Questions tagged [xss]
Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).
1,497
questions
1
vote
1
answer
95
views
Risk of injecting a malicious script/code?
I was was inspecting elements in a website and I randomly stumbled onto this piece of code .
</style><meta name="add-styles-here"/><meta name="add-scripts-here"/>&...
- 23
-1
votes
1
answer
375
views
Is there any way to bypass javascript comment filtering (XSS)
So I am testing an application and I almost got an XSS vulnerability but only if I can comment on the rest of the code. e.g. Originally this is how the target returns the user-entered input:
I've ...
- 3
1
vote
0
answers
119
views
Need for URL encoding in XSS / CORS lab
I am doing one of Portswigger's labs on web security, specifically CORS (cross origin resource sharing). I am having trouble understanding why there is a need for URL encoding certain parts of the XSS ...
- 11
0
votes
1
answer
112
views
Is it possible to get xss in json body request?
I was doing a VAPT assessment in which I see some JSON body in the request which has orgid deviceid
So there any possibility to get XSS in json body?
3
votes
1
answer
965
views
Can a plain text email contain XSS injection?
I need to send a plain text email with user-specified input.
For example, if a user is an attacker a plain text email can contain
<script>alert(1)</script>
It looks like mail clients ...
- 33
0
votes
2
answers
127
views
Parameter vulnerable for HTML injection but cannot exploit because of URL encoding
I found a HTML injection vulnerability but there is an issue.
The following request returns the following:
curl "https://redacted.com/xss/para?meter="><h1>Test\</h1>"<...
- 11
0
votes
1
answer
69
views
How does this PortSwigger lab's XSS work?
I was doing the following PortSwigger Lab on cross site scripting (XSS).
The following payload works perfectly.
http://foo?'-alert(1)-'
Which is input into the following section of ...
- 181
1
vote
1
answer
205
views
Can BeEF also work in public?
Is it possible to run the tool called BeEF to do penetration testing on real domains like example.com? As far as I know, BeEF can only be used within localhost.
I can only test my site for XSS on the ...
- 11
0
votes
1
answer
449
views
XSS against jQuery PortSwigger challenge
I am trying to do this jQuery XSS challenge here by PortSwigger.
They have a good walkthrough for XSS attacks, however I could not find anything on jQuery, which is also a programming language I have ...
- 181
0
votes
1
answer
76
views
Is this SQLi or XSS? (or both/neither)
I'm trying to get the hang of SQLi and XSS, and I am starting to get the hang of it.
However: in my lab I made this:
ignore'"; UPDATE users SET name=<script>alert('Malicious activity')</...
0
votes
1
answer
968
views
Bypass double quotes " transformed to "
I'm having a hard time bypassing "
I tried every payload but nothing happened. The payload is
"><img src="data:xxx1" style='aaa: '\"/onerror=alert(1)//'' />
But ...
4
votes
1
answer
614
views
Security Headers: Access-Control-Allow-Origin vs. Cross-Origin-Resource-Policy (CORP)
Can someone explain the difference between the Access-Control-Allow-Origin header and the Cross-Origin-Resource-Policy header?
According to MDN:
The Access-Control-Allow-Origin response header ...
- 41
1
vote
2
answers
7k
views
XSS: window.location.href and window.open
I'm working through all issues that the static security analysis tool Fortify found in our internal Angular application. There is one particular issue I'm not confident of how to work with. Please see ...
- 125
0
votes
0
answers
39
views
How to turn a relative path script (js) import to an absolue one with a url for XSS ? (more details below)
I have a parameter whose value is injected in the HTML as the following
<script src="/dir1/dir2/dir3/dir4/INJECT_HERE"> </script>
I was able to traverse back to just / but when ...
0
votes
1
answer
248
views
How does this break out of a javascript tag? [closed]
How does putting the alert function '-alert(1)-' into a search field, where it ends up inside a script tag actually break out of the script string?
Wouldn't this just be interpreted as an empty string ...
0
votes
0
answers
50
views
What are vulnerabilities of saving user input directly in wordpress plugin?
I have a WordPress plugin that helps create an organization chart/tree and then generates a URL where the chart is available to be viewed by the public.
The plugin dashboard looks like this
the plugin ...
0
votes
2
answers
91
views
What are the vulnerabilities of exposing url end point param?
