Questions tagged [xss]

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

Filter by
Sorted by
Tagged with
107
votes
9answers
29k views

Why is it dangerous to open a suspicious email?

I would like to know why is it considered to be dangerous to open an email from an unknown source? I am using Gmail and I thought it's only unsafe to download an attachment and run it. The first ...
89
votes
4answers
16k views

How does XSS work? [closed]

I have very little experience in web development, but I'm interested in security. However, I haven't fully understood how XSS works. Can you explain it to med? The Wikipedia article give me a good ...
81
votes
8answers
44k views

What could an “<img src=” XSS do?

Most WAFs when blocking XSS will block obvious tags like script and iframe, but they don't block img. Theoretically, you can img src='OFFSITE URL', but what's the worse that can happen? I know you ...
71
votes
5answers
5k views

Strange Payment Gateway

I have a freelance client that wants me to integrate a payment gateway into their Woocommerce site but I am being increasingly concerned about their choice of provider and the project as a whole. The ...
70
votes
1answer
6k views

Tell browser my site has no scripts

I have created a Tor hidden service site which has absolutely no JavaScript or other types of client side scripts. The page is HTML, CSS, images, and some JSP for handling user input. I encourage ...
59
votes
9answers
12k views

How hard should I try to prevent a user from XSSing themselves?

Let's say a user can store some data in a web app. I'm now only talking about that sort of data the user can THEMSELVES view, not that is intended to be viewed by other users of the webapp. (Or if ...
54
votes
5answers
15k views

IMG tag vulnerability

Is it safe to display images from arbitrary domains? I.e. let's say I have an image on my page: <img src="http://badguy.com/image.gif" /> What if image.gif will return some js attack vector, ...
52
votes
6answers
18k views

Does injecting querystring values directly into HTML pose a security risk?

Someone reported a bug on my site that I don't really consider an issue. My site has an URL akin to this: www.site.com/ajax/ads.asp?callback=[text injection] So filetype is application/json, and I ...
50
votes
1answer
23k views

Is Django's built-in security enough?

I have learned that Django provides built-in protection against the three main types of web app attacks (SQL injection, XSS and CSRF), which is really awesome. Yet I have spoken to a few Django ...
50
votes
5answers
10k views

New XSS cheatsheet? [closed]

There is a great list of XSS vectors avaliable here: http://ha.ckers.org/xss.html, but It hasn't changed much lately (eg. latest FF version mentioned is 2.0). Is there any other list as good as this, ...
48
votes
4answers
10k views

Why aren't sessions exclusive to an IP address?

Given the appropriate XSS vulnerability, an attacker can hijack somebody's session with the data that's passed to and from the server. Why aren't sessions always exclusive to the IP they were started ...
47
votes
4answers
17k views

How does CORS prevent XSS?

I recently learned about CORS and got the impression that its purpose is to prevent XSS. With CORS, the browser blocks requests to different domains, unless particular headers are in place. But if a ...
46
votes
3answers
5k views

I found obfuscated code in a comment on my blog. What should I do?

Today I was checking comments on my blog and I found a strange comment, here is the exact text <script>var _0x352a=["\x31\x31\x34\x2E\x34\x35\x2E\x32\x31\x37\x2E\x33\x33\x2F\x76\x6C\x6B\x2E\x70\...
42
votes
2answers
10k views

How do I use Markdown securely?

How do I use the Markdown library safely? What do I need to do to make sure that its output is safe to include into my web page? I want to allow untrusted users to enter content (in Markdown format)....
41
votes
7answers
5k views

What are some important concepts to teach developers about cross-site scripting (XSS)?

I'm helping with a one-hour training for developers (~100 of them) on cross-site scripting. What are some concepts you think are indispensable to get across to them? Right now we have: Difference ...
41
votes
1answer
5k views

Why do I need two parameters in an HTTP parameter pollution attack?

I'm reading about HTTP parameter pollution and I'm confused about one thing. If there is an endpoint like this, https://security.stackexchange.com/editpost/?postuid=19348 and you tried a HPP attack, ...
37
votes
1answer
5k views

Why do XSS strings often start with ">?

