Questions tagged [xss]
Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).
1,496
questions
2
votes
1
answer
416
views
XSS inside of a javascript string, with unusual filter
While making a website I made an interesting mistake, and I'm wondering if this could be used to achieve XSS. I've come very close, but not quite.
I can put my user input into a string inside of a <...
- 123
1
vote
2
answers
259
views
abiliity to change elements in HubSpot iFrame forms
I recently started working on adding custom code to HubSpot forms after their form is loaded via an iFrame. Initially, I was using the following code to access the iFrame to change it:
var form = ...
- 113
0
votes
1
answer
206
views
XSS Triggers only when pasted in
I have a XSS case that I would like to exploit as a proof of concept, however the payload seems to only be triggering when pasted in and not from the URL.
Basically, I have a search box which when ...
- 1
0
votes
1
answer
6k
views
How to bypass an XSS filter encoding single quotes? [duplicate]
I'm trying to do an XSS attack test on a website.
I am using " and <> just fine and I have managed to escape the string. Now I'm trying to send my own cookie to my server that saves it to a ...
- 3
7
votes
1
answer
4k
views
Passing a C# object to Javascript in ASP.NET MVC
Several answers on StackOverflow suggest that a C# object can be passed to JavaScript in ASP.NET MVC by the following:
<script type="text/javascript">
var obj = @Html.Raw(Json....
- 28.9k
13
votes
2
answers
4k
views
How do I safely host third-party Javascript code in an iframe?
I'm building a website where users, among other things, can add embeds (YouTube, Google Forms, Airtable...) and show those embeds to other people. Embeds are snippets of HTML that can include <...
- 243
0
votes
0
answers
567
views
Stored XSS cookie stealing, but a loop of redirection
I found a stored xss vulnerability on a comment section of a fun site and I wanted to steal cookies using xss attack.
So on my remote server I run an HTTP server with Flask using python where there is ...
0
votes
1
answer
325
views
Securing a Websocket Connection in case of XSS Vulnerability
Goal
Authenticate the Client via HTTP Request.
Authenticate the Client's WebSocket connection.
Prevent exploitation of WebSocket connection(when a XSS Vulnerability is present on website).
How I'm ...
- 3
0
votes
0
answers
87
views
Taking html, js, css input from the user
We are building a multitenancy web app with Laravel (+Blade), each user can create a store (tenancy), and have a control panel where they can edit the store settings and styling, to edit the store ...
- 101
0
votes
1
answer
368
views
Flask XSS prevention
I'm trying to fix a possible XSS vulnerability in WebApp (Flask) and I'm not sure what is the best way to prevent XSS without breaking functionality. For example, I have the following code block:
... ...
- 3
0
votes
0
answers
292
views
Exploit an XSS without <> and valid encoding
I'm making a web penetration test, so I trying to exploit a XSS, I've looked that if I use a payload like the following:
<script>alert(document.domain)</script>
The output in the page ...
0
votes
1
answer
268
views
Is it still XSS if it requires user input?
I have a web app which displays what I enter in an <input> field back as HTML, but it happens all client-side in the DOM after manual input, so it can't be made into a URL which causes a payload ...
5
votes
1
answer
2k
views
Is it better to disable X-XSS-Protection header or set the header as X-XSS-Protection: 0?
Because X-XSS-Protection header is now not supported by major browsers I wonder what option is better, to delete this header or to set the header as X-XSS-Protection: 0?
Because browsers do not ...
- 1,233
0
votes
0
answers
1k
views
How to reliably detect Browser Exploitation Attacks with BeEF and other JavaScript hooking packages?
"Unlike other security frameworks, BeEF looks past the hardened network perimeter and client system, and examines exploitability within the context of the one open door: the web browser. BeEF ...
user264116
0
votes
2
answers
5k
views
read etc/passwd using XSS
by trying the XSS room on THM, I try was trying to read the /etc/passwd using the following cmd:
<iframe src="/etc/passwd"></iframe>
However what I got is an error code as shown ...
- 103
2
votes
1
answer
153
views
Does this qualify as Filename Upload DOM-XSS?
An application has the following javascript code which is triggered whenever an user tries to upload a file.
a.html(fileName)
then if the user uploads a file named <img src=x onerror=alert()> ...
