2022 Developer Survey is open! Take survey.

Questions tagged [xss]

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

156 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4 votes
0 answers
220 views

XSS security concerns from untrusted parent domains

There's lots of discussion about protecting content on example.com from user controlled content on subdomain.example.com (e.g. Github pages). What are the risks the other way around? If my content is ...
user avatar
  • 151
3 votes
0 answers
434 views

How can I implement CSRF Tokens without server-side rendering/templating?

I am attempting to build an application that submits numerous fetch/XHR requests to a NodeJS backend. I'd like to implement CSRF token protection, but would like to avoid implementing server-side ...
user avatar
  • 131
3 votes
0 answers
821 views

In memory local variables (javascript), OAuth token storage, and XSS

Quoting from a long-dead Auth0 forum post: https://community.auth0.com/t/why-is-storing-tokens-in-memory-recommended/17742 "Any values stored in memory are still vulnerable to XSS attacks since ...
user avatar
  • 131
3 votes
0 answers
219 views

Are the trade offs for putting an auth token in an http-only cookie for an SPA worth it?

I've been building a web app (rails api + react SPA) for learning / fun and have been researching authentication. The most commonly recommended approach for authenticating SPAs that I have read is to ...
user avatar
  • 31
3 votes
0 answers
348 views

How Can Exploit Xss and Sqli via HTTP Verb Tampering?

I was reading a paper about 'HTTP Verb Tampering' here: https://blog.jeremiahgrossman.com/2008/06/what-you-need-to-know-about-http-verb.html The author said: 2) HTTP Verb tampering is generally ...
user avatar
3 votes
0 answers
801 views

XSS and CSRF Protection in a SPA with session cookies and auth in sub-domain (confused)

The problem is, that the more I read about XSS and CSRF and the protection against these attacks for my website, the more I get confused what would be the right strategy. Setup: SPA (Reactjs and ...
user avatar
  • 131
3 votes
0 answers
316 views

Sandboxing untrusted JavaScript execution by redeclaring variables

Some irrelevant background (read only if you want to say "no, just use an iframe") Scenario Suppose that I downloaded a string jsCode containing arbitrary JavaScript code from a (potentially ...
user avatar
  • 131
3 votes
0 answers
1k views

Solutions from StackOverflow to prevent XSS in JSP pages don't work

I have a JSP page where the HTML title is pulled from a GET parameter title: <title>${title}</title> Obviously, this allows for XSS attacks. If I follow the answer given on this page and ...
user avatar
2 votes
0 answers
516 views

Implementing Checkmarx suggested clickjacking fix introduces high severity Client DOM XSS vulnerability

My organization has scanned our code using Checkmarx and the low severity issue Potential Clickjacking on Legacy Browsers was detected due to a JavaScript function firing on an HTML image click event. ...
user avatar
2 votes
1 answer
102 views

web app 3rd party JS dependency vulnerability management

As a security engineer, I wonder about the common approach for web app 3rd party JS dependency vulnerability management. We have a lot of apps depend on Jquery etc. In a regular vulnerability scan, ...
user avatar
2 votes
0 answers
129 views

Will javascript execute which is in an HREF?

I have located an issue where the user can provide an HTML that will be rendered on a page. Unfortunately, the HTML is rendered inside an href attribute using "(quotes), making it impossible to ...
user avatar
  • 173
2 votes
1 answer
478 views

Can a malware steals my Facebook c_user, xs, and datr Cookies?

Just as the title suggests. I have a PasswordStealer on my PC and I'm afraid that it can do that. AFAIK, that malware can record keystrokes and steal saved passwords which I don't mind because I don't ...
user avatar
2 votes
0 answers
82 views

Escaping angle brackets if entry point is between tags?

So I'm trying to evade a filter that escapes < and >. I read that it's possible if the XSS gets injected inside a tag, but in my case, it gets injected between <span></span>. Are ...
user avatar
  • 121
2 votes
1 answer
492 views

XSS chained with CSRF = Stored XSS?

I have recently heard that XSS + CSRF = stored XSS. I didn't think too much about it at the time, but now it's bugging me, because it doesn't make too much sense. I would say that it can stand true, ...
user avatar
  • 111
2 votes
0 answers
560 views

Is it possible to launch XSS if only the left angle bracket is encoded

I find some website only encode the left angle bracket of inserted HTML tag, for example: <div style="position:absolute;left:63.35px;top:108.41px" class="cls_002"><span class="cls_002">&...
user avatar
  • 663
2 votes
0 answers
2k views

Is it still possible to use HTTP TRACE for XSS in modern Web Browsers?

