Skip to main content

Questions tagged [xss]

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

Filter by
Sorted by
Tagged with
1 vote
1 answer
208 views

XSS on infinite-scrolling pages

Say I make a social-media website and forget to include the htmlspecialchars() function. If the website uses infinite scrolling (that will eventually show every post on the website if you scroll down ...
1 vote
0 answers
1k views

XSS Payload Cookie Stealing

I have been playing around with the DVWA stored XSS page and wondered if someone could help. I used XSS Validator in Burp and found numerous payloads that give a prompt, indicating that XSS is present....
7 votes
2 answers
25k views

Bypassing browsers URL encoding to do reflected XSS from query parameter?

I tried to get reflected XSS in vulnerable website with a request to the following URL: https://vulnerable.website/dir/dir?param1=test"><svg/onload=alert(1)> The browser URL encode the ...
0 votes
1 answer
847 views

XSS attack not executing with correct payload

Hello I was testing on a private program where I was able to inject XSS but for some reason it is not popping up when I put the mouse over the input field. <input type="text" onmouseover=&...
1 vote
0 answers
356 views

CSRF and XSS Protection with a Static Site and REST API

I'm building an application which will support both browser and application access to REST resources. Applications will POST a username/password JSON body to a login endpoint which will return a ...
4 votes
1 answer
15k views

How to perform XSS in hidden HTML input fields using accesskey?

I am trying to insert a XSS payload into a hidden HTML input field. I know it works with a script tag like below, but I am looking for other alternatives. <input type="hidden" name="date" value=""/...
2 votes
1 answer
209 views

Is this server side object vulnerable to XSS?

I have an object that is stored in the server side of the application. It is never inserted into the DOM. The object looks like this: {"id": "34245425", "field": false, &...
3 votes
1 answer
4k views

Can XSS ever occur in an <img> tag's "src" attribute?

In a scenario where an attacker has control over the src attribute of an img HTML tag, they could easily inject a simple JavaScript XSS payload like the following: <img src="javascript:alert(1)...
3 votes
1 answer
462 views

Is this XSS filter for HTML comments safe?

HTML comments can be notoriously tricky from an XSS standpoint, and the standard recommendation seems to be to never put untrusted user data in them. But shouldn't it be possible to strip out a few ...
1 vote
2 answers
3k views

How is Object Tag data URI XSS actually XSS?

I have been looking into XSS pertaining to base64 encoding a data URI into an <object> tag (which is typically considered only a feasible XSS payload in Firefox), but I am failing to understand ...
1 vote
1 answer
1k views

JWT cookie with CSRF token as a claim inside the JWT

I am trying to figure out if the solution I am suggesting is valid for both XSS & CSRF protection, I would like to store the JWT in an httpOnly & secure cookie and not in local storage, when ...
1 vote
1 answer
2k views

How to implement the CSRF token mechanism for restful APIs?

Considering the following facts, using CSRF token for a restful API (which of course is intrisincly session-less) seems inevitable: storing JWT in local storage(any where other than http-only cookie) ...
0 votes
1 answer
1k views

How to test an Angular SPA for DOM XSS with OWASP ZAP?

I want to test an Angular SPA for any DOM-based XSS. How do I do that with OWASP ZAP?
4 votes
4 answers
10k views

Can Cross site scripting lead to database access?

I wanna know that weather a site having XSS vulnerability can lead the hacker to access database? I know that he can get the username and password from the cookie stored but can he completely access ...
3 votes
1 answer
1k views

What can attacker do with OpenID Connect id_token?

I have an application that stores the id_token in the localStorage of the browser. Since there is no CSP and Web Storage does not have the same protections such as cookies (HttpOnly, SameSite) this &...
2 votes
1 answer
2k views

HTML Option Tag XSS

Is it possible to inject javascript inside of an HTML option tag? For example, say you have the following html: <select> <option MALISCIOUS_CODE_HERE>Option Description</option> &...
1 vote
1 answer
696 views

Keycloak's Angular quickstart : XSS vulnerable?

We are using Keycloak for the authentication of our server-side rendered applications (Java/Spring/Thymeleaf), and now we want to use it for our Angular applications. Using the Angular quickstart, ...
2 votes
3 answers
1k views

Does SOP prevent a class of CSRF attacks?

