Skip to main content

Questions tagged [xss]

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

Filter by
Sorted by
Tagged with
4 votes
1 answer
6k views

Is it safe to use font-src with data: in a Content Security Policy?

I'm currently experiencing an issue where base64 encoded fonts are being blocked by CSP on my website (note that I replaced the base64 with abcdefg in this example: Refused to load the font 'data:font/...
x3nr0s's user avatar
  • 143
1 vote
0 answers
279 views

HTML tags converting into entity characters in XSS [closed]

When I type xss in a search box, it's reflecting and when I inspect it, it's showing as <h1>Search results for: xss</h1>. So I tried to inject script <img src=x onerror=alert(1)> and ...
Noob Hunter's user avatar
3 votes
2 answers
1k views

XSS in a href with target=_blank

I have found out that in most browsers the following code won't execute: <a href="javascript:alert(1)" target=_blank>click</a> But the same code without blank will. My question ...
The Modern Gamer's user avatar
1 vote
1 answer
146 views

JS bug is stopping my xss payload to exeute

The XSS vector is at the * but the function issue_type is not declared hence my payload is not getting executed. following is the instance of the vulnerable code:- <select name="sub_subissues&...
joao silva's user avatar
1 vote
2 answers
537 views

Reflected XSS detected by Burp Suite not working

Burp Suite detected a reflected XXS, if I use the Repeater and send the request the payload shows up in the response unfiltered, but if I visit the url it gets filtered, is there a way to bypass it or ...
Samuele Giovanetti's user avatar
0 votes
1 answer
616 views

XSS bypass in url

I have a website: https://bugbounty.com/test/"injection inside js", but " is escaped with \ and I'm trying to inject </script><script>alert() but https://bugbounty.com/test/&...
Edward Akina's user avatar
1 vote
2 answers
760 views

xss: is it possible to continue javascript code execution after a "throw new Error()" line?

there is this javascript file that a can inject code after throw new Error("error string") line. But it seems that after the throw statement, no code can be executed. throw new Error("...
nv92Cczb1's user avatar
1 vote
1 answer
239 views

How is a XSS attack possible in this context?

I'm testing a website, which is vulnerable to XSS. <input type="hidden" id="referer" name="referer" value="INJECTION_POINT"> <script> document....
Hyper's user avatar
  • 11
1 vote
0 answers
553 views

force XSS after bypassing Request.Form using URL Encoding

I am testing a cross-site scripting attack on a website, as we all know the Request.Form function validates the input so the user couldn't insert a <script> inside the input. My focus in this ...
syk's user avatar
  • 11
1 vote
0 answers
100 views

Understanding browser text input value rendering for combatting XSS

If you use inspect in the developer tools for Chrome the values for the two input boxes below will look the same. <input name="test1" type="text" value="<script>alert(...
tony's user avatar
  • 111
1 vote
1 answer
1k views

How to alert cookie in 30 character XSS payload?

The application allows user to enter a 30 character long username. I tried the following XSS payload and it worked, but the triager is asking if I can alert cookie. But script tags and src keyword is ...
alisa's user avatar
  • 11
0 votes
1 answer
198 views

Validating XSS script with success response with expected data in REST API

I am performing security testing on a REST API and it is a POST method. I injected an XSS script in a body parameter and the API responded with '200 success' response with the actual expected data. If ...
sowmiya's user avatar
1 vote
3 answers
2k views

What exactly are Hidden HTTP Parameters?

I read a lot of reports where 'hackers' potentially exploited a 'Hidden HTTP Parameter'. There are also tons of tools which are developed for this exact purpose. Example : https://blog.yeswehack.com/...
Just.a.tech's user avatar
0 votes
2 answers
359 views

What are the risks of XSS in this forms?

I recently developed a website that was operational for me ^^ However, someone came to try injections and found an XSS flaw. I have a form like this: <h2> <span>Search</span> </...
Lynow's user avatar
  • 1
0 votes
1 answer
112 views

Why do you think this code isn't firing?

I don't have a lot of knowledge about xss so im kinda confused, why this is not popping up an alert box?
fiirat's user avatar
  • 1
0 votes
0 answers
26 views

I clicked what looked like an Amazon email, but it (maybe) was from an Amazon affiliate. Ended up at Amazon.com anyway. Can I safely investigate? [duplicate]

In a case of clicking too fast, I clicked on a picture that looked like it was from Amazon. However this was not the case. I did end up at Amazon, but I'm aware that other things could've taken place ...
Moochcar's user avatar
0 votes
1 answer
191 views

How do browsers defend the user against XSS?

