Skip to main content

Questions tagged [xss]

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

Filter by
Sorted by
Tagged with
2 votes
2 answers
7k views

How to bypass sanitization of < while exploiting an XSS vulnerability?

Whatever is to the right of < is being deleted if I don't have a following >, else everything in between < and > is being deleted. Is there a way to bypass this sanitization?
1 vote
2 answers
2k views

Bypass WAF to perform XSS?

I am trying to find an XSS in website protected by Cloudflare. I use Burp to find which HTML tags allowed. Only the <script/> is tag disallowed. I tested multiple payloads to pass the WAF and ...
0 votes
2 answers
763 views

Persistent XSS in Blogger domain

I have discovered persistent XSS in blogger domain. I have reported vulnerability to Google Security Team and I received this is the response: Users are permitted to place arbitrary JavaScript, ...
3 votes
1 answer
214 views

Escaping angle brackets if entry point is between tags?

So I'm trying to evade a filter that escapes < and >. I read that it's possible if the XSS gets injected inside a tag, but in my case, it gets injected between <span></span>. Are ...
4 votes
0 answers
1k views

In memory local variables (javascript), OAuth token storage, and XSS

Quoting from a long-dead Auth0 forum post: https://community.auth0.com/t/why-is-storing-tokens-in-memory-recommended/17742 "Any values stored in memory are still vulnerable to XSS attacks since ...
1 vote
1 answer
319 views

Is this code code vulnerable to XSS?

I have a function that accepts the param url and passes it to exec() function getQueryValue(url, name) { name = name.replace(/[\[]/, "\\[").replace(/[\]]/, "\\]"); var ...
0 votes
2 answers
340 views

XSS when I can't see URL parameters

I'm new to penetration testing and I found a Reflected XSS vulnerability on the website I'm working on. But the thing is when I submit the form, the website automatically redirects me to www.website....
1 vote
1 answer
532 views

Single and double Encoding of parameters to bypass security filters

I was practising some labs to get better at XSS and SSRF. I found that sometimes I just encode characters once and the security filter is bypassed and occasionally I have to encode it two times. How ...
0 votes
1 answer
454 views

Is it still XSS if it requires user input?

I have a web app which displays what I enter in an <input> field back as HTML, but it happens all client-side in the DOM after manual input, so it can't be made into a URL which causes a payload ...
0 votes
1 answer
718 views

Triggering an XSS through a shortened URL?

I have this piece of HTML: <img src="image src" alt="{injectable}" title="{injectable}" border="0"> where {injectable} values correspond to the same input value that has to be 32 characters ...
1 vote
1 answer
465 views

Reflected DOM XSS Portswigger Lab

I'm a total beginner and im trying to solve Portswigger Academy labs. I'm studying on XSS right now and im stuck in somewhere. Lab Details:This lab demonstrates a reflected DOM vulnerability. ...
0 votes
0 answers
231 views

Securing my API: concept of access tokens

First of all I want to excuse for the bad spelling and grammar. English is not my mother tongue. I have built a JSON communication between a front-end (website) and my Node.js web server. I want to ...
1 vote
1 answer
1k views

Potentially dangerous request loads the page

I hosted an application in ASP.NET 4.0 webforms. When I am browsing hostname/DressDetail.aspx?<script>alert(313)</script>&category=1&code=76 it is showing an error message like: ...
0 votes
1 answer
413 views

XSS payload to Send request to server without closing tag

I was testing a website which does not have XSS in their scope. So I thought it would be a good idea to escalate XSS to a bug which is valid. I need to make a request to my server but the problem is ...
1 vote
1 answer
766 views

Would XSS that can cause privilege escalation be considered XSS or privilege escalation?

I am creating a bug bounty report for a stored cross-site-scripting exploit that can potentially also cause privilege escalation. The bug bounty program categorizes Stored XSS as low criticality and ...
0 votes
1 answer
825 views

Possible Cross-site scripting vulnerability, site accepts <> but returns empty response when a complete script is sent

I have a parameter, let's call it p which normally accepts true or false as a string. I can send the following command and it will be printed, the only thing hindering the script from executing is ...
3 votes
1 answer
1k views

Is PHP json_encode sufficient for HTML data blocks?