Just want to settle a debate I'm having with someone. Suppose there is no SOP. Via an XSS exploit, code can run on website A.com and submit an XHR request to B.com. Suppose B.com stores an auth token ...
0 votes
1 answer
503 views

Detecting XSS when Payload is only Triggered on Another Page

I am trying to detect the presence of a blind/stored XSS vulnerability of an input field. The vulnerability does not trigger on page 'A' where the payload is injected. It is likely due to the fact ...
4 votes
3 answers
20k views

Cross site scripting prevention removing &lt and &gt

I'm testing an application that only skips < and > symbols. The user input being validated is always inserted between html tags like <b>, <span>, <div>, etc. and never passed ...
0 votes
2 answers
870 views

XSS payloads getting filtered but HTML tags are getting rendered. Can we exploit this? [duplicate]

I was trying to test a potential XSS vulnerability on a website. On the search bar I can see the filtering process happening i.e if I type script> (not with starting <) I can see the same in the ...
55 votes
2 answers
31k views

Is including the data scheme in your Content Security Policy safe?

I have a Cordova app that transforms some images to base64. This violates CSP with this message: Refused to load the image 'data:image/svg+xml;charset=US-ASCII,%3C%3Fxml%20version%3D%221.0%22%20encod…...
41 votes
7 answers
5k views

What are some important concepts to teach developers about cross-site scripting (XSS)?

I'm helping with a one-hour training for developers (~100 of them) on cross-site scripting. What are some concepts you think are indispensable to get across to them? Right now we have: Difference ...
0 votes
1 answer
374 views

Could this code be vulnerable to XSS?

It seems like exploiting XSS is becoming harder with every browser version update. My question is: Is this code vulnerable to XSS? <script type="text/javascript"> var url = ...
1 vote
1 answer
2k views

XSS without angle brackets

I would like to run the following script inside an input tag when the page loads. I know how this can be fixed by using onfocus and autofocus. But how do I get the expression document.cookie in there? ...
2 votes
2 answers
5k views

How do I bypass a regex filter that filters all html to avoid xss?

How do I bypass a regex filter that filters all html to avoid xss? I've tried using things like &lt;img src="aa" onerror="alert(1)"&gt; but still no luck. This is for a CTF ...
1 vote
1 answer
3k views

How to prevent persistent XSS vulnerability with the Java Struts 1 Framework?

I have an application that executes under Tomcat 7, developed with Struts (Java Web Framework). My application contains a security vulnerability (XSS Cross-site scripting). What kind of XSS ...
2 votes
1 answer
2k views

Is <plaintext> vulnerable to XSS

I have a question regarding the element. I know that this element has been deprecated for a long time, but during a penetration test, we inserted the following attack vector into a textarea: <...
4 votes
4 answers
59k views

How can I bypass double quotes in a attribute based xss attack

The code that I have is: <input type="text" name="some_name" value="<?php echo CHtml::encode($str); ?>" /> $str is the input data. 'CHtml::encode()' is Yii's way of encoding special ...
2 votes
1 answer
1k views

XSS inside of a javascript string, with unusual filter

While making a website I made an interesting mistake, and I'm wondering if this could be used to achieve XSS. I've come very close, but not quite. I can put my user input into a string inside of a <...
0 votes
1 answer
13k views

How to bypass an XSS filter encoding single quotes? [duplicate]

I'm trying to do an XSS attack test on a website. I am using " and <> just fine and I have managed to escape the string. Now I'm trying to send my own cookie to my server that saves it to a ...
1 vote
2 answers
657 views

Can “c:set” cause Cross Site Scripting (XSS) vulnerability?

Can this be exploited as XSS vulnerability using urls like localhost/?myVar=<script>alert(document.cookie)</script> or though any other possibility? <c:set var="myVar" value=&...
1 vote
2 answers
497 views

abiliity to change elements in HubSpot iFrame forms

I recently started working on adding custom code to HubSpot forms after their form is loaded via an iFrame. Initially, I was using the following code to access the iFrame to change it: var form = ...
1 vote
1 answer
6k views

CSP - Unsafe-inline or unsafe-eval for specific domain is allowed or not

Following is a CSP policy, for example derived sample response headers. The implementation below allows white-listed domains only in "script-src" directive but the 'unsafe-inline' and 'unsafe-eval' ...
1 vote
3 answers
523 views

Do browsers XSS filters protect against DOM based XSS?

