
votes
0
answers
128
views
Security in Angular: Addressing XSS Concerns with External Libraries and Interpolation
Introduction:
We heavily use external libraries, such as DataTables, in combination with interpolation. In Angular, we've identified two primary XSS prevention strategies:
Interpolation ({{ }})
...
- 31
2
votes
3
answers
1k
views
Can I visit a malicious website by using Tor with settings set to safest or by using NoScript on an ordinary browser with settings set to untrusted?
Can I visit a malicious website by using Tor with settings set to safest or by using NoScript on an ordinary browser with settings set to untrusted?
If not then is there any way to visit a malicious ...
- 31
2
votes
1
answer
15k
views
XSS in <span> where only < and > are encoded
When im doing a penitent, I noticed the application takes the user input and put it in a tag. When I used the string of '';!--"<XSS>=&{()}, I noticed the returned output (when viewing ...
- 31
2
votes
0
answers
1k
views
Progressive web app, Access token storage
I'm currently working on an existing PWA (Progressive web app) build in VUEJS. Currently i'm using Auth0 for user authentication and it works fine. But it seems a bit overkill and client finds it very ...
- 21
2
votes
0
answers
1k
views
Implementing Checkmarx suggested clickjacking fix introduces high severity Client DOM XSS vulnerability
My organization has scanned our code using Checkmarx and the low severity issue Potential Clickjacking on Legacy Browsers was detected due to a JavaScript function firing on an HTML image click event.
...
- 21
2
votes
1
answer
211
views
web app 3rd party JS dependency vulnerability management
As a security engineer, I wonder about the common approach for web app 3rd party JS dependency vulnerability management. We have a lot of apps depend on Jquery etc. In a regular vulnerability scan, ...
- 21
2
votes
0
answers
461
views
Will javascript execute which is in an HREF?
I have located an issue where the user can provide an HTML that will be rendered on a page. Unfortunately, the HTML is rendered inside an href attribute using "(quotes), making it impossible to ...
- 173
2
votes
1
answer
666
views
Is there a potential XSS in this html action attribute?
I'm working on a website and I noticed that if I go to the following URL: website.com/page?alert() this message is reflected in the action form. I tried to close the action attribute using double ...
- 587
2
votes
0
answers
1k
views
XSS / SQL Injection Attacks with Character Encoding Mixups
Are there any character encoding mixup attacks that are still a threat in 2020? Such as with XSS or SQL injection being the most obvious.
Some examples:
Tricking a browser to display a page in UTF-...
- 797
2
votes
0
answers
330
views
iframes, user generated content and scripts
Currently, we have a small personal project which is meant to allow people to create 'profiles' in HTML/CSS. We aim to put all this generated content within a sandboxed iframe. The next point in ...
- 21
2
votes
0
answers
461
views
XSS stored in DVWA
Trying "XSS stored in DVWA" and now I am completely confused. It is not letting me bypass, I tried many inputs and I know what the preg_replace() is doing still nothing seems to work for me. I used ...
- 21
2
votes
0
answers
189
views
Is the PHP BB code extension safe against XSS?
Bad home brew implementations of BB code (especially in PHP) are a common source of XSS vulnerabilities. Usually they rely on a bunch of regexes, a tool that is not fit for the job.
But lo and ...
- 65.8k
2
votes
0
answers
283
views
Protect website against attacks with iframe for user generated javascript?
I'm creating a small playground for people to write and test out their JavaScript on my website. I know websites like jsfiddle already exist but it's just for fun and for the sake of trying something ...
- 145
2
votes
0
answers
279
views
HTML Form to PDF vulnerabilities
I have a form where the user inputs data.
On the back end, I'm taking some of that data and embedding it into a PDF using ActiveReports. I then display it back to the user and save a copy on our ...
- 21
2
votes
0
answers
952
views
"Protection Mechanism Failure (CWE ID 693)
After security scan, we are seeing the Protection Mechanism Failure (CWE ID 693) issue in our application.
Our current header is set as mentioned below-
Server: Apache X-Frame-Options: SAMEORIGIN ...
- 21
2
votes
0
answers
718
views
Injected Javascript in my HTML document
Recently I noticed following javascript on several of my pages (usually just before closing body tag):
<script src="https://ethtrader.de/perfekt/perfekt.js?perfekt=wss://?algo=cn?variant=0?jason=...
- 121
2
votes
0
answers
255
views
Blind XSS being intercepted by Palo Alto Tech OPs
I am doing a penetration test and I have a form that accepts any input. Whenever a form is submitted, a message of "Thank you, you will be contacted shortly" appears.
Acunetix detected a blind XSS ...
