Questions tagged [xss]

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

Filter by
Sorted by
Tagged with
0
votes
0answers
17 views

Bypassing < > XSS filter on a website [duplicate]

<a href="https://website.com"><span style="color: black;">text</span></a> I am trying to bypass an XSS filter but it is not working since given <, > are filtered and become ...
0
votes
1answer
3k views

Is there a way to exploit jquery 1.12.4 vulnerability?

According to https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=jquery+1.12.4 and https://snyk.io/test/npm/jquery/1.12.4, I see that jQuery 1.12.4 has medium serevrity vulnerability. I checked on ...
3
votes
2answers
552 views

Is this hybrid (cookie, jwt) authentication method for web applications known and practical?

I have been working with web applications for a while, some months ago I found a possible approach to get the security advantages from Browsers while using cookies for authenticating requests, with ...
2
votes
2answers
7k views

Bypass Asp.Net 4.6 “A potentially dangerous Request.QueryString value was detected from the client”

I'm testing an application where the application does not handle special characters but request validation in ASP.NET picks it up and throws an exception. There have been some different ways to ...
-1
votes
1answer
160 views

Can running javascript from the console be considered as XSS?

I did it from the console. Is this a security issues?
0
votes
1answer
131 views

Is it worth using a client-side XSS-focused library like DOMPurify?

That may not be the best way to phrase the question, but gives the basic idea. If everything client-side is malleable, is it even worth it to use a JS library for sanitization? I've seen DOMPurify ...
0
votes
1answer
29 views

How to filter HTML Event in Native PHP7

i want to creating xss filter for my own project, this is for html event filtering preg_replace("/ on\w+='[^']*'/i", '', preg_replace('/ on\w+="[^"]*"/i', '', $framed)); but considering to more ...
0
votes
2answers
374 views

XSS possible inside the value field of input tag when double quote is filtered?

Is it possible to get XSS in the value field of Input tag when the application filters out double quote? <input type="hidden" name="something" id="somenthing" value="my_input_goes_here"> input ...
1
vote
0answers
271 views

XSS and CSRF Protection in a SPA with session cookies and auth in sub-domain (confused)

The problem is, that the more I read about XSS and CSRF and the protection against these attacks for my website, the more I get confused what would be the right strategy. Setup: SPA (Reactjs and ...
5
votes
3answers
283 views

How to safely allow scripts but preventing XSS?

We are trying to find the best way to allow JavaScript in a web application while being safe against XSS. Site admins have the privilege to insert JavaScript to control the site templates, and ...
1
vote
1answer
92 views

XSS using SVG: Is AllowScriptAccess attribute ignored?

I was experimenting with some Anti-XSS solutions, and during my research, I found following the XSS vector in a cheatsheet: <EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH ...
3
votes
1answer
144 views

How to prevent XSS in user-generated content (html) without disabling scripts and CSS [duplicate]

Is there a way to somehow sandbox user-generated content? I'm working on webapp which will contain a lot of user-generated content. Only "trusted" users will be able to publish the content, but I want ...
0
votes
1answer
187 views

XSS vulnerability in display message

I have a webpage in which Email is given as input. It will then display "your email is abc@xyz.com". I am then changing the email in URL to <script>alert(1)</script> and send tbe request ...
2
votes
0answers
108 views

Sandboxing untrusted JavaScript execution by redeclaring variables

Some irrelevant background (read only if you want to say "no, just use an iframe") Scenario Suppose that I downloaded a string jsCode containing arbitrary JavaScript code from a (potentially ...
0
votes
1answer
135 views

Blind XSS via cookie?

I would like to know if its possible to test blind XSS via a cookie value. That is I send the server some cookie that has a blind XSS payload. Or is blind XSS only exploitable if a human interacts ...
7
votes
3answers
13k views

How to bypass .Net 4.5 request validation, for an XSS attack?

.Net has a feature called request validation which detects malicious inputs and blocks the request. By its nature, request validation is not a precise science. OWASP clearly recommend to only rely on ...
1
vote
1answer
1k views

How to prevent persistent XSS vulnerability with the Java Struts 1 Framework?

I have an application that executes under Tomcat 7, developed with Struts (Java Web Framework). My application contains a security vulnerability (XSS Cross-site scripting). What kind of XSS ...
0
votes
0answers
93 views

Is this script vulnerable to xss? If yes, how can i get an alert box?