Many (but not all) browsers come with built in XSS protection that can be activated with a HTTP header: X-XSS-Protection: 1; mode=block As I understand it, it prevents reflected XSS attacks by ...
0 votes
1 answer
7k views

Is it possible to bypass httponly?

I read some articles about XSS and how to mitigate the flaws in a web application. I've seen the HttpOnly on Set-Cookie. Can this flag be bypassed? Or is there another way to access a session cookie? ...
7 votes
1 answer
8k views

Passing a C# object to Javascript in ASP.NET MVC

Several answers on StackOverflow suggest that a C# object can be passed to JavaScript in ASP.NET MVC by the following: <script type="text/javascript"> var obj = @Html.Raw(Json....
15 votes
2 answers
6k views

How do I safely host third-party Javascript code in an iframe?

I'm building a website where users, among other things, can add embeds (YouTube, Google Forms, Airtable...) and show those embeds to other people. Embeds are snippets of HTML that can include <...
0 votes
0 answers
1k views

Stored XSS cookie stealing, but a loop of redirection

I found a stored xss vulnerability on a comment section of a fun site and I wanted to steal cookies using xss attack. So on my remote server I run an HTTP server with Flask using python where there is ...
53 votes
2 answers
24k views

Will same-site cookies be sufficient protection against CSRF and XSS?

I must say, that I like this idea and it seems that it will bring a new form of protection against CSRF and XSS or at least it will reduce those attacks. So, how effective will this protection be? ...
2 votes
2 answers
5k views

XSS in script tags application/json - possible?

Is there way to execute alert box if " is not correctly escaped and can be injected in example below? <script type="application/json">{"requests":{"postClicked"...
0 votes
1 answer
584 views

Securing a Websocket Connection in case of XSS Vulnerability

Goal Authenticate the Client via HTTP Request. Authenticate the Client's WebSocket connection. Prevent exploitation of WebSocket connection(when a XSS Vulnerability is present on website). How I'm ...
0 votes
0 answers
122 views

Taking html, js, css input from the user

We are building a multitenancy web app with Laravel (+Blade), each user can create a store (tenancy), and have a control panel where they can edit the store settings and styling, to edit the store ...
0 votes
1 answer
696 views

Flask XSS prevention

I'm trying to fix a possible XSS vulnerability in WebApp (Flask) and I'm not sure what is the best way to prevent XSS without breaking functionality. For example, I have the following code block: ... ...
0 votes
0 answers
644 views

Exploit an XSS without <> and valid encoding

I'm making a web penetration test, so I trying to exploit a XSS, I've looked that if I use a payload like the following: <script>alert(document.domain)</script> The output in the page ...
6 votes
1 answer
5k views

Is it better to disable X-XSS-Protection header or set the header as X-XSS-Protection: 0?

Because X-XSS-Protection header is now not supported by major browsers I wonder what option is better, to delete this header or to set the header as X-XSS-Protection: 0? Because browsers do not ...
1 vote
2 answers
11k views

Is it possible to read and extract HTTP request headers via JavaScript while performing XSS & CSRF? If so, how?

Is it possible to read and extract HTTP request headers via JavaScript? i.e. something like; var req = new XMLHttpRequest(); req.open(‘GET’, document.location, false); req.send(null); var headers = ...
0 votes
2 answers
9k views

read etc/passwd using XSS

by trying the XSS room on THM, I try was trying to read the /etc/passwd using the following cmd: <iframe src="/etc/passwd"></iframe> However what I got is an error code as shown ...
3 votes
2 answers
9k views

How can I read local files from blind XSS?

When I do one of these payloads, I can see /etc/passwd: <iframe src=file:///etc/passwd></iframe> <img src="xasdasdasd" onerror="document.write('<iframe src=file:///etc/...
0 votes
1 answer
495 views

Is it possible to bypass this csp?

Today I created a web application. I'm using this csp to avoid xss attacks. CSP: Content-Security-Policy", `child-src 'none'; connect-src 'none'; default-src 'none'; font-src 'none'; frame-src '...

1
3 4
5
6 7
31