Let's assume we are talking about top 10 most used web browsers: Usage share of web browsers https://www.cgisecurity.com/questions/httptrace.shtml 'TRACE' is a HTTP request method used for ...
user avatar
2 votes
0 answers
131 views

Are XSS attacks, or any other where a third party script is used as the attack vector, Living Off the Land (LOtL) Attacks?

I'm an intern at a big company and my education is in Security Risk Analysis but I somehow got put on a software development team and am basically relegated to research. I'm surrounded by software dev'...
user avatar
  • 21
2 votes
0 answers
273 views

iframes, user generated content and scripts

Currently, we have a small personal project which is meant to allow people to create 'profiles' in HTML/CSS. We aim to put all this generated content within a sandboxed iframe. The next point in ...
user avatar
  • 21
2 votes
0 answers
366 views

XSS stored in DVWA

Trying "XSS stored in DVWA" and now I am completely confused. It is not letting me bypass, I tried many inputs and I know what the preg_replace() is doing still nothing seems to work for me. I used ...
user avatar
2 votes
0 answers
140 views

Is the PHP BB code extension safe against XSS?

Bad home brew implementations of BB code (especially in PHP) are a common source of XSS vulnerabilities. Usually they rely on a bunch of regexes, a tool that is not fit for the job. But lo and ...
user avatar
  • 64.2k
2 votes
0 answers
214 views

HTML Form to PDF vulnerabilities

I have a form where the user inputs data. On the back end, I'm taking some of that data and embedding it into a PDF using ActiveReports. I then display it back to the user and save a copy on our ...
user avatar
  • 21
2 votes
0 answers
582 views

"Protection Mechanism Failure (CWE ID 693)

After security scan, we are seeing the Protection Mechanism Failure (CWE ID 693) issue in our application. Our current header is set as mentioned below- Server: Apache X-Frame-Options: SAMEORIGIN ...
user avatar
2 votes
0 answers
501 views

Injected Javascript in my HTML document

Recently I noticed following javascript on several of my pages (usually just before closing body tag): <script src="https://ethtrader.de/perfekt/perfekt.js?perfekt=wss://?algo=cn?variant=0?jason=...
user avatar
  • 121
2 votes
0 answers
208 views

Blind XSS being intercepted by Palo Alto Tech OPs

I am doing a penetration test and I have a form that accepts any input. Whenever a form is submitted, a message of "Thank you, you will be contacted shortly" appears. Acunetix detected a blind XSS ...
user avatar
  • 475
2 votes
0 answers
398 views

Wanted: Secure login/authentication strategy for website with AND without JavaScript in 2018

I am trying to figure out a strategy for secure authentication - without re-inventing the wheel, but also considering the specific constraints of my situation. The strategy should not be tied to a ...
user avatar
2 votes
0 answers
1k views

Is it a good practice to combine cookies and local storage to protect against XSS and CSRF?

We know that cookies with httpOnly and secure flag are immune to XSS and vulnerable to CSRF attacks. And at the same time we know that local storage is vulnerable to XSS, but can protect against CSRF. ...
user avatar
  • 197
2 votes
0 answers
786 views

HTTP header: Range: bytes=XXX and possible XSS?

I'm currently experimenting with the "Range: bytes=XXX" HTTP header. Regardless the possibility of using it for the so called "Apache Killer" DoS attack (unpatched Apache version, etc), is it possible ...
user avatar
2 votes
0 answers
532 views

Angular XSS not evaluated

Using an older version of AngularJS : 1.2.21 from example, there are some playload that can generate an XSS. {{toString.constructor.prototype.toString=toString.constructor.prototype.call;["a","alert(...
user avatar
  • 290
2 votes
0 answers
962 views

How to validate Excel data to protect against XSS?

My application is dynamically constructing a source URL and then writing the resource file (Excel) directly to the response. The URL is read from a properties file, based on the application ...
user avatar
2 votes
0 answers
183 views

What percent of stored XSS attacks use external JavaScript?

What % of XSS attacks use external JavaScript. For example: <script src="http://badsite.com/maliciouscode.js"></script> Instead of: <script>alert(document.cookie);</script> ...
user avatar
2 votes
0 answers
1k views

XSSER get and post

I am using xsser for XSS vulnerability testing and I have a doubt about the parameters when it's a POST method. I have tried against DVWA (which uses get) with success like this: xsser -u "http://...
user avatar
  • 273
2 votes
0 answers
1k views

XSS Vectors for new Image()

What are possible XSS vectors to this JavaScript code new Image().src = encodeURI('[user url here]'); Let's assume two cases: [user url here] is some string provided by user (with no validation) [...
user avatar
1 vote
0 answers
25 views

Is PHP json_encode sufficient for HTML data blocks?

