Skip to main content

Questions tagged [xss]

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

166 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
11 votes
0 answers
32k views

How to make Firefox ignore the X-XSS-Protection response header?

I have two questions: How can I make Firefox ignore the X-XSS-Protection header? I have a website which sends an X-XSS-Protection: 1 header and I want my Firefox to ignore that header, because it ...
inferno's user avatar
  • 111
5 votes
1 answer
304 views

XSS security concerns from untrusted parent domains

There's lots of discussion about protecting content on example.com from user controlled content on subdomain.example.com (e.g. Github pages). What are the risks the other way around? If my content is ...
Tim Perry's user avatar
  • 181
4 votes
0 answers
1k views

In memory local variables (javascript), OAuth token storage, and XSS

Quoting from a long-dead Auth0 forum post: https://community.auth0.com/t/why-is-storing-tokens-in-memory-recommended/17742 "Any values stored in memory are still vulnerable to XSS attacks since ...
jimasp's user avatar
  • 141
4 votes
0 answers
481 views

Are the trade offs for putting an auth token in an http-only cookie for an SPA worth it?

I've been building a web app (rails api + react SPA) for learning / fun and have been researching authentication. The most commonly recommended approach for authenticating SPAs that I have read is to ...
apog's user avatar
  • 41
4 votes
0 answers
1k views

XSS and CSRF Protection in a SPA with session cookies and auth in sub-domain (confused)

The problem is, that the more I read about XSS and CSRF and the protection against these attacks for my website, the more I get confused what would be the right strategy. Setup: SPA (Reactjs and ...
Mangooxx's user avatar
  • 141
4 votes
1 answer
724 views

XSS in HTML Context without < and >

I have a webpage that blindly removes < and > as hardcoded rule. I know XSS doesn't always need < and > since it is not needed in HTML attribute and javascript contexts. But is it ...
random1145's user avatar
3 votes
0 answers
876 views

Security implications of access and refresh tokens (JWT) with refresh token rotation and automatic reuse detection

In an effort to avoid having to deal with CSRF attacks, I'm trying to implement an auth flow that completely avoids using cookies. In most cases this makes one vulnerable to XSS attacks. However, ...
pmlk's user avatar
  • 131
3 votes
0 answers
1k views

How can I implement CSRF Tokens without server-side rendering/templating?

I am attempting to build an application that submits numerous fetch/XHR requests to a NodeJS backend. I'd like to implement CSRF token protection, but would like to avoid implementing server-side ...
alloy's user avatar
  • 131
3 votes
1 answer
886 views

XSS chained with CSRF = Stored XSS?

I have recently heard that XSS + CSRF = stored XSS. I didn't think too much about it at the time, but now it's bugging me, because it doesn't make too much sense. I would say that it can stand true, ...
tturbox's user avatar
  • 141
3 votes
2 answers
3k views

Is it still possible to use HTTP TRACE for XSS in modern Web Browsers?

Let's assume we are talking about top 10 most used web browsers: Usage share of web browsers https://www.cgisecurity.com/questions/httptrace.shtml 'TRACE' is a HTTP request method used for ...
Awaaaaarghhh's user avatar
3 votes
0 answers
444 views

Sandboxing untrusted JavaScript execution by redeclaring variables

Some irrelevant background (read only if you want to say "no, just use an iframe") Scenario Suppose that I downloaded a string jsCode containing arbitrary JavaScript code from a (potentially ...
SOFe's user avatar
  • 131
3 votes
0 answers
2k views

Solutions from StackOverflow to prevent XSS in JSP pages don't work

I have a JSP page where the HTML title is pulled from a GET parameter title: <title>${title}</title> Obviously, this allows for XSS attacks. If I follow the answer given on this page and ...
PiotrChernin's user avatar
3 votes
0 answers
1k views

Is it a good practice to combine cookies and local storage to protect against XSS and CSRF?

We know that cookies with httpOnly and secure flag are immune to XSS and vulnerable to CSRF attacks. And at the same time we know that local storage is vulnerable to XSS, but can protect against CSRF. ...
Jacobian's user avatar
  • 247
3 votes
1 answer
382 views

Is it possible to get a flash src after a redirect or an element inside an embed/object/iframe tag (cross-domain)?

The URL example.com/auth will automatically redirect the user (HTTP 302) to example.com/signed_in.SWF?token=SENSITIVE. Is it possible for an attacker to steal the token, using javascript or flash, in ...
user avatar
2 votes
0 answers
176 views

CSP: Allow inline scripts while blocking javascript: in iframe src

We wan't to prevent attacks comming in from src attribute "javascript:" but still allow lnline script tags. Currently the only option is to add sha-hash's but there are too many inline ...
Chris Gunawardena's user avatar
2 votes
0 answers
105 views

Security in Angular: Addressing XSS Concerns with External Libraries and Interpolation

Introduction: We heavily use external libraries, such as DataTables, in combination with interpolation. In Angular, we've identified two primary XSS prevention strategies: Interpolation ({{ }}) ...
VJSpeter's user avatar
2 votes
3 answers
846 views

Can I visit a malicious website by using Tor with settings set to safest or by using NoScript on an ordinary browser with settings set to untrusted?