- 557
1
vote
0
answers
1k
views
NodeJS, unrestricted file upload, RCE [closed]
I'm testing on application which runs on NodeJS, and discovered unrestriced file upload vulnerability, path traversal is not possible.
Uploaded file is visitable, I can upload .html to perform XSS ...
- 11
0
votes
2
answers
1k
views
Prevent URL encoding on form submit
During an engagement, I found a potential XSS vulnerability on a page. There is an HTML form that is submitted to this page (POST method) and sent parameters are reflected (without encoding) in the ...
- 271
0
votes
1
answer
293
views
is XSS in Content-Disposition possible?
There is a web application that can upload HTML files and also download the uploaded file.
When I upload an HTML file containing the script tag and download it, the response is as follows.
HTTP/1.1 ...
-1
votes
1
answer
171
views
XSS Inside the text part of an <a> tag [closed]
How do I xss inside <a href="https://gooogle.com">here</a> ? I have tried normally using alert() but it didn't work
- 21
0
votes
1
answer
303
views
DOM-based XSS - via URL
I have a website that I am testing but I am pretty new to all of this security stuff and would appreciate some help!.
I have a url similar to the following:
http://testurl?nexturl=whatever
The ...
0
votes
1
answer
246
views
Is it possible to bypass this csp?
Today I created a web application. I'm using this csp to avoid xss attacks. CSP: Content-Security-Policy", `child-src 'none'; connect-src 'none'; default-src 'none'; font-src 'none'; frame-src '...
- 21
2
votes
2
answers
3k
views
How do I bypass a regex filter that filters all html to avoid xss?
How do I bypass a regex filter that filters all html to avoid xss? I've tried using things like <img src="aa" onerror="alert(1)"> but still no luck. This is for a CTF ...
- 21
1
vote
1
answer
1k
views
srcdoc attribute of iframes as a source of XSS attacks
I am trying to implement a case where a user provides us some html code which is then stored in our database. We then retrieve the HTML from our database as a string. (We have no control over the user ...
- 11
0
votes
2
answers
195
views
Is this potential XSS exploitable?
I am pentesting a website and I found that I can inject code at value=""
<input type="text" id="search_1" name="keyword" placeholder="Search by keyword&...
- 21
0
votes
0
answers
128
views
Injection inside double quoted section of script element
For a test to find vulnerabilities I found the following code in a page and I am looking for ways to manipulate it:
<script>
func({
"key1": "value",
"...
- 1
1
vote
0
answers
124
views
Attack on a string created by a developer
Go and Java have "compile time constants", and JavaScript will soon get a feature that allows "Distinguishing strings from a trusted developer from strings that may be attacker ...
- 111
6
votes
2
answers
1k
views
Content Security Policy https: and data: meaning
I am having trouble finding information on the implications of using https: and data: as a source
for the directives in a CSP.
Example:
img-src 'self' https: data:;
Could someone some context around ...
- 177
1
vote
1
answer
246
views
Found XSS in chat form in bug bounty but they say it's only self XSS. How to leverage it? [closed]
I have found an XSS bug in a chat form on a bug bounty target. When I enter in the chat form input <button onclick="alert(1)">click</button> and after that I click the button a ...
- 31
1
vote
1
answer
1k
views
Bypass input validation
I'm trying to create a vulnerable sandbox environment for pentesting challenges. As part of the challenge, I want to include some elements of XSS or SQLi if possible. However, I do not wish to make ...
- 15
2
votes
0
answers
741
views
Progressive web app, Access token storage
I'm currently working on an existing PWA (Progressive web app) build in VUEJS. Currently i'm using Auth0 for user authentication and it works fine. But it seems a bit overkill and client finds it very ...
- 21
0
votes
1
answer
337
views
XSS Payloads: <script> vs javascript:
Hello I was experimenting with XSS payloads and couldn't help wonder the syntax for
javascript:alert(0)
The most basic payload for XSS makes sense, since the tag is used for JavaScript in HTML.
<...
2
votes
0
answers
708
views
Implementing Checkmarx suggested clickjacking fix introduces high severity Client DOM XSS vulnerability
My organization has scanned our code using Checkmarx and the low severity issue Potential Clickjacking on Legacy Browsers was detected due to a JavaScript function firing on an HTML image click event.
...
- 21
0
votes
1
answer
120
views
Is every plain flow into a dangerous sink exploitable?