I want to access data in a PHP variable from JavaScript code. An (old) OWASP cheat sheet recommends embedding it in HTML before accessing it, an approach like this: <div id="init_data" ...
0 votes
1 answer
176 views

How do double quotes and angle bracket work in this scenario?

Question about a solution in portswigger academy (since portswigger explains nothing and I can't find any info elsewhere on this): Break out of the img attribute by searching for: Here is the img ...
1 vote
1 answer
3k views

How can I steal all cookies from reflected XSS?

I just found a website with a XSS vulnerability. When I visit the following URL, a pop up occurs: https://example.com/article/HALLOWEEN"><script>alert(1);</script> I have a ...
1 vote
0 answers
2k views

Checkmarx Client DOM XSS Violation in ReachJS

I have this message from Checkmarx: The application's = embeds untrusted data in the generated output with location, at line 19 of ****.js. This untrusted data is embedded straight into the output ...
2 votes
2 answers
3k views

Reflected XSS found in web application via POST request with JSON body. Is this issue exploitable?

I was testing an application recently and i came across with a Reflected XSS vulnerability via HTTP POST Request with JSON body. Although this condition can't be exploitable from his own, due respond'...
1 vote
1 answer
504 views

What characters need to be escaped or replaced to prevent xss jsonp callback attacks?

I have a service which allows the user to specify a callback function name that wraps the data being returned to support jsonp callbacks. I want to make sure that I am covering all of my bases in ...
2 votes
1 answer
173 views

Are XSS attacks, or any other where a third party script is used as the attack vector, Living Off the Land (LOtL) Attacks?

I'm an intern at a big company and my education is in Security Risk Analysis but I somehow got put on a software development team and am basically relegated to research. I'm surrounded by software dev'...
1 vote
1 answer
151 views

Risk of injecting a malicious script/code?

I was was inspecting elements in a website and I randomly stumbled onto this piece of code . </style><meta name="add-styles-here"/><meta name="add-scripts-here"/>&...
-1 votes
1 answer
1k views

Is there any way to bypass javascript comment filtering (XSS)

So I am testing an application and I almost got an XSS vulnerability but only if I can comment on the rest of the code. e.g. Originally this is how the target returns the user-entered input: I've ...
1 vote
0 answers
276 views

Need for URL encoding in XSS / CORS lab

I am doing one of Portswigger's labs on web security, specifically CORS (cross origin resource sharing). I am having trouble understanding why there is a need for URL encoding certain parts of the XSS ...
3 votes
1 answer
4k views

Can a plain text email contain XSS injection?

I need to send a plain text email with user-specified input. For example, if a user is an attacker a plain text email can contain <script>alert(1)</script> It looks like mail clients ...
0 votes
1 answer
277 views

Is it possible to get xss in json body request?

I was doing a VAPT assessment in which I see some JSON body in the request which has orgid deviceid So there any possibility to get XSS in json body?
1 vote
2 answers
572 views

XSS outside of the DOM

I have the following JS (using jQuery for brevity's sake but it isn't necessary for the question): $("<i></i>").html(userInput); Is it possible for someone to input some string, ...
0 votes
1 answer
251 views

How does this PortSwigger lab's XSS work?

I was doing the following PortSwigger Lab on cross site scripting (XSS). The following payload works perfectly. http://foo?&apos;-alert(1)-&apos; Which is input into the following section of ...
1 vote
1 answer
332 views

Can BeEF also work in public?

Is it possible to run the tool called BeEF to do penetration testing on real domains like example.com? As far as I know, BeEF can only be used within localhost. I can only test my site for XSS on the ...
0 votes
1 answer
156 views

Is this SQLi or XSS? (or both/neither)

I'm trying to get the hang of SQLi and XSS, and I am starting to get the hang of it. However: in my lab I made this: ignore'"; UPDATE users SET name=<script>alert('Malicious activity')</...
0 votes
0 answers
401 views

xss attack on value field by bypassing encoded double quotes

consider a website that handles search query like this: <input class="something" type="search-field" value="SEARCHQUERY"> if i try to inject this script it doesnt work... " onerror="alert(0) ...
0 votes
0 answers
311 views

How to turn a relative path script (js) import to an absolue one with a url for XSS ? (more details below)

I have a parameter whose value is injected in the HTML as the following <script src="/dir1/dir2/dir3/dir4/INJECT_HERE"> </script> I was able to traverse back to just / but when ...
0 votes
1 answer
617 views

How does this break out of a javascript tag? [closed]

How does putting the alert function '-alert(1)-' into a search field, where it ends up inside a script tag actually break out of the script string? Wouldn't this just be interpreted as an empty string ...
0 votes
2 answers
220 views

What are the vulnerabilities of exposing url end point param?