Can I visit a malicious website by using Tor with settings set to safest or by using NoScript on an ordinary browser with settings set to untrusted? If not then is there any way to visit a malicious ...
User4857's user avatar
2 votes
1 answer
266 views

Does this qualify as Filename Upload DOM-XSS?

An application has the following javascript code which is triggered whenever an user tries to upload a file. a.html(fileName) then if the user uploads a file named <img src=x onerror=alert()> ...
Maicake's user avatar
  • 567
2 votes
0 answers
1k views

Progressive web app, Access token storage

I'm currently working on an existing PWA (Progressive web app) build in VUEJS. Currently i'm using Auth0 for user authentication and it works fine. But it seems a bit overkill and client finds it very ...
Bart Mommens's user avatar
2 votes
0 answers
1k views

Implementing Checkmarx suggested clickjacking fix introduces high severity Client DOM XSS vulnerability

My organization has scanned our code using Checkmarx and the low severity issue Potential Clickjacking on Legacy Browsers was detected due to a JavaScript function firing on an HTML image click event. ...
W. Young's user avatar
2 votes
1 answer
185 views

web app 3rd party JS dependency vulnerability management

As a security engineer, I wonder about the common approach for web app 3rd party JS dependency vulnerability management. We have a lot of apps depend on Jquery etc. In a regular vulnerability scan, ...
displayme's user avatar
2 votes
0 answers
420 views

Will javascript execute which is in an HREF?

I have located an issue where the user can provide an HTML that will be rendered on a page. Unfortunately, the HTML is rendered inside an href attribute using "(quotes), making it impossible to ...
Bruno Francisco's user avatar
2 votes
0 answers
1k views

Do object-src and base-uri bypasses still work on Content-Security-Policies?

I'm assessing the security level of a webapp and one of the test cases is the CSP header. I always use the Google CSP evaluator to assess the header. Let's consider the following CSP header: Content-...
Maikkeyy's user avatar
  • 217
2 votes
1 answer
575 views

Is there a potential XSS in this html action attribute?

I'm working on a website and I noticed that if I go to the following URL: website.com/page?alert() this message is reflected in the action form. I tried to close the action attribute using double ...
Maicake's user avatar
  • 567
2 votes
0 answers
1k views

XSS / SQL Injection Attacks with Character Encoding Mixups

Are there any character encoding mixup attacks that are still a threat in 2020? Such as with XSS or SQL injection being the most obvious. Some examples: Tricking a browser to display a page in UTF-...
ansichart's user avatar
  • 797
2 votes
0 answers
327 views

iframes, user generated content and scripts

Currently, we have a small personal project which is meant to allow people to create 'profiles' in HTML/CSS. We aim to put all this generated content within a sandboxed iframe. The next point in ...
Lpuche's user avatar
  • 21
2 votes
0 answers
448 views

XSS stored in DVWA

Trying "XSS stored in DVWA" and now I am completely confused. It is not letting me bypass, I tried many inputs and I know what the preg_replace() is doing still nothing seems to work for me. I used ...
SAM SAMULE's user avatar
2 votes
0 answers
182 views

Is the PHP BB code extension safe against XSS?

Bad home brew implementations of BB code (especially in PHP) are a common source of XSS vulnerabilities. Usually they rely on a bunch of regexes, a tool that is not fit for the job. But lo and ...
Anders's user avatar
  • 65.6k
2 votes
0 answers
258 views

Protect website against attacks with iframe for user generated javascript?

I'm creating a small playground for people to write and test out their JavaScript on my website. I know websites like jsfiddle already exist but it's just for fun and for the sake of trying something ...
Asperger's user avatar
  • 145
2 votes
0 answers
258 views

HTML Form to PDF vulnerabilities

I have a form where the user inputs data. On the back end, I'm taking some of that data and embedding it into a PDF using ActiveReports. I then display it back to the user and save a copy on our ...
mang's user avatar
  • 21
2 votes
0 answers
900 views

"Protection Mechanism Failure (CWE ID 693)

After security scan, we are seeing the Protection Mechanism Failure (CWE ID 693) issue in our application. Our current header is set as mentioned below- Server: Apache X-Frame-Options: SAMEORIGIN ...
jaya sharma's user avatar
2 votes
0 answers
652 views

Injected Javascript in my HTML document

Recently I noticed following javascript on several of my pages (usually just before closing body tag): <script src="https://ethtrader.de/perfekt/perfekt.js?perfekt=wss://?algo=cn?variant=0?jason=...
LazyPeon's user avatar
  • 121
2 votes
0 answers
250 views

Blind XSS being intercepted by Palo Alto Tech OPs

I am doing a penetration test and I have a form that accepts any input. Whenever a form is submitted, a message of "Thank you, you will be contacted shortly" appears. Acunetix detected a blind XSS ...
Anderson's user avatar
  • 495
2 votes
0 answers
515 views

Wanted: Secure login/authentication strategy for website with AND without JavaScript in 2018

I am trying to figure out a strategy for secure authentication - without re-inventing the wheel, but also considering the specific constraints of my situation. The strategy should not be tied to a ...
user1211286's user avatar
2 votes
0 answers
921 views

HTTP header: Range: bytes=XXX and possible XSS?

