Questions tagged [xss]
Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).
1,496
questions
115
votes
9
answers
34k
views
Why is it dangerous to open a suspicious email?
I would like to know why is it considered to be dangerous to open an email from an unknown source?
I am using Gmail and I thought it's only unsafe to download an attachment and run it.
The first ...
- 1,331
98
votes
8
answers
98k
views
What could an "<img src=" XSS do?
Most WAFs when blocking XSS will block obvious tags like script and iframe, but they don't block img.
Theoretically, you can img src='OFFSITE URL', but what's the worse that can happen? I know you ...
- 1,023
92
votes
4
answers
19k
views
How does XSS work? [closed]
I have very little experience in web development, but I'm interested in security. However, I haven't fully understood how XSS works. Can you explain it to med? The Wikipedia article give me a good ...
- 1,039
83
votes
6
answers
36k
views
How does CORS prevent XSS?
I recently learned about CORS and got the impression that its purpose is to prevent XSS. With CORS, the browser blocks requests to different domains, unless particular headers are in place.
But if a ...
- 1,310
71
votes
1
answer
6k
views
Tell browser my site has no scripts
I have created a Tor hidden service site which has absolutely no JavaScript or other types of client side scripts. The page is HTML, CSS, images, and some JSP for handling user input.
I encourage ...
- 1,272
70
votes
5
answers
5k
views
Strange Payment Gateway
I have a freelance client that wants me to integrate a payment gateway into their Woocommerce site but I am being increasingly concerned about their choice of provider and the project as a whole.
The ...
- 803
60
votes
9
answers
13k
views
How hard should I try to prevent a user from XSSing themselves?
Let's say a user can store some data in a web app. I'm now only talking about that sort of data the user can THEMSELVES view, not that is intended to be viewed by other users of the webapp. (Or if ...
- 5,667
56
votes
5
answers
21k
views
IMG tag vulnerability
Is it safe to display images from arbitrary domains? I.e. let's say I have an image on my page:
<img src="http://badguy.com/image.gif" />
What if image.gif will return some js attack vector, ...
- 2,837
54
votes
2
answers
26k
views
Is including the data scheme in your Content Security Policy safe?
I have a Cordova app that transforms some images to base64. This violates CSP with this message:
Refused to load the image
'data:image/svg+xml;charset=US-ASCII,%3C%3Fxml%20version%3D%221.0%22%20encod…...
- 645
54
votes
1
answer
25k
views
Is Django's built-in security enough?
I have learned that Django provides built-in protection against the three main types of web app attacks (SQL injection, XSS and CSRF), which is really awesome.
Yet I have spoken to a few Django ...
- 643
53
votes
6
answers
22k
views
Does injecting querystring values directly into HTML pose a security risk?
Someone reported a bug on my site that I don't really consider an issue. My site has an URL akin to this:
www.site.com/ajax/ads.asp?callback=[text injection]
So filetype is application/json, and I ...
- 1,432
50
votes
4
answers
14k
views
Why aren't sessions exclusive to an IP address?
Given the appropriate XSS vulnerability, an attacker can hijack somebody's session with the data that's passed to and from the server.
Why aren't sessions always exclusive to the IP they were started ...
user81147
50
votes
2
answers
20k
views
Will same-site cookies be sufficient protection against CSRF and XSS?
I must say, that I like this idea and it seems that it will bring a new form of protection against CSRF and XSS or at least it will reduce those attacks.
So, how effective will this protection be?
...
- 10.1k
50
votes
5
answers
10k
views
New XSS cheatsheet? [closed]
There is a great list of XSS vectors avaliable here: http://ha.ckers.org/xss.html, but It hasn't changed much lately (eg. latest FF version mentioned is 2.0).
Is there any other list as good as this, ...
- 1,115
48
votes
2
answers
12k
views
How do I use Markdown securely?
How do I use the Markdown library safely? What do I need to do to make sure that its output is safe to include into my web page?
I want to allow untrusted users to enter content (in Markdown format)....
- 98.9k
47
votes
3
answers
5k
views
I found obfuscated code in a comment on my blog. What should I do?
Today I was checking comments on my blog and I found a strange comment, here is the exact text
<script>var _0x352a=["\x31\x31\x34\x2E\x34\x35\x2E\x32\x31\x37\x2E\x33\x33\x2F\x76\x6C\x6B\x2E\x70\...
