Questions tagged [xss]

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

Filter by
Sorted by
Tagged with
0
votes
4answers
1k views

Using DOM-based XSS to redirect to different domain or execute script?

I was trying my hands at DOM-based XSS. I came across a scenario where a user-controlled string from the URL is included in JavaScript as below. var userControlled=substring of URL; window.location="/...
19
votes
2answers
6k views

Will same-site cookies be sufficent protection against CSRF and XSS?

I must say, that I like this idea and it seems that it will bring a new form of protection against CSRF and XSS or at least it will reduce those attacks. So, how effective will this protection be? ...
2
votes
2answers
167 views

Does rendering of user supplied content imply an xss vulnerability?

I am working on a chat program in my spare time. If a user inputs html it will be rendered, for example, <a href="example.com">link</a> will render a hyperlink. At the same time, if you ...
3
votes
2answers
463 views

XSS payload nuances

I am checking this application & have confirmed a reflected xss. Now, I am trying to craft a functioning payload, instead of simply showing an alert box. The crafted url is as follows: http://...
3
votes
1answer
122 views

Why the following XSS vectors work without closing bracket?

The following XSS injections will execute without the accompanying closing tag (see this demo): <body/onload=alert(1) <svg/onload=alert(1) <iframe/onload=alert(1) I just need to know why ...
0
votes
1answer
839 views

What would be the impact of a CVE-2015-9251 vulnerability?

I've seen that in jQuery versions older than jQuery 3 there is the CVE-2015-9251 vulnerability which can result in cross-site scripting. Is this a limited vulnerability? What could be its possible ...
15
votes
3answers
4k views

Does incognito/private browsing prevent XSS attacks?

When starting an incognito/private browsing session, no cookies from other browsing profiles should exist. For example, if I am logged in to a site on my main browsing profile, then start a new ...
9
votes
3answers
6k views

Is XSS possible with jQuery(location.hash)?

Is it possible to exploit XSS in the following code? jQuery(window.location.hash) It seems to me that window.location.hash always starts with a hash #, and modern jQuery always interpretes this as ...
2
votes
1answer
779 views

XSS from JSON outputs

In the book "XSS Attacks - Exploits and Defense" Jeremiah Grossman writes: The exploit found in Google’s reader was due to the developers thinking that JSON was only going to be viewed by the ...
0
votes
1answer
180 views

Is XSS exploit always illegal? [closed]

I recently got a great deal of $$ stolen by scammers. I am trying to use XSS exploitation to find his real identity (IMSI, IMEI, External IP, Internal IP, any computer unique ID) Is it legal? I am ...
2
votes
2answers
113 views

What is client side non-DOM XSS?

I've been reading on the new categories of XSS. According to OWASP, they're no longer just reflected, stored and DOM-based XSS, but rather server/client side, and then subdivided into reflected/stored....
10
votes
3answers
6k views

security issues in JWT storage

I'm creating a JWT login mechanism for a site. There are two very opposing opinions on how to store the JWT. Stormpath swear by cookies httponly: https://stormpath.com/blog/where-to-store-your-jwts-...
2
votes
1answer
207 views

Are unescaped backslashes dangerous in terms of XSS?

I thought the \ (backslash) character was a dangerous character that you needed to filter out/properly encode to protect against XSS attacks (OWASP says so, too), and I still do, but why? I found a ...
0
votes
1answer
501 views

How can I execute a XSS on 302 redirect and the body on the page?

Is there a way to execute XSS? on 302 redirect and the body on the page? <HTML><HEAD> <TITLE>302 Moved Temporarily</TITLE> </HEAD> <BODY> The document has moved &...
8
votes
1answer
13k views

XSS bypass strtoupper & htmlspecialchars

I've looked into a bit of pentesting but the following is eluding me, I think I've got it but I can't get it to trigger! Trying to bypass the following: $strippedID = htmlspecialchars($ID); $NEWID = ...
0
votes
2answers
2k views

Why can't I test XSS Vulnerability?

I am using DVWA and having trouble executing a simple, reflected XSS vulnerability. Entering the suggested text does not produce a popup in either Firefox or Chrome. Are there any settings that I need ...
1
vote
0answers
227 views

Bypassing double quote in DOM based XSS?