I have a wordpress plugin that helps create an organization chart/tree and then generates a URL where the chart is available to be viewed by the public? Inside the plugin's view in WordPress dashboard....
1 vote
1 answer
736 views

Why is this XSS not working on my site?

I'm attempting to make a site with an example of what XSS would look like, so in this I take user input and set a paragraph element's innerHTML to the user input but the script isn't running. However ...
0 votes
1 answer
139 views

IP address in access.log is incorrect and likely hacked

I just noticed in my access.log several POST requests coming from a (hidden) registration sub page that is not accessible via any link. A 'hacker' seems to have posted a form from there (manually it ...
1 vote
2 answers
12k views

Is cross site scripting possible with the img alt attribute?

If any characters are allowed in the alt attribute of an img tag (except for double quotes), is XSS possible? Valid image or not.
1 vote
0 answers
314 views

Headers X-XSS-Protection issue

I want to clear my doubt that Is there any issues coming from adding 'Strict-Transport-Security' and 'X-XSS-Protection' headers ? Header set Strict-Transport-Security "max-age=10886400; Header ...
1 vote
1 answer
699 views

Is there a consensus on whether HTML encoding should happen upon upload or retrieval/display for defense against stored XSS?

The common thing to do in defense against XSS, stored or not, is to HTML-encode the payload. Encoding upon the upload/POST of the data is efficient for processing power and neutralizes it early to be ...
22 votes
4 answers
26k views

Is a secure cookie without the HttpOnly flag a problem?

I understand that cookies with the secure flag should be transmitted over a HTTPS connection. It also means that these cookies should be protected from adversaries (private cookie). Thus, it is ...
0 votes
1 answer
258 views

Is this safe from XSS?

I need to allow a user to pass unsafe text into an iframe URL: <iframe src="https://example.com?foo=INPUT"></iframe> Inside the iFrame render code, I have this: <!doctype ...
6 votes
2 answers
2k views

What is the point of having a refresh token if it can be as easily stolen as an access token on client-side/JavaScript applications (SPA/PWA)?

From my understanding, the point of having a refresh token and short lived access tokens is to mitigate the consequences of having the access token stolen. This way, if this happens, the attacker will ...
1 vote
3 answers
2k views

Filtering out JavaScript from HTML to prevent XSS?

I'm having an exercise to patch an older version of my work from university's e-class. It's written in PHP and requires version 5.3.27. One of the things I want to patch is to prevent XSS. The site ...
5 votes
2 answers
15k views

XSS vectors in img src and background-image url

I'm a little confused about XSS vulnerabilities when serving img.src and background url. From what I understand, the only way to execute javascript in this case, is to use javascript protocol. Let's ...
0 votes
1 answer
321 views

JSON Web Token splitting

It's been quite a few years since the last time I did web development and I realized many things have changed: instead of stateful server-side sessions with authentication cookies and CSRF tokens now ...
0 votes
0 answers
164 views

Failed to inject payload with Python requests library in DVWA forms

I have written a Python script to inject a payload through the requests library, but the payload is being added instead of injecting xsstestscript=html.unescape("&lt;script&gt;alert&#...
10 votes
2 answers
66k views

Will JavaScript be executed which is in an HREF?

I located an issue with a site where I can insert a script tag into the href of an anchor tag: <a href="<script>alert(8007)</script>">Click Me</a> What I am trying to ...
4 votes
2 answers
10k views

XSS in Content-Disposition

Lets assume i have found a xss on site example.com, now to trigger an XSS, i use the following URL: https://example.com/a.php?v=%22%3E%3Cimg%20src=x Which results in following response: HTTP/1.1 ...

1 2 3
4
5
31