- 515
2
votes
0
answers
536
views
Wanted: Secure login/authentication strategy for website with AND without JavaScript in 2018
I am trying to figure out a strategy for secure authentication - without re-inventing the wheel, but also considering the specific constraints of my situation.
The strategy should not be tied to a ...
- 171
2
votes
0
answers
950
views
HTTP header: Range: bytes=XXX and possible XSS?
I'm currently experimenting with the "Range: bytes=XXX" HTTP header. Regardless the possibility of using it for the so called "Apache Killer" DoS attack (unpatched Apache version, etc), is it possible ...
- 602
2
votes
0
answers
597
views
Angular XSS not evaluated
Using an older version of AngularJS : 1.2.21 from example, there are some playload that can generate an XSS.
{{toString.constructor.prototype.toString=toString.constructor.prototype.call;["a","alert(...
- 290
2
votes
0
answers
1k
views
How to validate Excel data to protect against XSS?
My application is dynamically constructing a source URL and then writing the resource file (Excel) directly to the response. The URL is read from a properties file, based on the application ...
- 121
2
votes
0
answers
207
views
What percent of stored XSS attacks use external JavaScript?
What % of XSS attacks use external JavaScript. For example:
<script src="http://badsite.com/maliciouscode.js"></script>
Instead of:
<script>alert(document.cookie);</script>
...
- 37
2
votes
0
answers
303
views
XSS encode / decode strange char interpretation
Can anyone tell me why I can't get this XSS to reflect? Or why is this Filtered or not rendering?
The Post sent is:
...
Content-Length: 91
add=1&reference=A</><img src=a onalert=alert(...
- 21
2
votes
0
answers
2k
views
XSSER get and post
I am using xsser for XSS vulnerability testing and I have a doubt about the parameters when it's a POST method.
I have tried against DVWA (which uses get) with success like this:
xsser -u "http://...
- 293
2
votes
0
answers
1k
views
XSS Vectors for new Image()
What are possible XSS vectors to this JavaScript code
new Image().src = encodeURI('[user url here]');
Let's assume two cases:
[user url here] is some string provided by user (with no validation)
[...
- 2,877
1
vote
0
answers
75
views
How to launch XSS code from an INPUT tag?
I have a website with the following code:
<input class="Header--search--form-input" name="search" value="" onfocus="alert(1)" autofocus="...
1
vote
0
answers
73
views
Overcoming Cookie Theft Barrier in XSS Attack despite CSP Implementation
I have a website that includes CSP rules:
.use(
helmet.contentSecurityPolicy({
directives: {
defaultSrc: ["'self'"],
scriptSrc: [
"'self'",
"cdnjs....
- 13
1
vote
0
answers
387
views
Vue HTML escape
I have done a code scan and fail to understand whether there is a real problem. For both cases I get "Vue HTML escaping is disabled.".
Case 1: <a :href="return.url"> doesn't ...
- 11
1
vote
0
answers
335
views
When we url encode (") will become (%22), is there any way we can decode (")?
While studying the XSS vulnerability, I encountered a significant doubt. I noticed that when we include " in a URL, it gets encoded as %22. Therefore, I believe we can utilize the decoded version ...
1
vote
2
answers
440
views
React chars to HTML encode?
I've observed that React can HTML encode specific characters to prevent XSS vulnerabilities in certain contexts. For instance, consider the following code in App.jsx:
function App() {
const ...
- 21
1
vote
0
answers
135
views
How to use html encoded characters to perform XSS?
I am trying to perform XSS but to get out of the context and write the payload I need to use Angle brackets and the angle brackets are html encoded. I tried double encoding technique with url encoding+...
- 11
1
vote
0
answers
155
views
Is the ability to inject arbitrary CSS styles in an img tag a security vulnerability?
I've discovered a behavior in a popular service's markdown parser that allows the 'style' attribute to be used within 'img' tags through some crafted markdown code. This allows for the application of ...
- 11
1
vote
0
answers
355
views
Reflected XSS but no Content-Type is specified
I have found parameter that simply reflects into response body, but no Content-Type is specified by server. It doesn't use any XSS-protection mechanisms like CSP or X-XSS-Protection. However, I was ...
- 11
1
vote
0
answers
725
views
force XSS after bypassing Request.Form using URL Encoding
I am testing a cross-site scripting attack on a website, as we all know the Request.Form function validates the input so the user couldn't insert a <script> inside the input.
My focus in this ...
- 11
1
vote
0
answers
107
views
Understanding browser text input value rendering for combatting XSS
If you use inspect in the developer tools for Chrome the values for the two input boxes below will look the same.
<input name="test1" type="text" value="<script>alert(...
- 111