Questions tagged [xss]

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

Filter by
Sorted by
Tagged with
0
votes
2answers
361 views

Using single or double quotes to prevent XSS and SQLi?

Why it is recommended to put single or double quotes around HTML attribute values? It is recommended to prevent XSS, but why? Same goes for SQL injection: It is recommended to use single or double ...
0
votes
1answer
83 views

Triggering a XSS when the payload appears twice?

I have found a XXS vulnerability, but I am not able to exploit it. My input, 66038');}confirm(1);/*, appears two times. The idea was to close the function foo1() and trigger confirm(1). But foo2 is ...
0
votes
1answer
319 views

XSS code not fetching back script

I am doing a XSS challenge on HTB and have run into an issue. I have the unvalidated field that is vulnerable to XSS and so far I have got the below line to successfully call back to a python server ...
3
votes
0answers
735 views

Solutions from StackOverflow to prevent XSS in JSP pages don't work

I have a JSP page where the HTML title is pulled from a GET parameter title: <title>${title}</title> Obviously, this allows for XSS attacks. If I follow the answer given on this page and ...
0
votes
1answer
886 views

What is the XSS auditor in Chrome/Firefox and how do I find bypasses?

I've been doing a lot of bug bounties lately and although I've been gaining reputation and experience, I never seem to find XSS even in private programs. Items are always being reflected as HTML. It ...
1
vote
0answers
267 views

Android WebView JavaScript Enabled

I recently found an Android application, which uses a WebView with enabled JavaScript. In this webview I am able to browse from their provided FAQ page to twitter, and from twitter basically ...
2
votes
2answers
1k views

What are the common features to identify XSS attack from Apache log file?

I have tried some XSS vulnerability on web application such as webgoat, OWASP mutillidae, bWAPP. I want to know the features/keywords/footprints of cross site scripting attack in apache log file and ...
1
vote
1answer
135 views

HTML payloads work on burp but not on browser

I was looking into bWAPP. In the HTML GET Injection section, I entered %25%33%63%25%36%38%25%33%31%25%33%65%25%36%31%25%37%30%25%37%30%25%36%63%25%36%35%25%33%63%25%32%66%25%36%38%25%33%31%25%33%65 ...
2
votes
2answers
152 views

Can hacker delete my server files and database where I am using below function?

I want to know how to protect my website from hackers. I am a php-mysql developer. For fetching data from databases I always use MySQLi. For preventing my website from SQL injection, I always use PHP'...
1
vote
1answer
343 views

Is this code vulnerable to DOM based XSS jquery animate? [duplicate]

Is this code vulnerable to DOM based XSS? The application is using jQuery 1.12.4 and i noticed that Data is read from window.location.hash and passed to $() via the following statements: var target_ ...
0
votes
1answer
111 views

Prevent javascript cross-origin write

Let's assume an attacker manages to inject this script in a login page: const form = document.getElementsByTagName('form')[0]; form.addEventListener('submit', stealCredentials); function ...
0
votes
1answer
242 views

Is this code vulnerable to dom based XSS? [duplicate]

Is this code vulnerable to DOM based XSS? The application is using jQuery 3.3.1 and i noticed that Data is read from window.location.hash and passed to $() via the following statements: var hash = ...
9
votes
2answers
3k views

Why shouldn't I put user input in HTML comments?

The OWASP XSS Prevention Cheat Sheet has a list of locations where untrusted data should never be put: <script>...NEVER PUT UNTRUSTED DATA HERE...</script> directly in a script <!-...
2
votes
2answers
202 views

CSRF methods: img vs iframe vs form/javascript

I have a questions concerning methods for executing CSRF. I did the CSRF Prompt By-pass lesson in WebGoat (Lessons -> Cross-site Scripting -> CSRF Prompt By-pass). The lesson requires you to craft an ...
1
vote
3answers
977 views

Injecting <script>alert(“1”)</script> to OWASP Juice shop doesn't work

I've just learned the theory behind XSS attacks and now I would like to test my knowledge in a legal way. I wanted to "hack" OWASP Juice shop by following steps from this book section "Perform a ...
0
votes
1answer
755 views

How to get admin cookie with Persistent XSS?