I am trying to generate a POC for DOM XSS exploit. I could inject a code using the following link: <a href="wepage.jsp" target='&quot;><script> alert(document.cookie)</script>&...
0
votes
1answer
133 views

DOMXSS - Is Input Field Content an Attack Vector?

A typical example for DOMXSS is that vulnerable code carelessly processes the part after the hash mark as in https://www.example.org/path/param1=val1&...#PAYLOAD_HERE without validation. For ...
1
vote
2answers
268 views

Can a site vulnerable to XSS be used to attack a site with a CSRF vulnerability?

I heard of the attacks Cross Site Scripting (XSS: An attack where an attacker injects malious client side code (For example: JavaScript) into a web application.) and Cross Site Request Forgery (CSRF: ...
1
vote
1answer
219 views

MageCart attack on Newegg

I am reading about an attack that occurred during August of this year conducted by the group MageCart through the use of "card skimming" to steal credit card info from Newegg users. While reading ...
2
votes
1answer
1k views

Am I safe from XSS in React as long as I don't use dangerouslySetInnerHTML?

Let's say I write a webapp using React only, never touching the DOM directly. I never use dangerouslySetInnerHTML. Do I still have to worry about XSS? Or in other words, are there any other unsafe ...
0
votes
2answers
146 views

XSS vulnerability through burp suite

I am getting a XSS vulnerability through burp suite but when I inject script manually I don't get the XSS vulnerability. Is this a reportable vulnerability?
1
vote
1answer
248 views

Is XSS via MIME sniffing a Stored or Reflected XSS?

The title says it all. I understand how to exploit XSS via MIME sniffing, but the question is, do you call this type of XSS stored or reflected? OWASP says Stored attacks are those where the ...
1
vote
0answers
855 views

How can I steal all cookies from reflected XSS?

I just found a website with a XSS vulnerability. When I visit the following URL, a pop up occurs: https://example.com/article/HALLOWEEN"><script>alert(1);</script> I have a ...
32
votes
7answers
6k views

How do hackers make the victim access an XSS attack URL?

As I understand it, the basic idea of XSS is to let the user's browser execute some malicious code created by the hackers. Say, if a page has a vulnerability of loading arbitrary script when user ...
1
vote
0answers
238 views

How did the recent British Airways hack go down?

How did the Magecart group manage to inject their malicious code into the source code of the BA ticketing site? I have read two articles, one of which said, it could be because BA was not checking ...
2
votes
1answer
257 views

How does the anchor tag (<a>) let you do a stored XSS?

I was trying to get XSS but and site validate input but when I entered https://google.com the site did this: <a href="//google.com">https://www.google.com</a> so I tried to do this: ...
-1
votes
1answer
552 views

Bypass this unique XSS filter?

I found a website that reflected back the user inputs. But the problem is when I inject this payload <svg/onload=alert(1)> I get an error. But when I use this payload <%20svg/onload=alert(1)&...
4
votes
3answers
1k views

Is this code vulnerable to Reflected XSS?

I'm doing a pentest and came by this code: (function() { var subdomain = (function() { var query = /[?&]css=([^&#]*)/i.exec(window.location.search); if(...
-1
votes
1answer
679 views

Is it dangerous to use javascript:window.open in href tags?

I have a website and would like to create a link to share information on a third-party site. Is it safe to use the javascript:window.open() function to do this? If unsafe, are there any ways this ...
1
vote
1answer
92 views

Does escaping/cutting of <> prevents you from XSS [duplicate]

I have an input, which displays a value (Firstname) in a box on the page. On the server side, the input is escaped by following rule (vb.net): Public Function UnescapeString(strValue As String) As ...
3
votes
2answers
365 views

Why does “<!--<script>” in a JS string cause a broken page/denial of service for that page?

I was under the impression that all I needed to do to make inline JSON safe was to break any closing </script> tags in strings, e.g. escape the / like <\/script>. However I found a weird ...
4
votes
3answers
16k views

Typical 'search box' XSS attack

When I develop a site, I'm always conscious of security flaws, but I'm struggling to see how a search box could ever be used to inject script that could be ran on a page of mine. So I understand that,...
1
vote
1answer
65 views

How does Software Defined Perimeter (SDP) protect against certains attack that happen in the browser?