- 1,957
42
votes
11
answers
18k
views
How dangerous is XSS?
I am a software engineer and have been watching a lot of videos about XSS.
But I fail to understand how is it dangerous if it runs on the client side and does not execute on the server side which ...
- 553
41
votes
7
answers
5k
views
What are some important concepts to teach developers about cross-site scripting (XSS)?
I'm helping with a one-hour training for developers (~100 of them) on cross-site scripting. What are some concepts you think are indispensable to get across to them? Right now we have:
Difference ...
- 6,844
41
votes
1
answer
6k
views
Why do I need two parameters in an HTTP parameter pollution attack?
I'm reading about HTTP parameter pollution and I'm confused about one thing. If there is an endpoint like this,
https://security.stackexchange.com/editpost/?postuid=19348
and you tried a HPP attack, ...
- 519
39
votes
1
answer
44k
views
Difference between XSS and CSRF? [closed]
I know about cross-site scripting and cross-site request forgery. I want to know if there is any similarity between them?
- 581
37
votes
1
answer
5k
views
Why do XSS strings often start with ">?
One of the ways, XSS can be exploited, is to use following tag:
"><script>alert(document.cookie)</script>
Here, What is the meaning of "> before script (<script> tag) and why ...
- 443
35
votes
8
answers
8k
views
Is reflected XSS still relevant today?
I've been learning more about XSS (for the unfamiliar, Excess XSS is a great resource). I opted to get my hands dirty and give Reflected XSS a try on a local environment. I set up a very simple ...
- 1,310
33
votes
2
answers
16k
views
JavaScript written only with brackets?
I once saw JavaScript code which was only written as multiple brackets (). Does anybody remember this kind of code? There was also an online converter to convert "normal" JS into this style of code. I ...
- 769
33
votes
2
answers
15k
views
XSS prevention through Content Security Policy
How can Content Security Policy (CSP) significantly reduce the risk and impact of XSS attacks in modern browsers?
Is it possible to circumvent CSP in order to execute XSS?
- 4,824
32
votes
4
answers
80k
views
Which is the best way to sanitize user input in PHP?
These are things I do when users submit data:
substr if extra characters found.
htmlspecialchars() + ENT_QUOTES + UTF-8
str_replace '<' '>' in user input
What more things need to be done?
- 421
32
votes
7
answers
7k
views
How do hackers make the victim access an XSS attack URL?
As I understand it, the basic idea of XSS is to let the user's browser execute some malicious code created by the hackers.
Say, if a page has a vulnerability of loading arbitrary script when user ...
- 421
31
votes
10
answers
28k
views
Is XSS a server-side or client-side vulnerability?
My colleagues claim that XSS is a vulnerability on the server side. I always thought that this is a client side vulnerability. Which one of us is correct, and why?
- 311
30
votes
7
answers
8k
views
Filter user input before the database or upon display?
Given a web application where user data must be properly escaped to avoid XSS, is it better to try to remove the "bad stuff" before it enters the database, or is it best to allow it in the database ...
- 4,888
29
votes
6
answers
6k
views
Is splitting a REST API server from a Web server considered a security threat?
I am participating in a project that involves a JavaScript SPA that provides a service and is intended to interact via REST APIs with one of our servers. Initially, I proposed to work on the two ...
- 401
29
votes
2
answers
196k
views
XSS cookie stealing without redirecting to another page
I'm practicing in VM following the OWASP guide. I know that is possible to steal the cookie by redirecting to "False" page etc. but I would like to steal the cookie without redirecting on another page....
- 291
29
votes
5
answers
2k
views
Is filtering of user input data enough, or should it be parsed?
In a web application there could be two approaches to mitigate XSS attacks:
all the input data could be filtered (removing all 'bad' data), or
the input could be parsed, tokenized and output with ...
- 2,749
28
votes
1
answer
7k
views
Is Dom based XSS still a valid security concern in modern browsers?
I am trying to understand how DOM based XSS work, e.g. from this post, I managed to reproduce it in IE11, but e.g. Chrome and Firefox are immune at least against this exact example.
What happens is ...
- 2,257
27
votes
1
answer
5k
views
What is meant by "Vulnerable with: css class selector" for JQuery?
I'm mostly a beginner in cybersecurity. I came across this the other day about how JQuery 1.3.2 is vulnerable to CSS Selectors and Location Hash (source).
I understand how XSS works and I know what ...