Two parts to this question. Let's say there is a site which accepts my input and sends it in XML format to server. When I enter the input as shown here: https://ghostbin.com/paste/hc5n6 The reason I ...
0
votes
3answers
458 views

Why doesn't XSS execute when bypassing HTML encoding?

I am trying to execute an XSS payload on a search field that takes my input like this: <input name="q" id="gsasearch" type="text" value="My Input"></input> Observations: <, > and "...
1
vote
1answer
185 views

What are a JSON rest api's responsibilities to prevent XSS? [duplicate]

I'm building a rest API that serves exclusively JSON. It might one day be consumed by a browser based app. Is there anything I should do on my end to prevent XSS attacks?
1
vote
0answers
386 views

Should sensitive tokens be stored in localStorage or an HTTPOnly cookie?

In the context of a web application... should sensitive tokens, such as those used for sessions, authentication and/or authorization, be stored in localStorage or an HTTPOnly cookie; or are they both ...
0
votes
1answer
129 views

Can registration forms be used for an XSS attack?

In most websites that have account logins, there are at least two fields: Email Password Could either of these fields be used to mount an XSS attack (assuming no character encoding)? For example, ...
0
votes
4answers
637 views

XSS payload shorter than 20 character

For an university project I have to perform an analysis on a web application to find out XSS vulnerabilities. After this I have to report and create automatic test to prove vulnerabilities that I have ...
2
votes
1answer
144 views

Can Arbitrary Code Execution be done using CSS Injection?

As part of our class project, we are studying the attacks that could be done using CSS Injection. In our threat model, attacker can manipulate any CSS file on the server. If attacker replaces original ...
0
votes
1answer
115 views

Is the following javascript code vulnerable to DOM XSS? [duplicate]

I have the following javaScript code in an application, which BURP flags as being possibly vulnerable. However, i have had no luck trying to get it to execute. var hash = window.location.hash; if(...
0
votes
2answers
132 views

'=' and '(' are bypassed XSS [closed]

How can I add = in my script when return input.replace (/ [= (] /g, ''); is replacing it? This is only for education purpose solving CTF. Used HTML codes but not working.
11
votes
3answers
5k views

How can I execute a XSS when a web application transforms a data from lowercase to uppercase?

I'm testing a web application, when I send an input data to web application, this places the data in an onclick function, something like this: <a href="#" onclick="someFunction('dataFromServer', '...
4
votes
1answer
280 views

XSS - will javascript execute in anchor tag where “/” by default added by server in href

I came across a scenario, where userinput is reflecting in anchor tag href value. So if i put test there it reflects as <a href="/test"> Due to this default slash added in the code, javascript:...
7
votes
4answers
1k views

Exploiting XSS in jQuery without equal character?

This is some vulnerable JavaScript code: $(document).ready(function(){ var payload = unescape(document.location.hash.substr(1)); $(payload); document.body.innerText = "The payload is: " + ...
1
vote
1answer
263 views

Not convinced on the security of a JWT Token + CSRF Token

Lets suppose I have a web application that uses JWT tokens and CSRF Tokens in its authentication scheme. As I understand it, it works like this: When a user logs in, the client sends a login request. ...
1
vote
2answers
174 views

What to do about vulnerability in a SaaS product I buy?

I work for a university, where I am part of the team responsible for integrating a SaaS Learning Management System (eg: Moodle, Canvas) with the rest of the university's systems. Two months ago, I ...
2
votes
2answers
757 views

Reflected XSS only works through Burp Repeater because of URL encoding

I am able to get reflected XSS through burp repeater using a GET request. I then click on show response in browser and I am able to get an XSS alert. But when I manually go to the URL in my browser ...
0
votes
3answers
596 views

How can I exploit a XSS vulnerability which doesn't allow me to type < and > symbols and puts my input in double quotes?