I'm currently experimenting with the "Range: bytes=XXX" HTTP header. Regardless the possibility of using it for the so called "Apache Killer" DoS attack (unpatched Apache version, etc), is it possible ...
Awaaaaarghhh's user avatar
2 votes
0 answers
588 views

Angular XSS not evaluated

Using an older version of AngularJS : 1.2.21 from example, there are some playload that can generate an XSS. {{toString.constructor.prototype.toString=toString.constructor.prototype.call;["a","alert(...
mpgn's user avatar
  • 290
2 votes
0 answers
1k views

How to validate Excel data to protect against XSS?

My application is dynamically constructing a source URL and then writing the resource file (Excel) directly to the response. The URL is read from a properties file, based on the application ...
Destruktor's user avatar
2 votes
0 answers
204 views

What percent of stored XSS attacks use external JavaScript?

What % of XSS attacks use external JavaScript. For example: <script src="http://badsite.com/maliciouscode.js"></script> Instead of: <script>alert(document.cookie);</script> ...
Discovery's user avatar
2 votes
0 answers
2k views

XSSER get and post

I am using xsser for XSS vulnerability testing and I have a doubt about the parameters when it's a POST method. I have tried against DVWA (which uses get) with success like this: xsser -u "http://...
aDoN's user avatar
  • 293
2 votes
0 answers
1k views

XSS Vectors for new Image()

What are possible XSS vectors to this JavaScript code new Image().src = encodeURI('[user url here]'); Let's assume two cases: [user url here] is some string provided by user (with no validation) [...
Paul Podlipensky's user avatar
1 vote
0 answers
53 views

Overcoming Cookie Theft Barrier in XSS Attack despite CSP Implementation

I have a website that includes CSP rules: .use( helmet.contentSecurityPolicy({ directives: { defaultSrc: ["'self'"], scriptSrc: [ "'self'", "cdnjs....
EPiez's user avatar
  • 13
1 vote
0 answers
191 views

Vue HTML escape

I have done a code scan and fail to understand whether there is a real problem. For both cases I get "Vue HTML escaping is disabled.". Case 1: <a :href="return.url"> doesn't ...
snakx123's user avatar
1 vote
0 answers
170 views

When we url encode (") will become (%22), is there any way we can decode (")?

While studying the XSS vulnerability, I encountered a significant doubt. I noticed that when we include " in a URL, it gets encoded as %22. Therefore, I believe we can utilize the decoded version ...
suwarnarajtest testaccount's user avatar
1 vote
0 answers
89 views

How to use html encoded characters to perform XSS?

I am trying to perform XSS but to get out of the context and write the payload I need to use Angle brackets and the angle brackets are html encoded. I tried double encoding technique with url encoding+...
Riaz Rabia's user avatar
1 vote
0 answers
118 views

Is the ability to inject arbitrary CSS styles in an img tag a security vulnerability?

I've discovered a behavior in a popular service's markdown parser that allows the 'style' attribute to be used within 'img' tags through some crafted markdown code. This allows for the application of ...
LunaXenon's user avatar
1 vote
1 answer
558 views

CSP script-scr blob

What are the risks to allow a "blob:" directive to the script-src CSP? Is it safe? I have a list of allowed domains defined in script-src, but nonetheless I got an error specifying the ...
Giuseppe Canto's user avatar
1 vote
0 answers
256 views

Reflected XSS but no Content-Type is specified

I have found parameter that simply reflects into response body, but no Content-Type is specified by server. It doesn't use any XSS-protection mechanisms like CSP or X-XSS-Protection. However, I was ...
ksenia pi's user avatar
1 vote
0 answers
545 views

force XSS after bypassing Request.Form using URL Encoding

I am testing a cross-site scripting attack on a website, as we all know the Request.Form function validates the input so the user couldn't insert a <script> inside the input. My focus in this ...
syk's user avatar
  • 11
1 vote
0 answers
100 views

Understanding browser text input value rendering for combatting XSS

If you use inspect in the developer tools for Chrome the values for the two input boxes below will look the same. <input name="test1" type="text" value="<script>alert(...
tony's user avatar
  • 111
1 vote
0 answers
120 views

Storing auth token in html

Current projects webs application utilises a cookie based approach to store users auth token. Implemented with secure and http-only attributes set. All traffic over https. The application loads third ...
Sam's user avatar
  • 11