I'm learning about the different mitigations employed by browsers against XSS vulnerabilities. Let's say, the developer made a mistake and there is a XSS vulnerability on a site. Unfortunately, a ...
Loresim's user avatar
1 vote
1 answer
504 views

Jsoup XSS attack with URL encoded input

I'm having a Spring Web Application that exposes REST APIs. I have implemented XSS filter using Jsoup that strips the input using Safelist.NONE. The penetration testing team raised a concern where the ...
Yuval Simhon's user avatar
1 vote
0 answers
121 views

Storing auth token in html

Current projects webs application utilises a cookie based approach to store users auth token. Implemented with secure and http-only attributes set. All traffic over https. The application loads third ...
Sam's user avatar
  • 11
1 vote
0 answers
589 views

Client-side Javascript injection by assinging the output of window.location.href.substr to a variable

Sample code: function winLoad() { var sessionId = ''; if (window.location == window.top.location) { var semicolonIndex = window.location.href.indexOf(';'); if (semicolonIndex !=...
jne's user avatar
  • 11
2 votes
1 answer
361 views

Can I use a ServiceWorker to prevent an XSS attacker from gaining access to private user data?

I run a small blogging platform, and I want my users to be able to embed javascript that runs on their blogs (to manipulate the DOM, etc. as you might if you were hosting your own website). However, I ...
bennlich's user avatar
  • 125
0 votes
1 answer
836 views

Vulnerabilities in img src

It is known that in modern browsers you can't run XSS in img src(assuming quotes are escaped), because neither javascript: protocol, nor svg will execute the code. But does it mean that trusted data ...
The Modern Gamer's user avatar
3 votes
2 answers
722 views

Can someone bypass this XSS filter

During our Red/Blue team practice my friend made a web forum application where people can post messages. What he did was filtering: The equal sign The key words: "javascript", "alert&...
rudeus123's user avatar
0 votes
1 answer
210 views

XSS in location.hash.match() function

I was solving a CTF. Just reading the source code of the web page, I found a vulnerable piece of code: var r4c='(.*?)'; var results = location.hash.match('token\\('+r4c+'\\);'); I am unable to ...
yaman jain's user avatar
0 votes
0 answers
183 views

Adding a script tag after the html closing tag

I am still a beginner in web vulnerability. While I was browsing on the internet I saw a challenge inspired by a real life security crisis. We are given a pcap of a malware infection that was done in ...
RudeusGreyrat's user avatar
0 votes
1 answer
116 views

How secure is using https://*.domain.com as a value in a Content Security Policy?

Let's say I am an organization with all my resources on example.com. I have a web server in the DMZ that hosts a website named app.example.com open to the internet. The CSP for that website is Content-...
Sky's user avatar
  • 1
0 votes
2 answers
639 views

Check for special characters in request parameters

Our system is accepting requests including special characters, see parameter2. Request [ { "reqHeader": { "parameter1": "abc", "...
abc123's user avatar
  • 111
0 votes
2 answers
349 views

AES Encryption as XSS protection for url parameters?

So, I found a website that uses AES encryption to prevent XSS and I'm wondering if this approach is inherently flawed. It has an endpoint like execute.php?code=encryptedPayload which de-crypts the ...
xsrf's user avatar
  • 178
2 votes
1 answer
172 views

Should I worry about excessive data forgery from my users on Firebase?

I'm getting familiar with Firebase and the firestore database. I have a small project relying on a certain data format. It is a simple React project with direct connexion to its firestore, so no back-...
Lewis's user avatar
  • 23
2 votes
2 answers
306 views

What could go wrong with this inlined javascript variable initialization in ASP?

I am currently reviewing an ASP application where this javascript initialization is used all over the place: const someValue = "<% get_some_value() %>"; And this pattern is actually ...
Anis LOUNIS aka AnixPasBesoin's user avatar
1 vote
0 answers
156 views

What are the ways in which XSS can be done in innerHTML

Server has blacklisted <img> and <a> tags in input. Server does: var myvar = url.searchParams.get('query')) document.getElementById("id").innerHTML = myvar <img> and <a&...
CodeTalker's user avatar
1 vote
0 answers
391 views

Possible window.location.hash DOM XSS

I've recently gotten into web security and javascript and I think this looks like apretty promising DOM XSS: let hastagIntentos = 0 , posAnterior = 0 , reintentosHatagPos = 0; function ...
Henktorius's user avatar
2 votes
1 answer
144 views

Should I call a vulnerability XSS even though it is blocked by the CSP?

Let's say the Content Security Policy looks like this: Content-Security-Policy: default-src 'self'; It's also not possible to upload JS files on the same origin. Now there's an exploit to write ...
Jonas's user avatar
  • 23
2 votes
2 answers
2k views

String in JSON message body blocked by Azure WAF with OWASP 3.1 returning 403

Details I have an application running behind an Azure Web Application Firewall (WAF) on an Azure Application Gateway (AppGW) that was previously on an on-premises server. Since moving it to Azure, ...
FilBot3's user avatar
  • 123
0 votes
3 answers
1k views

What XSS attacks could somebody perform through an iframe?