I have the following script: function filter() { const inputstring = JSON.stringify(document.getElementById('input').value) .replace(/[<]/g, '%lt') .replace(/[>]/g, '%gt'); ...
1
vote
1answer
124 views

XSS in custom, user-supplied CSS

Users of our web app would like to use custom CSS to customize parts of UI. I've came up with some kind of blacklist for CSS "bad words" and I'm curious whether it is sufficient or if I need to ...
0
votes
3answers
207 views

XSS: Code payload gets displayed on the screen as a string

I am new to security and trying to improve. Sometimes when I try to find XSS vulnerabilities on a website my payload just get displayed on the screen but nothing happens. The whole payload just gets ...
2
votes
2answers
244 views

Content Security Policy Header not stopping attack

I created a simple test web application to test the use of the content security policy header. I included a vulnerability in my test app, such that submitting a basic XSS payload with script tags ...
4
votes
1answer
9k views

ASP.NET Web API and potential XSS

I'm wondering if my ASP.NET Web API had an XSS vulnerability as my controller didn't have a method to handle the default GET call. Without the GET method being handled in the code a call to /api/...
29
votes
4answers
67k views

Which is the best way to sanitize user input in PHP?

What is the best way to sanitize user input? These are things I do when users submit data: substr if over limited values found. htmlspecialchars() + ent_quotes + UTF-8 str_replace '<' '>' users ...
8
votes
2answers
15k views

DOM Based XSS attacks: what is the most dangerous example?

I knew that XSS attacks (“non-persistent” and “persistent”) can hijack user session, deface websites, conduct phishing attack, etc. However, I can't understand what is dangerous of DOM Based XSS if ...
0
votes
1answer
130 views

Inject JavaScript code into websites requested by an Android app? [closed]

How can I add custom scripts to pages I'm opening on Android via Chrome, Firefox or any other internet browsing app?
3
votes
3answers
7k views

Cross site scripting prevention removing &lt and &gt

I'm testing an application that only skips < and > symbols. The user input being validated is always inserted between html tags like <b>, <span>, <div>, etc. and never passed ...
0
votes
2answers
229 views

XSS alert not working with concatenated string

I've noticed that the following Stored XSS does not execute, whereas in the JS console it works: <img src=0 onerror=alert(document.domain+": "+Date.now())> This doesn't prompt an alert box. ...
0
votes
1answer
183 views

Reflected XSS in multiline script block

I am trying to exploit a reflected cross site scripting in a GET request where the reflection is in the first multi line script block. It seems I can use every character but <, > and " and the ...
0
votes
1answer
594 views

How does OWASP ZAP find Reflected XSS?

What I'm doing: I'm using OWASP Zap to find vulnerabilities in a site (I have the owner's consent) and Zap came up with a Reflected XSS Vulnerability after I did an active scan on a POST request. It ...
1
vote
1answer
450 views

Bypassing XSS filter replacing characters?

Is it possible to bypass an XSS filter that replaces the malicious characters? I've prepared this filter: searchTextField.replace(/</g, " ") .replace(/>/g, " ") .replace(/"/g, " ") ...
1
vote
1answer
1k views

XSS and XXE payload in XML attributes value

I am testing web application with functionality of file upload. The only possible file format is XML. The content of the file saved in XML attributes is then presented on the separate page. For ...
0
votes
2answers
91 views

Can an xss vulnerability without authentication be exploited?

I am confused about the attack surface made possible by an XSS vulnerability. Suppose I have a simple web application that does not involve authentication (perhaps a "word of the day" kind of thing). ...
1
vote
0answers
208 views

Understanding XSS

So, I am trying to understand how XSS works and I gathered some information online and crafted the code. Following is the snippet. When I enter some value in the text field and submit, the script ...
1
vote
2answers
174 views

Do browsers XSS filters protect against DOM based XSS?

Many (but not all) browsers come with built in XSS protection that can be activated with a HTTP header: X-XSS-Protection: 1; mode=block As I understand it, it prevents reflected XSS attacks by ...
33
votes
8answers
7k views

Is reflected XSS still relevant today?

I've been learning more about XSS (for the unfamiliar, Excess XSS is a great resource). I opted to get my hands dirty and give Reflected XSS a try on a local environment. I set up a very simple ...
4
votes
2answers
4k views

Use XSS vulnerability in iframe to compromise parent?

I have a site, let's call it parent.com, that embeds a third party plugin from child.com in an iframe. I have found a XSS vulnerability on child.com. The embedded page from child.com contains a form ...
1
vote
2answers
214 views

Is this a sign of a successful XSS attack?

I'm just testing a basic XSS injection attack. Given the images below, does it look like this website is vulnerable to XSS? Is whitelisting the characters still the best practice against XSS attacks?...