One of the ways, XSS can be exploited, is to use following tag: "><script>alert(document.cookie)</script> Here, What is the meaning of "> before script (<script> tag) and why ...
36
votes
9answers
12k views

How dangerous is XSS?

I am a software engineer and have been watching a lot of videos about XSS. But I fail to understand how is it dangerous if it runs on the client side and does not execute on the server side which ...
33
votes
8answers
7k views

Is reflected XSS still relevant today?

I've been learning more about XSS (for the unfamiliar, Excess XSS is a great resource). I opted to get my hands dirty and give Reflected XSS a try on a local environment. I set up a very simple ...
32
votes
7answers
6k views

How do hackers make the victim access an XSS attack URL?

As I understand it, the basic idea of XSS is to let the user's browser execute some malicious code created by the hackers. Say, if a page has a vulnerability of loading arbitrary script when user ...
32
votes
2answers
11k views

JavaScript written only with brackets?

I once saw JavaScript code which was only written as multiple brackets (). Does anybody remember this kind of code? There was also an online converter to convert "normal" JS into this style of code. I ...
30
votes
4answers
68k views

Which is the best way to sanitize user input in PHP?

What is the best way to sanitize user input? These are things I do when users submit data: substr if over limited values found. htmlspecialchars() + ent_quotes + UTF-8 str_replace '<' '>' users ...
28
votes
5answers
2k views

Is filtering of user input data enough, or should it be parsed?

In a web application there could be two approaches to mitigate XSS attacks: all the input data could be filtered (removing all 'bad' data), or the input could be parsed, tokenized and output with ...
26
votes
9answers
16k views

Is XSS a server-side or client-side vulnerability?

My colleagues claim that XSS is a vulnerability on the server side. I always thought that this is a client side vulnerability. Which one of us is correct, and why?
26
votes
1answer
4k views

What is meant by “Vulnerable with: css class selector” for JQuery?

I'm mostly a beginner in cybersecurity. I came across this the other day about how JQuery 1.3.2 is vulnerable to CSS Selectors and Location Hash (source). I understand how XSS works and I know what ...
24
votes
5answers
42k views

What is Reflected XSS?

Fed up with the following definition. Reflected attacks are those where the injected script is reflected off the web server, such as in an error message, search result, or any other response that ...
24
votes
1answer
32k views

Difference between XSS and CSRF? [closed]

I know about cross-site scripting and cross-site request forgery. I want to know if there is any similarity between them?
24
votes
6answers
6k views

Filter user input before the database or upon display?

Given a web application where user data must be properly escaped to avoid XSS, is it better to try to remove the "bad stuff" before it enters the database, or is it best to allow it in the database ...
24
votes
2answers
8k views

XSS prevention through Content Security Policy

How can Content Security Policy (CSP) significantly reduce the risk and impact of XSS attacks in modern browsers? Is it possible to circumvent CSP in order to execute XSS?
23
votes
1answer
5k views

When and why does bypassing XSS sanitizers with double encoding work?

I have read in different sites about different ways to bypass XSS sanitizers, like double encoding special characters such as /<>:"', or employing different encoding schemes. However most of ...
22
votes
3answers
15k views

Cross Site Scripting without special chars

I'm testing a web application and I found a XSS vulnerability. I can break a tag and inject some code to the application but nothing potentialy dangerous for the client. The application has a filter ...
22
votes
1answer
6k views

Does the practice of blocking an off-site “Referer:” HTTP requests improve website security?

Is there any benefit for a security-paranoid website to disallow HTTP requests that have a Referer: from 3rd party sites? The pitch is that if such a HTTP request were to come in, then certain XSS ...
21
votes
2answers
7k views

Is including the data scheme in your Content Security Policy safe?