I have a wordpress plugin that helps create an organization chart/tree and then generates a URL where the chart is available to be viewed by the public?
Inside the plugin's view in WordPress dashboard....
1
vote
1
answer
297
views
Why is this XSS not working on my site?
I'm attempting to make a site with an example of what XSS would look like, so in this I take user input and set a paragraph element's innerHTML to the user input but the script isn't running. However ...
- 13
0
votes
1
answer
53
views
HTML Injection into custom sanitiser
I found a curious website that shows listings. It allows you to type a description, and also allows for you to use tags like <b> and <u> for formatting.
But it doesn't let you do more ...
- 101
0
votes
0
answers
17
views
Threat Assessment Javascript User-controlled Variable Names on Window
I have a requirement to support some external integration to a 3rd party vendor on our site (which is a SaaS site with multiple tenant logins). The vendor requires a script and a global variable to be ...
- 101
0
votes
1
answer
87
views
IP address in access.log is incorrect and likely hacked
I just noticed in my access.log several POST requests coming from a (hidden) registration sub page that is not accessible via any link. A 'hacker' seems to have posted a form from there (manually it ...
- 103
1
vote
1
answer
429
views
XSS - Anyway to bypass double quotes in href of anchor?
I have an anchor that has href attribute populated by my input. I am trying to input javascript, but it always renders it useless since it always appears between double quotes.
So far, I have tried ...
- 111
0
votes
0
answers
111
views
Headers X-XSS-Protection issue
I want to clear my doubt that Is there any issues coming from adding 'Strict-Transport-Security' and 'X-XSS-Protection' headers ?
Header set Strict-Transport-Security "max-age=10886400;
Header ...
2
votes
1
answer
457
views
Is PHP json_encode sufficient for HTML data blocks?
I want to access data in a PHP variable from JavaScript code. An (old) OWASP cheat sheet recommends embedding it in HTML before accessing it, an approach like this:
<div id="init_data" ...
- 146
1
vote
0
answers
403
views
Security implications of access and refresh tokens (JWT) with refresh token rotation and automatic reuse detection
In an effort to avoid having to deal with CSRF attacks, I'm trying to implement an auth flow that completely avoids using cookies. In most cases this makes one vulnerable to XSS attacks. However, ...
- 111
1
vote
1
answer
73
views
Is there a consensus on whether HTML encoding should happen upon upload or retrieval/display for defense against stored XSS?
The common thing to do in defense against XSS, stored or not, is to HTML-encode the payload. Encoding upon the upload/POST of the data is efficient for processing power and neutralizes it early to be ...
- 3,472
0
votes
0
answers
255
views
Mitigating CSRF and XSS with JWT authentication: can someone tell me where my logic is wrong
I'm currently working on a personal project including a RESTful API and also trying to understand how to make it as secure as possible. I have read a bit about JWT, the possible vulnerabilities as ...
0
votes
1
answer
120
views
Is this safe from XSS?
I need to allow a user to pass unsafe text into an iframe URL:
<iframe src="https://example.com?foo=INPUT"></iframe>
Inside the iFrame render code, I have this:
<!doctype ...
- 105
0
votes
1
answer
115
views
How do double quotes and angle bracket work in this scenario?
Question about a solution in portswigger academy (since portswigger explains nothing and I can't find any info elsewhere on this):
Break out of the img attribute by searching for:
Here is the img ...
0
votes
1
answer
57
views
DCP-Portal Vulnerability
This vulnerability is from a third party reviewer for PCI scans. I am stuck for months and can't figure this out. I already used sanitation to my page and it still fail the PCI scanning. I am starting ...
- 1
0
votes
0
answers
101
views
Failed to inject payload with Python requests library in DVWA forms
I have written a Python script to inject a payload through the requests library, but the payload is being added instead of injecting
xsstestscript=html.unescape("<script>alert&#...
- 1
1
vote
0
answers
739
views
XSS Payload Cookie Stealing
I have been playing around with the DVWA stored XSS page and wondered if someone could help.
I used XSS Validator in Burp and found numerous payloads that give a prompt, indicating that XSS is present....
- 11
0
votes
1
answer
217
views
JSON Web Token splitting
It's been quite a few years since the last time I did web development and I realized many things have changed: instead of stateful server-side sessions with authentication cookies and CSRF tokens now ...