I have been doing a bit of research on SDP (Software Defined Perimeter) but it's still a bit unclear to me how it protects against certain types of attacks. On Wikipedia it says that it can protect ...
2
votes
1answer
68 views

What stops us from using an <antiscript> tag to stop XSS?

I am aware of various ways to prevent XSS attacks, such as escaping and encoding, which are prone to issues, and using a Content Security Policy which requires extraction of all scripts. However, what ...
0
votes
2answers
640 views

XSS attack vsibible in html but no running

To test XSS for a certain website, username in the account settings to <script type="text/javascript">alert("XSS");</script>. In the html the code it is visible and but it's not running. ...
7
votes
4answers
6k views

Does default ModSecurity protect enough against XSS?

It's been a few years since I mucked around with modsecurity... Will simply installing the package with the default rules provide enough validation to prevent any (okay, let's be honest - best we ...
13
votes
1answer
19k views

Does Google Chrome protect against cross site scripting (XSS)?

In Firefox I've been using the NoScript extension to protect myself from certain kinds of malware attacks. NoScript is well known as a very powerful extension for Firefox and introduced protection ...
1
vote
1answer
560 views

Access denied after inserting reflected XSS payload in JavaScript

I am getting multi reflection of my input on a websites page, one of the reflections of my input happens to be inside the <script> tag. The script tag that I just mentioned has it's src ...
1
vote
2answers
4k views

How to bypass htmlentities() function in PHP to get an XSS?

Here is the PHP filter function that I'm dealing with: function xss_check_2($data) { return htmlentities($data, ENT_QUOTES); } The source code of the output (the output is the name, Peter ...
1
vote
1answer
36 views

Should untrusted strings be sanitized server-side if they're inserted into the document body through document.createTextNode?

Chat webapp. Clients (that is, web browsers) send messages to the server, which the server broadcasts to all connected clients. Client-side code looks like this: let p = document.createElement('p') p....
1
vote
1answer
124 views

What characters need to be escaped or replaced to prevent xss jsonp callback attacks?

I have a service which allows the user to specify a callback function name that wraps the data being returned to support jsonp callbacks. I want to make sure that I am covering all of my bases in ...
10
votes
2answers
7k views

XSS via JSON: Why does a web application not sanitize either its incoming params hash or its outgoing JSON values of malicious tags like Script?

Recently working on a Rails-based web application for a company, I had to look into XSS vulnerability. It turns out that the application, in some places, could take an HTML tag (e.g., <script>...
2
votes
1answer
594 views

Runtitme Error page is being displayed for XSS or SQL injection payloads

When I have manipulated the URI of an application with some SQL or XSS payloads I am able to see a runtime error page. Can we come to a conclusion that the application is vulnerable to SQL Injection ...
1
vote
1answer
213 views

Cross Site Scripting on a Unique Key

Is it possible to perform a cross-site scripting attack by entering my script into a field that is required to match a specific value? I am scanning an application for vulnerabilities, and my ...
1
vote
1answer
101 views

How to detect XSS on HTML tags? [closed]

I am a beginner who is trying to understand XSS. I want to make my own site and am very curious about how to detect if any of the HTML tags are vulnerable to XSS (like if the <src> or <a> ...
3
votes
2answers
2k views

Principal DOM Based XSS detect using python

I am working for a project make a XSS scan tool using python. I have a sample url: http://www.foo.bar/index.php?ids=111 I've found that it has a vulnerability by http://www.foo.bar/index.php?ids=">...
5
votes
1answer
280 views

Can BeEF hooking be stopped with Content Security Policies

I know that using strict values for default-src and scripts-src are a popular way to prevent (or at least limit the impact) of XSS attacks. But I was just wondering it CSPs can be used to stop ...
7
votes
1answer
321 views

How do I sandbox user JS without using a VM, transpiler, or whitelist-based API?

I've done my research and there are a few robust ways to sandbox user JS, namely: Use a JS VM that runs the JS using a sandboxed form of js, like VM.js Use a transpiler like Google Caja, which adds ...
3
votes
1answer
2k views

XSS via -confirm()-

I was reading this article here, in the middle I saw the author used -confirm()- as the payload. I'd like to know what is this payload? I mean what's the difference between -confirm()- and <script&...