Questions tagged [xss]

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

Filter by
Sorted by
Tagged with
2
votes
1answer
662 views

How is security risk of storing authentication token in localStorage compared with cookies?

I've read that it's a bad idea to save Single Page App's encrypted authentication token in browser's localStorage because this makes your app vulnerable to XSS attack, and when the token is stolen, ...
1
vote
2answers
748 views

How do web browsers detect XSS attempts when the X-XSS-Protection header is enabled?

Simple question but hard to understand how web browsers make the distinction between legitimate and malicious code when mode=block is enabled? Of course, I would like to know how each rendering ...
4
votes
3answers
1k views

HOW is the malicious URL/payload is delivered to the user on a DOM based XSS attack?

Testing for DOM based XSS at OWASP reads: The first hypothetical example uses the following client side code: <script> document.write("Site is at: " + document.location.href + "."); </...
0
votes
2answers
375 views

Using single or double quotes to prevent XSS and SQLi?

Why it is recommended to put single or double quotes around HTML attribute values? It is recommended to prevent XSS, but why? Same goes for SQL injection: It is recommended to use single or double ...
0
votes
1answer
84 views

Triggering a XSS when the payload appears twice?

I have found a XXS vulnerability, but I am not able to exploit it. My input, 66038');}confirm(1);/*, appears two times. The idea was to close the function foo1() and trigger confirm(1). But foo2 is ...
0
votes
1answer
356 views

XSS code not fetching back script

I am doing a XSS challenge on HTB and have run into an issue. I have the unvalidated field that is vulnerable to XSS and so far I have got the below line to successfully call back to a python server ...
3
votes
0answers
847 views

Solutions from StackOverflow to prevent XSS in JSP pages don't work

I have a JSP page where the HTML title is pulled from a GET parameter title: <title>${title}</title> Obviously, this allows for XSS attacks. If I follow the answer given on this page and ...
0
votes
1answer
1k views

What is the XSS auditor in Chrome/Firefox and how do I find bypasses?

I've been doing a lot of bug bounties lately and although I've been gaining reputation and experience, I never seem to find XSS even in private programs. Items are always being reflected as HTML. It ...
1
vote
0answers
297 views

Android WebView JavaScript Enabled

I recently found an Android application, which uses a WebView with enabled JavaScript. In this webview I am able to browse from their provided FAQ page to twitter, and from twitter basically ...
2
votes
2answers
2k views

What are the common features to identify XSS attack from Apache log file?

I have tried some XSS vulnerability on web application such as webgoat, OWASP mutillidae, bWAPP. I want to know the features/keywords/footprints of cross site scripting attack in apache log file and ...
1
vote
1answer
182 views

HTML payloads work on burp but not on browser

I was looking into bWAPP. In the HTML GET Injection section, I entered %25%33%63%25%36%38%25%33%31%25%33%65%25%36%31%25%37%30%25%37%30%25%36%63%25%36%35%25%33%63%25%32%66%25%36%38%25%33%31%25%33%65 ...
2
votes
2answers
166 views

Can hacker delete my server files and database where I am using below function?

I want to know how to protect my website from hackers. I am a php-mysql developer. For fetching data from databases I always use MySQLi. For preventing my website from SQL injection, I always use PHP'...
1
vote
1answer
475 views

Is this code vulnerable to DOM based XSS jquery animate? [duplicate]

Is this code vulnerable to DOM based XSS? The application is using jQuery 1.12.4 and i noticed that Data is read from window.location.hash and passed to $() via the following statements: var target_ ...
0
votes
1answer
143 views

Prevent javascript cross-origin write

Let's assume an attacker manages to inject this script in a login page: const form = document.getElementsByTagName('form')[0]; form.addEventListener('submit', stealCredentials); function ...
0
votes
1answer
282 views

Is this code vulnerable to dom based XSS? [duplicate]

Is this code vulnerable to DOM based XSS? The application is using jQuery 3.3.1 and i noticed that Data is read from window.location.hash and passed to $() via the following statements: var hash = ...
10
votes
2answers
3k views

Why shouldn't I put user input in HTML comments?