- 434
0
votes
1
answer
384
views
XSS attack not executing with correct payload
Hello I was testing on a private program where I was able to inject XSS but for some reason it is not popping up when I put the mouse over the input field.
<input type="text" onmouseover=&...
1
vote
0
answers
214
views
CSRF and XSS Protection with a Static Site and REST API
I'm building an application which will support both browser and application access to REST resources.
Applications will POST a username/password JSON body to a login endpoint which will return a ...
- 6,745
2
votes
1
answer
1k
views
Can XSS ever occur in an <img> tag's "src" attribute?
In a scenario where an attacker has control over the src attribute of an img HTML tag, they could easily inject a simple JavaScript XSS payload like the following:
<img src="javascript:alert(1)...
- 123
2
votes
1
answer
162
views
Is this server side object vulnerable to XSS?
I have an object that is stored in the server side of the application. It is never inserted into the DOM. The object looks like this:
{"id": "34245425", "field": false, &...
- 31
0
votes
2
answers
996
views
How is Object Tag data URI XSS actually XSS?
I have been looking into XSS pertaining to base64 encoding a data URI into an <object> tag (which is typically considered only a feasible XSS payload in Firefox), but I am failing to understand ...
- 3
1
vote
1
answer
704
views
JWT cookie with CSRF token as a claim inside the JWT
I am trying to figure out if the solution I am suggesting is valid for both XSS & CSRF protection,
I would like to store the JWT in an httpOnly & secure cookie and not in local storage,
when ...
- 113
0
votes
1
answer
256
views
How do I test for Reflected XSS in webpage titles, url parameters and javascript variables?
I have a java web app. I'm using OWASP Java Encoder to encode for html, javascript and url components to mitigate reflected XSS. I'm new to this so I'm not sure on how to test on my web app for the ...
0
votes
1
answer
527
views
How to test an Angular SPA for DOM XSS with OWASP ZAP?
I want to test an Angular SPA for any DOM-based XSS. How do I do that with OWASP ZAP?
- 1
1
vote
1
answer
920
views
How to implement the CSRF token mechanism for restful APIs?
Considering the following facts, using CSRF token for a restful API (which of course is intrisincly session-less) seems inevitable:
storing JWT in local storage(any where other than http-only cookie) ...
- 113
0
votes
1
answer
446
views
HTML Option Tag XSS
Is it possible to inject javascript inside of an HTML option tag?
For example, say you have the following html:
<select>
<option MALISCIOUS_CODE_HERE>Option Description</option>
&...
- 103
0
votes
1
answer
213
views
Detecting XSS when Payload is only Triggered on Another Page
I am trying to detect the presence of a blind/stored XSS vulnerability of an input field. The vulnerability does not trigger on page 'A' where the payload is injected.
It is likely due to the fact ...
- 101
1
vote
2
answers
884
views
Bypass WAF to perform XSS?
I am trying to find an XSS in website protected by Cloudflare. I use Burp to find which HTML tags allowed.
Only the <script/> is tag disallowed. I tested multiple payloads to pass the WAF and ...
- 111
0
votes
1
answer
233
views
Could this code be vulnerable to XSS?
It seems like exploiting XSS is becoming harder with every browser version update.
My question is: Is this code vulnerable to XSS?
<script type="text/javascript">
var url = ...
2
votes
1
answer
436
views
What can attacker do with OpenID Connect id_token?
I have an application that stores the id_token in the localStorage of the browser.
Since there is no CSP and Web Storage does not have the same protections such as cookies (HttpOnly, SameSite) this &...
- 68
0
votes
2
answers
400
views
XSS payloads getting filtered but HTML tags are getting rendered. Can we exploit this? [duplicate]
I was trying to test a potential XSS vulnerability on a website. On the search bar I can see the filtering process happening i.e if I type script> (not with starting <) I can see the same in the ...
2
votes
1
answer
1k
views
Is <plaintext> vulnerable to XSS
I have a question regarding the element. I know that this element has been deprecated for a long time, but during a penetration test, we inserted the following attack vector into a textarea:
<...
- 129
1
vote
1
answer
6k
views
XSS in <span> where only < and > are encoded
When im doing a penitent, I noticed the application takes the user input and put it in a tag. When I used the string of '';!--"<XSS>=&{()}, I noticed the returned output (when viewing ...
- 21