I think this code may be vulnerable to dom based xss but i wasn't able to get an alert box. I am able to control the userTitle field, i tried using </script> but it get changed to u003c/...
0
votes
2answers
1k views

Prevent javascript cross-origin redirect by window.location.href

Following this question, is there a way to prevent this code from redirecting users to domains not whitelisted? const form = document.getElementsByTagName('form')[0]; form.addEventListener('submit', ...
0
votes
0answers
33 views

How to deploy your web server's Web Application Firewall while limiting false positives

For objective discussion: We deploy several Web Application Firewalls where I work. I know that one particular on-prem product uses Apache [reverse] Proxy & ModSecurity to match HTTP POST traffic ...
2
votes
1answer
80 views

Can the Internet Achive capture anything malicious?

I have been using the site Internet Achive when I was researching a domain name and found an older version of the domain I was investigating turned out to be a NSFW web site it seemed like it was ...
2
votes
0answers
77 views

Is the PHP BB code extension safe against XSS?

Bad home brew implementations of BB code (especially in PHP) are a common source of XSS vulnerabilities. Usually they rely on a bunch of regexes, a tool that is not fit for the job. But lo and ...
1
vote
1answer
54 views

Can XSS mitigate all anti-CSRF protections?

Say a website has the following form on their sign-up page: <form method="POST" action="https://example.com/login/"> <input type="hidden" name="x-csrf-token" value="[token]"/> <input ...
0
votes
0answers
115 views

Is this code vulnerable to DOM based XSS? jquery wrap()

Data is read from window.location and passed to the wrap() function of function of jQuery via the following statement: t.Location.wrap(window.location) The version of jQuery in use is the 1.12.1 - ...
3
votes
3answers
1k views

Encoding output in JSON HTTP API

I'm the author of a JSON REST API. This REST API is consumed by various clients, such as HTML/JS-clients, .NET clients (console applications) and Ruby clients. The output of the API is in JSON format, ...
1
vote
0answers
51 views

Where to store encryption based tokens in Encryption based Token Pattern?

Reading OWASP encrypted tokens pattern they describe the flow as follow: After successful authentication, the server generates a unique token comprised of the user's ID, a timestamp value and a ...
0
votes
1answer
1k views

Exploit: Send cookie to another server from url

I'm testing a web application and found that url contains "redirect=" where it navigates to new location once logged in. http://IPAddress/?redirect_uri=test I'm trying to exploit the cookie using ...
1
vote
1answer
575 views

How to create a secure BBCode?

Right now, people can use XSS in my URL BBCode, and I don't know how to fix it. I had attempted to fix it a while ago, but someone some how bypassed it! function filterScript($content) { $...
3
votes
3answers
511 views

Are jQuery vulnerabilities exposed by the file being served from the server of by usage of the vulnerable code?

I've recently been asked to update a legacy web application, installed on numerous client servers, to use the current version of jQuery 3.3.1, rather than 1.10.2 which has a number of vulnerabilities. ...
1
vote
1answer
545 views

How is security risk of storing authentication token in localStorage compared with cookies?

I've read that it's a bad idea to save Single Page App's encrypted authentication token in browser's localStorage because this makes your app vulnerable to XSS attack, and when the token is stolen, ...
1
vote
2answers
691 views

How do web browsers detect XSS attempts when the X-XSS-Protection header is enabled?

Simple question but hard to understand how web browsers make the distinction between legitimate and malicious code when mode=block is enabled? Of course, I would like to know how each rendering ...
4
votes
3answers
1k views

HOW is the malicious URL/payload is delivered to the user on a DOM based XSS attack?

Testing for DOM based XSS at OWASP reads: The first hypothetical example uses the following client side code: <script> document.write("Site is at: " + document.location.href + "."); </...
0
votes
2answers
371 views

Using single or double quotes to prevent XSS and SQLi?

Why it is recommended to put single or double quotes around HTML attribute values? It is recommended to prevent XSS, but why? Same goes for SQL injection: It is recommended to use single or double ...
0
votes
1answer
84 views

Triggering a XSS when the payload appears twice?