The OWASP XSS Prevention Cheat Sheet has a list of locations where untrusted data should never be put: <script>...NEVER PUT UNTRUSTED DATA HERE...</script> directly in a script <!-...
2
votes
2answers
251 views

CSRF methods: img vs iframe vs form/javascript

I have a questions concerning methods for executing CSRF. I did the CSRF Prompt By-pass lesson in WebGoat (Lessons -> Cross-site Scripting -> CSRF Prompt By-pass). The lesson requires you to craft an ...
1
vote
3answers
2k views

Injecting <script>alert(“1”)</script> to OWASP Juice shop doesn't work

I've just learned the theory behind XSS attacks and now I would like to test my knowledge in a legal way. I wanted to "hack" OWASP Juice shop by following steps from this book section "Perform a ...
0
votes
1answer
1k views

How to get admin cookie with Persistent XSS?

Two parts to this question. Let's say there is a site which accepts my input and sends it in XML format to server. When I enter the input as shown here: https://ghostbin.com/paste/hc5n6 The reason I ...
0
votes
3answers
574 views

Why doesn't XSS execute when bypassing HTML encoding?

I am trying to execute an XSS payload on a search field that takes my input like this: <input name="q" id="gsasearch" type="text" value="My Input"></input> Observations: <, > and "...
1
vote
1answer
229 views

What are a JSON rest api's responsibilities to prevent XSS? [duplicate]

I'm building a rest API that serves exclusively JSON. It might one day be consumed by a browser based app. Is there anything I should do on my end to prevent XSS attacks?
1
vote
0answers
480 views

Should sensitive tokens be stored in localStorage or an HTTPOnly cookie?

In the context of a web application... should sensitive tokens, such as those used for sessions, authentication and/or authorization, be stored in localStorage or an HTTPOnly cookie; or are they both ...
0
votes
1answer
168 views

Can registration forms be used for an XSS attack?

In most websites that have account logins, there are at least two fields: Email Password Could either of these fields be used to mount an XSS attack (assuming no character encoding)? For example, ...
0
votes
4answers
1k views

XSS payload shorter than 20 character

For an university project I have to perform an analysis on a web application to find out XSS vulnerabilities. After this I have to report and create automatic test to prove vulnerabilities that I have ...
2
votes
1answer
184 views

Can Arbitrary Code Execution be done using CSS Injection?

As part of our class project, we are studying the attacks that could be done using CSS Injection. In our threat model, attacker can manipulate any CSS file on the server. If attacker replaces original ...
0
votes
1answer
137 views

Is the following javascript code vulnerable to DOM XSS? [duplicate]

I have the following javaScript code in an application, which BURP flags as being possibly vulnerable. However, i have had no luck trying to get it to execute. var hash = window.location.hash; if(...
0
votes
2answers
145 views

'=' and '(' are bypassed XSS [closed]

How can I add = in my script when return input.replace (/ [= (] /g, ''); is replacing it? This is only for education purpose solving CTF. Used HTML codes but not working.
11
votes
3answers
6k views

How can I execute a XSS when a web application transforms a data from lowercase to uppercase?

I'm testing a web application, when I send an input data to web application, this places the data in an onclick function, something like this: <a href="#" onclick="someFunction('dataFromServer', '...
4
votes
1answer
289 views

XSS - will javascript execute in anchor tag where “/” by default added by server in href

I came across a scenario, where userinput is reflecting in anchor tag href value. So if i put test there it reflects as <a href="/test"> Due to this default slash added in the code, javascript:...
7
votes
4answers
2k views

Exploiting XSS in jQuery without equal character?

This is some vulnerable JavaScript code: $(document).ready(function(){ var payload = unescape(document.location.hash.substr(1)); $(payload); document.body.innerText = "The payload is: " + ...
1
vote
1answer
355 views

Not convinced on the security of a JWT Token + CSRF Token

Lets suppose I have a web application that uses JWT tokens and CSRF Tokens in its authentication scheme. As I understand it, it works like this: When a user logs in, the client sends a login request. ...
1
vote
2answers
194 views

What to do about vulnerability in a SaaS product I buy?

I work for a university, where I am part of the team responsible for integrating a SaaS Learning Management System (eg: Moodle, Canvas) with the rest of the university's systems. Two months ago, I ...
2
votes
2answers
967 views

Reflected XSS only works through Burp Repeater because of URL encoding

I am able to get reflected XSS through burp repeater using a GET request. I then click on show response in browser and I am able to get an XSS alert. But when I manually go to the URL in my browser ...
0
votes
3answers
772 views

How can I exploit a XSS vulnerability which doesn't allow me to type < and > symbols and puts my input in double quotes?