- 403
26
votes
5
answers
52k
views
What is Reflected XSS?
Fed up with the following definition.
Reflected attacks are those where the injected script is reflected off the web server, such as in an error message, search result, or any other response that ...
- 363
26
votes
3
answers
78k
views
How to launch XSS code from an INPUT HTML tag upon page load?
Say I have the a website with the following code on it:
<input type="text" id="search-text" name="query" value="?" />
Double quotes aren't escaped so I can break out of the value attribute, ...
- 1,676
26
votes
1
answer
12k
views
When and why does bypassing XSS sanitizers with double encoding work?
I have read in different sites about different ways to bypass XSS sanitizers, like double encoding special characters such as /<>:"', or employing different encoding schemes.
However most of ...
- 524
24
votes
2
answers
53k
views
Cross site scripting when the greater than and less than signs are escaped?
If a website encodes < to < and > becomes >, is it still possible to perform cross site scripting? What would you enclose the script tags in?
For example, on one of my sites I can ...
- 353
24
votes
3
answers
5k
views
Why is it called cross-site scripting? (XSS)
Why is Cross-site scripting called Cross-site scripting? The term implies to me (a non-native English speaker) that there is some other web site involved that attacks your web site, but most of the ...
- 351
23
votes
2
answers
4k
views
Rails - protection against code injection and XSS
I've started using Ruby on Rails, and I was wondering if there were any security gotchas to watch out for with Rails, particularly regarding code injection and XSS?
I know Rails tries to prevent ...
- 1,194
22
votes
4
answers
24k
views
Is a secure cookie without the HttpOnly flag a problem?
I understand that cookies with the secure flag should be transmitted over a HTTPS connection. It also means that these cookies should be protected from adversaries (private cookie). Thus, it is ...
- 431
22
votes
4
answers
25k
views
Cross Site Scripting without special chars
I'm testing a web application and I found a XSS vulnerability. I can break a tag and inject some code to the application but nothing potentialy dangerous for the client.
The application has a filter ...
- 429
22
votes
1
answer
7k
views
Does the practice of blocking an off-site "Referer:" HTTP requests improve website security?
Is there any benefit for a security-paranoid website to disallow HTTP requests that have a Referer: from 3rd party sites?
The pitch is that if such a HTTP request were to come in, then certain XSS ...
- 50.5k
21
votes
6
answers
16k
views
Is Chrome completely secure against Reflected XSS?
I notice that Chrome does not execute scrips that are part of the web request,
http://vulnerable_site?pageTitle=<script>alert('xss')</script>
With such links since the script is as part ...
- 295
21
votes
4
answers
21k
views
What is the danger of Reflected Cross Site Scripting?
What is the danger of Reflected Cross Site Scripting?
I understand the Reflected XSS is dangerous, because it's possible. But what practical attacks can be performed using Reflected XSS?
- 54.2k
21
votes
3
answers
4k
views
What does a HTML filter need to do, to protect against SVG attacks?
I recently learned that SVG (Scalable Vector Graphics) images introduce a number of opportunities for subtle attacks on the web. (See paper below.) While SVG images may look like an image, the file ...
- 98.9k
20
votes
5
answers
20k
views
Does setting httponly prevent stealing a session using XSS?
If a session token is stored in a cookie that has httponly set, is there any way that a XSS vulnerability could allow a malicious user to steal a users session token?
- 8,165
18
votes
2
answers
18k
views
Is e-mail a direct vector for XSS
I'm curious if there is a way to execute XSS via email.
I am not talking about using e-mail as a way to deliver a link that has reflected XSS in it.
I'm talking about sending an email from example....
- 560
18
votes
4
answers
3k
views
Web Security Cheatsheet / ToDo list
Can anyone suggest a cheatsheet or ToDo list of web site and application security?
A local small business owner prompted a question about web security, basically her company website just got XSS ...
- 283
18
votes
2
answers
13k
views
What is mutation XSS (mXSS)?
I was unable to find any good documentation or anything on mXSS. Can anyone give some info or give a link?
I found a video and a PDF of the video's presentation:
http://www.youtube.com/watch?v=...
- 616
18
votes
2
answers
6k
views
XSS on an input element with style="display: none"
Suppose only user-supplied double quotes are allowed in an input tag which has the style attribute set to display: none.
Something like this:
<input type="text" style="display: none;" value="aa" ...
- 493