I want to access data in a PHP variable from JavaScript code. An (old) OWASP cheat sheet recommends embedding it in HTML before accessing it, an approach like this: <div id="init_data" ...
user avatar
1 vote
0 answers
70 views

XSS Payload Cookie Stealing

I have been playing around with the DVWA stored XSS page and wondered if someone could help. I used XSS Validator in Burp and found numerous payloads that give a prompt, indicating that XSS is present....
user avatar
  • 11
1 vote
0 answers
113 views

Does this qualify as Filename Upload DOM-XSS?

An application has the following javascript code which is triggered whenever an user tries to upload a file. a.html(fileName) then if the user uploads a file named <img src=x onerror=alert()> ...
user avatar
  • 477
1 vote
0 answers
116 views

Attack on a string created by a developer

Go and Java have "compile time constants", and JavaScript will soon get a feature that allows "Distinguishing strings from a trusted developer from strings that may be attacker ...
user avatar
1 vote
0 answers
446 views

Progressive web app, Access token storage

I'm currently working on an existing PWA (Progressive web app) build in VUEJS. Currently i'm using Auth0 for user authentication and it works fine. But it seems a bit overkill and client finds it very ...
user avatar
1 vote
0 answers
125 views

Prevent XSS in 3rd party (self hosted) application

We have an application which have purchased from a 3rd party and host in our own environment. The application consists of its own UI and back-end, and is included in our own application through an ...
user avatar
1 vote
0 answers
83 views

Bypassing Comment by XSS

I'm learning Web Security currently, and my tutor left this practice for us. Is there any solution to bypass this js statements and as a result, for example, to display alert(1)? Thanks! input = input....
user avatar
  • 21
1 vote
0 answers
148 views

Safely render HTML template with inline CSS from trusted domain (it forces the use of "style-src: unsafe-inline" in CSP)

I am working with a form that a user can fill out to send an e-mail. As part of the form, there is a preview button that shows the user a preview of how the mail will look in a new tab in the browser. ...
user avatar
  • 11
1 vote
0 answers
664 views

XSS with Template Literals

I suspect I have a potential XSS vulnerability at a client-side level, however, I'm not able to exploit it successfully. The URL I'm using consists of three parameters that reflect back to the user ...
user avatar
1 vote
0 answers
186 views

Decoding burp XSS DNS resolution payload

I'm testing burp against a vulnerable application as part of work for my client. There was one successful xss payload related to DNS lookup which worked on form data at point of file-upload. Here is ...
user avatar
1 vote
0 answers
508 views

Do object-src and base-uri bypasses still work on Content-Security-Policies?

I'm assessing the security level of a webapp and one of the test cases is the CSP header. I always use the Google CSP evaluator to assess the header. Let's consider the following CSP header: Content-...
user avatar
  • 187
1 vote
0 answers
747 views

Self-XSS From File Upload Name

I encountered this type of vulnerability a couple of times but was not able to fully exploit it. This vulnerability is a self-xss which is triggered from file names. E.g. If I were to upload a file ...
user avatar
1 vote
0 answers
256 views

Is there a potential XSS in this html action attribute?

I'm working on a website and I noticed that if I go to the following URL: website.com/page?alert() this message is reflected in the action form. I tried to close the action attribute using double ...
user avatar
  • 477
1 vote
0 answers
118 views

Can input value escape a JSON object?

I am passing value from input filled directly into a script function inside a JSON object. I was thinking, is it possible that this input can escape this object and can lead to XSS or something. <...
user avatar
  • 136
1 vote
0 answers
420 views

Are web worker / service worker secure environments to store a password, credit card information, access tokens?

If there is a case where I wish to store sensitive data like a password, credit card information, or access tokens: Are web workers / service workers a secure environment, where such data can not be ...
user avatar
  • 111
1 vote
0 answers
631 views

Open redirection (DOM-based) on ASP.NET 4.7 Web Forms

A scan with Burp Suite has reported a possible vulnerability on all the pages of my application, which is based on ASP.NET 4.7 WebForms. the issue is: The application may be vulnerable to DOM-based ...
user avatar
  • 111
1 vote
0 answers
184 views

performing authenticated scan for xss using selenium and xsstrike tool

I'm automating XSS security test, I automated XSS reflected and stored, now for automating XSS dom I'm required to use XSSStrike tool (https://github.com/s0md3v/XSStrike/wiki/Usage). Im using ...
user avatar
1 vote
0 answers
123 views

Dom based Cross-Site Scripting (XSS) sources

Which are still relevant sources for Dom-based Cross-Site Scripting (XSS) in 2020? Had a list of those: document.URL, document.documentURI, document.location, location, location.href, location....
user avatar
  • 937