If a potential attacker was able to upload a cross-origin <iframe> element to your website as a post of some sort, what could they actually do through it? I know that cross-origin <iframe> ...
Blue Herring's user avatar
2 votes
1 answer
710 views

Can the value attribute of input tag be a DOM-XSS sink?

Can at this code the input.value be a Dom-XSS sink? let qs=new urlsearch(location.search); let paramValue=qs.param; let input=document.getElementByID('inputField'); input.value=paramValue; I tried ...
Mouhannad Al-Hmedi's user avatar
0 votes
1 answer
929 views

XSS in href attribute

I'm currently pentesting a website where I can set a URL on my profile. I'm trying to get an XSS to fire, but my javascript knowledge is a bit limited for this use case: Imagine this is your ...
ex7lted's user avatar
  • 50
1 vote
1 answer
319 views

Is this code code vulnerable to XSS?

I have a function that accepts the param url and passes it to exec() function getQueryValue(url, name) { name = name.replace(/[\[]/, "\\[").replace(/[\]]/, "\\]"); var ...
Tikiyetti's user avatar
  • 135
1 vote
1 answer
465 views

Reflected DOM XSS Portswigger Lab

I'm a total beginner and im trying to solve Portswigger Academy labs. I'm studying on XSS right now and im stuck in somewhere. Lab Details:This lab demonstrates a reflected DOM vulnerability. ...
kgngkbyrk's user avatar
0 votes
1 answer
319 views

Can you have an <iframe> tag with no spaces?

I am looking to figure out how to create an iFrame tag without any spaces. I have found an input on a Bug Bounty program that reflects my input back into the page, and allows me to escape double ...
ex7lted's user avatar
  • 50
0 votes
1 answer
413 views

XSS payload to Send request to server without closing tag

I was testing a website which does not have XSS in their scope. So I thought it would be a good idea to escalate XSS to a bug which is valid. I need to make a request to my server but the problem is ...
SomeoneAlt-86's user avatar
1 vote
2 answers
1k views

Difference Between Reflected XSS and Reflected-DOM XSS

What's the difference between Reflected XSS (RXSS) and Reflected-DOM XSS (RDOMXSS)? After some research, I think it can be concluded that Reflected-DOM XSS is: Similarities: The value is reflected by ...
NoPurposeInLife's user avatar
1 vote
1 answer
3k views

"One of your code blocks includes unescaped HTML." JS console security warning

I operate a blog using Google's Blogger platform about programming. I use highlight.js for syntax highlighting, and now on my posts I see the console warning: One of your code blocks includes ...
christian_js's user avatar
2 votes
3 answers
858 views

Can I visit a malicious website by using Tor with settings set to safest or by using NoScript on an ordinary browser with settings set to untrusted?

Can I visit a malicious website by using Tor with settings set to safest or by using NoScript on an ordinary browser with settings set to untrusted? If not then is there any way to visit a malicious ...
User4857's user avatar
1 vote
0 answers
2k views

Checkmarx Client DOM XSS Violation in ReachJS

I have this message from Checkmarx: The application's = embeds untrusted data in the generated output with location, at line 19 of ****.js. This untrusted data is embedded straight into the output ...
Reis's user avatar
  • 111
2 votes
2 answers
3k views

Reflected XSS found in web application via POST request with JSON body. Is this issue exploitable?

I was testing an application recently and i came across with a Reflected XSS vulnerability via HTTP POST Request with JSON body. Although this condition can't be exploitable from his own, due respond'...
NeCro's user avatar
  • 25
1 vote
1 answer
151 views

Risk of injecting a malicious script/code?

I was was inspecting elements in a website and I randomly stumbled onto this piece of code . </style><meta name="add-styles-here"/><meta name="add-scripts-here"/>&...
Zorghost's user avatar
-1 votes
1 answer
1k views

Is there any way to bypass javascript comment filtering (XSS)

So I am testing an application and I almost got an XSS vulnerability but only if I can comment on the rest of the code. e.g. Originally this is how the target returns the user-entered input: I've ...
dipansh's user avatar
  • 103
1 vote
0 answers
276 views

Need for URL encoding in XSS / CORS lab

I am doing one of Portswigger's labs on web security, specifically CORS (cross origin resource sharing). I am having trouble understanding why there is a need for URL encoding certain parts of the XSS ...
Voyyce's user avatar
  • 11
0 votes
1 answer
277 views

Is it possible to get xss in json body request?

I was doing a VAPT assessment in which I see some JSON body in the request which has orgid deviceid So there any possibility to get XSS in json body?
B3ingN00b's user avatar

1
2
3 4 5
31