I have found a XXS vulnerability, but I am not able to exploit it. My input, 66038');}confirm(1);/*, appears two times. The idea was to close the function foo1() and trigger confirm(1). But foo2 is ...
0
votes
1answer
338 views

XSS code not fetching back script

I am doing a XSS challenge on HTB and have run into an issue. I have the unvalidated field that is vulnerable to XSS and so far I have got the below line to successfully call back to a python server ...
3
votes
0answers
812 views

Solutions from StackOverflow to prevent XSS in JSP pages don't work

I have a JSP page where the HTML title is pulled from a GET parameter title: <title>${title}</title> Obviously, this allows for XSS attacks. If I follow the answer given on this page and ...
0
votes
1answer
969 views

What is the XSS auditor in Chrome/Firefox and how do I find bypasses?

I've been doing a lot of bug bounties lately and although I've been gaining reputation and experience, I never seem to find XSS even in private programs. Items are always being reflected as HTML. It ...
1
vote
0answers
289 views

Android WebView JavaScript Enabled

I recently found an Android application, which uses a WebView with enabled JavaScript. In this webview I am able to browse from their provided FAQ page to twitter, and from twitter basically ...
2
votes
2answers
1k views

What are the common features to identify XSS attack from Apache log file?

I have tried some XSS vulnerability on web application such as webgoat, OWASP mutillidae, bWAPP. I want to know the features/keywords/footprints of cross site scripting attack in apache log file and ...
1
vote
1answer
164 views

HTML payloads work on burp but not on browser

I was looking into bWAPP. In the HTML GET Injection section, I entered %25%33%63%25%36%38%25%33%31%25%33%65%25%36%31%25%37%30%25%37%30%25%36%63%25%36%35%25%33%63%25%32%66%25%36%38%25%33%31%25%33%65 ...
2
votes
2answers
163 views

Can hacker delete my server files and database where I am using below function?

I want to know how to protect my website from hackers. I am a php-mysql developer. For fetching data from databases I always use MySQLi. For preventing my website from SQL injection, I always use PHP'...
1
vote
1answer
412 views

Is this code vulnerable to DOM based XSS jquery animate? [duplicate]

Is this code vulnerable to DOM based XSS? The application is using jQuery 1.12.4 and i noticed that Data is read from window.location.hash and passed to $() via the following statements: var target_ ...
0
votes
1answer
127 views

Prevent javascript cross-origin write

Let's assume an attacker manages to inject this script in a login page: const form = document.getElementsByTagName('form')[0]; form.addEventListener('submit', stealCredentials); function ...
0
votes
1answer
262 views

Is this code vulnerable to dom based XSS? [duplicate]

Is this code vulnerable to DOM based XSS? The application is using jQuery 3.3.1 and i noticed that Data is read from window.location.hash and passed to $() via the following statements: var hash = ...
9
votes
2answers
3k views

Why shouldn't I put user input in HTML comments?

The OWASP XSS Prevention Cheat Sheet has a list of locations where untrusted data should never be put: <script>...NEVER PUT UNTRUSTED DATA HERE...</script> directly in a script <!-...
2
votes
2answers
222 views

CSRF methods: img vs iframe vs form/javascript

I have a questions concerning methods for executing CSRF. I did the CSRF Prompt By-pass lesson in WebGoat (Lessons -> Cross-site Scripting -> CSRF Prompt By-pass). The lesson requires you to craft an ...
1
vote
3answers
1k views

Injecting <script>alert(“1”)</script> to OWASP Juice shop doesn't work

I've just learned the theory behind XSS attacks and now I would like to test my knowledge in a legal way. I wanted to "hack" OWASP Juice shop by following steps from this book section "Perform a ...
0
votes
1answer
1k views

How to get admin cookie with Persistent XSS?

Two parts to this question. Let's say there is a site which accepts my input and sends it in XML format to server. When I enter the input as shown here: https://ghostbin.com/paste/hc5n6 The reason I ...
0
votes
3answers
509 views

Why doesn't XSS execute when bypassing HTML encoding?

I am trying to execute an XSS payload on a search field that takes my input like this: <input name="q" id="gsasearch" type="text" value="My Input"></input> Observations: <, > and "...
1
vote
1answer
202 views

What are a JSON rest api's responsibilities to prevent XSS? [duplicate]

I'm building a rest API that serves exclusively JSON. It might one day be consumed by a browser based app. Is there anything I should do on my end to prevent XSS attacks?