I have the following script: function filter() { const inputstring = JSON.stringify(document.getElementById('input').value) .replace(/[<]/g, '%lt') .replace(/[>]/g, '%gt'); ...
1
vote
1answer
131 views

XSS in custom, user-supplied CSS

Users of our web app would like to use custom CSS to customize parts of UI. I've came up with some kind of blacklist for CSS "bad words" and I'm curious whether it is sufficient or if I need to ...
0
votes
3answers
233 views

XSS: Code payload gets displayed on the screen as a string

I am new to security and trying to improve. Sometimes when I try to find XSS vulnerabilities on a website my payload just get displayed on the screen but nothing happens. The whole payload just gets ...
2
votes
2answers
294 views

Content Security Policy Header not stopping attack

I created a simple test web application to test the use of the content security policy header. I included a vulnerability in my test app, such that submitting a basic XSS payload with script tags ...
4
votes
1answer
10k views

ASP.NET Web API and potential XSS

I'm wondering if my ASP.NET Web API had an XSS vulnerability as my controller didn't have a method to handle the default GET call. Without the GET method being handled in the code a call to /api/...
30
votes
4answers
69k views

Which is the best way to sanitize user input in PHP?

What is the best way to sanitize user input? These are things I do when users submit data: substr if over limited values found. htmlspecialchars() + ent_quotes + UTF-8 str_replace '<' '>' users ...
8
votes
2answers
15k views

DOM Based XSS attacks: what is the most dangerous example?

I knew that XSS attacks (“non-persistent” and “persistent”) can hijack user session, deface websites, conduct phishing attack, etc. However, I can't understand what is dangerous of DOM Based XSS if ...
0
votes
1answer
164 views

Inject JavaScript code into websites requested by an Android app? [closed]

How can I add custom scripts to pages I'm opening on Android via Chrome, Firefox or any other internet browsing app?
3
votes
3answers
8k views

Cross site scripting prevention removing &lt and &gt

I'm testing an application that only skips < and > symbols. The user input being validated is always inserted between html tags like <b>, <span>, <div>, etc. and never passed ...
0
votes
2answers
280 views

XSS alert not working with concatenated string

I've noticed that the following Stored XSS does not execute, whereas in the JS console it works: <img src=0 onerror=alert(document.domain+": "+Date.now())> This doesn't prompt an alert box. ...
0
votes
1answer
236 views

Reflected XSS in multiline script block

I am trying to exploit a reflected cross site scripting in a GET request where the reflection is in the first multi line script block. It seems I can use every character but <, > and " and the ...
0
votes
1answer
951 views

How does OWASP ZAP find Reflected XSS?

What I'm doing: I'm using OWASP Zap to find vulnerabilities in a site (I have the owner's consent) and Zap came up with a Reflected XSS Vulnerability after I did an active scan on a POST request. It ...
1
vote
1answer
541 views

Bypassing XSS filter replacing characters?

Is it possible to bypass an XSS filter that replaces the malicious characters? I've prepared this filter: searchTextField.replace(/</g, " ") .replace(/>/g, " ") .replace(/"/g, " ") ...
1
vote
1answer
1k views

XSS and XXE payload in XML attributes value

I am testing web application with functionality of file upload. The only possible file format is XML. The content of the file saved in XML attributes is then presented on the separate page. For ...
0
votes
2answers
126 views

Can an xss vulnerability without authentication be exploited?

I am confused about the attack surface made possible by an XSS vulnerability. Suppose I have a simple web application that does not involve authentication (perhaps a "word of the day" kind of thing). ...
1
vote
0answers
299 views

Understanding XSS

So, I am trying to understand how XSS works and I gathered some information online and crafted the code. Following is the snippet. When I enter some value in the text field and submit, the script ...
1
vote
2answers
208 views

Do browsers XSS filters protect against DOM based XSS?

Many (but not all) browsers come with built in XSS protection that can be activated with a HTTP header: X-XSS-Protection: 1; mode=block As I understand it, it prevents reflected XSS attacks by ...