Given a flow of information (for example from the URL) into a sink on a certain site, and given that this information is plain, i.e. is not sanitized, does this mean that if an attacker could control ...
- 13
1
vote
1
answer
389
views
Can an Intrusion Prevention System (e.g. Snort) prevent CSRF and XSS attacks?
I am currently learning about IPS and was wondering about a query that applies to how IPS works. I have knowledge of CSRF and XSS attacks, however I am unsure if Intrusion Prevention Systems can ...
- 23
1
vote
1
answer
195
views
Which cookies can xss have access to
I clicked on a link in my android phone and I don’t know if it was an xss or not. I want to know that in the case of an xss attack, can the hacker access my whole cookies or just the cookies that ...
- 21
1
vote
1
answer
147
views
How to confirm if it's a case of XSS
On a training website where instructors can create Q&A exams for their students, an instructor put a question about XSS. Part of the question was http://abcd.com/options#<img src=1 onerror=...
- 626
0
votes
0
answers
291
views
XSS with Java to get User Cookies
I am practicing some XSS on a vulnerable apache2 web application and having some issues getting the user's cookie information.
I am following the instructions in this Lab for the XSS Attack.
We are ...
- 1
0
votes
2
answers
141
views
Safely creating script tag and attaching to DOM
I have a need to to create and attach a script tag to DOM at runtime.
The script is a remote webpack bundle (via a Module Federation plugin). I would like to be able to change the URL to that hosted ...
- 111
0
votes
0
answers
32
views
What you can do with XSS attacks [duplicate]
I am practicing in a website which is vulnerable to XSS so as to learn better this kind of attacks. I have managed to inject somewhere the usual <script>alert('XSS')</script> and it seems ...
- 21
0
votes
0
answers
248
views
XSS attack being blocked by the browser
I'm trying to validate / test and XSS attack; however when I navigate to the page, the browser (tried on Chrome and Edge) tells me:
A parser-blocking, cross site (i.e. different eTLD+1) script,
is ...
- 1
2
votes
1
answer
160
views
Is an XSS attack possible under these constraints?
The output is:
<img src="http://example.com/[input]" oncontextmenu="openUrl('http://example.com/[input]')">
Where [input] is the user input, which is sanitised through this ...
- 121
2
votes
2
answers
2k
views
Does escaping quotes in a HTML attribute context prevent XSS?
I'm learning about XSS and I found I can inject code in this tag a few days ago.
Tag:
<div id="pagenotfound" title='Cannot find /it/search/testtesttesttetst\'onload=alert(1)'>
My ...
- 21
9
votes
5
answers
5k
views
How to protect a <input type='password'/> from XSS?
Most sites having a sign in form have the following html element:
<input type="password" />
If I press F12 to open the debugger on chrome and type:
document.getElementByName("...
- 91
0
votes
1
answer
337
views
Validity of a WAF as a Compensating/Alternative Control for CSP, X-XSS-Protection, etc [closed]
I would like to know peoples' thoughts as to whether a WAF is a perfectly acceptable compensating/alternative control to things like CSP, X-XSS-Protection, etc. I know WAF is suppose to protect ...
1
vote
1
answer
203
views
Blocking reflected XSS on common web servers
How is it possible to block reflected XSS on common web servers, such as IIS, Apache HTTP Server and Nginx?
The Content-Security-Policy: reflected-xss filter doesn't work on latest Chrome and X-XSS-...
- 33
3
votes
1
answer
3k
views
Stored XSS Cookie Stealing - shortest payload
I'm testing a web app (for which I have permissions) and I found a stored XSS vulnerability.
It is a little bit tricky to exploit because the input:
is being capitalized
it has a length constraint of ...
- 133
0
votes
1
answer
243
views
Can this Javascript redirect be exploited in some way?
Since I can modify pathname, search and hash value could I leverages this in some way?
var URL = window.location.hostname+window.location.pathname + window.location.search + window.location.hash;
...
- 557
1
vote
0
answers
312
views
XSS strip tag bypass [closed]
I'm studying and I really need some help, I've this code:
$param1 = strip_tags($_GET['var2'], '<>');
I'm trying all kinds of things, like:
$_GET['var2'] = "Hello <img src=x onerror=...
- 11
15
votes
1
answer
5k
views
SQL injection inside XSS
Is it possible to perform an SQL injection inside an XSS attack?
And if so, where can I find information on this or some examples?
- 253