I have a Cordova app that transforms some images to base64. This violates CSP with this message: Refused to load the image 'data:image/svg+xml;charset=US-ASCII,%3C%3Fxml%20version%3D%221.0%22%...
21
votes
2answers
4k views

Rails - protection against code injection and XSS

I've started using Ruby on Rails, and I was wondering if there were any security gotchas to watch out for with Rails, particularly regarding code injection and XSS? I know Rails tries to prevent ...
20
votes
2answers
108k views

XSS cookie stealing without redirecting to another page

I'm practicing in VM following the OWASP guide. I know that is possible to steal the cookie by redirecting to "False" page etc. but I would like to steal the cookie without redirecting on another page....
20
votes
6answers
13k views

Is Chrome completely secure against Reflected XSS?

I notice that Chrome does not execute scrips that are part of the web request, http://vulnerable_site?pageTitle=<script>alert('xss')</script> With such links since the script is as part ...
19
votes
2answers
39k views

How to launch XSS code from an INPUT HTML tag upon page load?

Say I have the a website with the following code on it: <input type="text" id="search-text" name="query" value="?" /> Double quotes aren't escaped so I can break out of the value attribute, ...
19
votes
2answers
6k views

Will same-site cookies be sufficent protection against CSRF and XSS?

I must say, that I like this idea and it seems that it will bring a new form of protection against CSRF and XSS or at least it will reduce those attacks. So, how effective will this protection be? ...
18
votes
4answers
17k views

Is a secure cookie without the HttpOnly flag a problem?

I understand that cookies with the secure flag should be transmitted over a HTTPS connection. It also means that these cookies should be protected from adversaries (private cookie). Thus, it is ...
18
votes
4answers
2k views

Web Security Cheatsheet / ToDo list

Can anyone suggest a cheatsheet or ToDo list of web site and application security? A local small business owner prompted a question about web security, basically her company website just got XSS ...
18
votes
4answers
17k views

What is the danger of Reflected Cross Site Scripting?

What is the danger of Reflected Cross Site Scripting? I understand the Reflected XSS is dangerous, because it's possible. But what practical attacks can be performed using Reflected XSS?
18
votes
2answers
26k views

Cross site scripting when the greater than and less than signs are escaped?

If a website encodes < to &lt; and > becomes &gt;, is it still possible to perform cross site scripting? What would you enclose the script tags in? For example, on one of my sites I can ...
17
votes
5answers
13k views

Does setting httponly prevent stealing a session using XSS?

If a session token is stored in a cookie that has httponly set, is there any way that a XSS vulnerability could allow a malicious user to steal a users session token?
17
votes
2answers
3k views

XSS on an input element with style=“display: none”

Suppose only user-supplied double quotes are allowed in an input tag which has the style attribute set to display: none. Something like this: <input type="text" style="display: none;" value="aa" ...
16
votes
2answers
3k views

Secure big, old ecommerce website from XSS?

I'm working for an ecommerce website written in C#.net (no CMS used, quite a lot of code) where security hasn't been a priority for a long time. My mission right now is to find and fix any XSS ...
16
votes
2answers
4k views

Why does this XSS vector work in svg but not in HTML?

Why does this vector : <svg><script>alert&#40/1/.source&#41</script> works in http://jsfiddle.net/ZgPY4/2/ and this one <script>alert&#40/1/.source&#41</...
16
votes
4answers
2k views

Why should XSS filters escape forward slash?

In OWASP recommendations regarding escaping untrusted input for HTML element content, they list the following: & --> &amp; < --> &lt; > --> &gt; " --> &quot; ' --...
15
votes
3answers
6k views

How serious are XSS attacks

A website I visit allows this kind of attack, to be implemented with GET in the URL <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT> Along with many others on this page: http://ha.ckers....
15
votes
3answers
4k views

Does incognito/private browsing prevent XSS attacks?

When starting an incognito/private browsing session, no cookies from other browsing profiles should exist. For example, if I am logged in to a site on my main browsing profile, then start a new ...
15
votes
6answers
4k views

Solution to allow JavaScript input but prevent XSS

We have a simple Blog system that allows users to input html and JavaScript to build a blog page. I'm aware that allowing javascript open up the door to xss attacks. We do however need to allow users ...