Questions tagged [xss]
Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).
1,496
questions
0
votes
2
answers
217
views
How much security should I use for my web application?
My question is, for a "normal" site, what do you think is enough to secure against methods used by "script kiddies"? For example, SQL injection, XSS, and stuff like that.
Same question for password ...
- 178
2
votes
2
answers
9k
views
Is this JSON encoding vulnerable to CDATA injection?
I ran across an odd notation in the jsfiddle.net generated pages
<script type='text/javascript'>//<![CDATA[
$(window).load(function(){
$('form, table').animate({
opacity: 1
});
});//]]&...
- 13.9k
1
vote
2
answers
23k
views
Bypassing XSS filters [duplicate]
Possible Duplicate:
New XSS cheatsheet?
Can anyone give me list of ways to encode XSS payload , or to be precise what are the ways to encode XSS payload to bypass encoding of <> or ().
I know ...
6
votes
1
answer
13k
views
Is this jQuery ajax call vulnerable to XSS?
If somebody can edit $("#field").val(), can they change the url property here to point to another location?
$.ajax({
url: "http://mywebsite/script?param=" + $("#field").val(),
dataType: "jsonp",
...
- 71
6
votes
3
answers
455
views
Is XSS dangerous on web without login/sensitive user's data?
Is XSS dangerous when the web application doesn't have a login/register function, the user isn't logged in or when the website doesn't store any sensitive user information?
- 163
12
votes
2
answers
8k
views
Is strip_tags() horribly unsafe?
I always use strip_tags to prevent XSS attacks, but today I saw a post which was telling it's horribly unsafe. As the manual says, it doesn't check for malformed HTML!
Is it true?
What can I do to ...
- 1,280
10
votes
3
answers
6k
views
How bad is a Self Contained XSS attack?
Some of you might be familiar with this attack called Self Contained XSS. I recently stumbled upon this article about it. So how bad this kind of attack can be, even though this doesn't have access to ...
- 203
7
votes
2
answers
338
views
Presentation on Web App Security (ACM Student Chapter)
I am a member of the local ACM student chapter in my university and as part of our activities I am scheduled to give a talk on current issues on Web Application Security (and possibly secure coding ...
- 656
8
votes
1
answer
3k
views
Is Request.getHeader("host") vulnerable?
If the following is the code snippet, what would be your suggestions?
<script type="text/javascript" src="<%=request.getHeader("Host")%>/XXX/xxx.js"></script>
Is this a clear ...
- 1,131
3
votes
1
answer
2k
views
XSS in SWF file
I have the following code in an SWF file that a vulnerability scanner marks as XSS:
// Action0
{
var __callResult_6 = getURL(_root.thankYou, "_self");
var __callResult_7 = stop();
...
name
30
votes
7
answers
8k
views
Filter user input before the database or upon display?
Given a web application where user data must be properly escaped to avoid XSS, is it better to try to remove the "bad stuff" before it enters the database, or is it best to allow it in the database ...
- 4,888
3
votes
2
answers
8k
views
Is there a way to bypass escape function in javascript?
Is there a way to bypass escape function in javascript for exploiting a XSS vulnerability ?
- 87
0
votes
4
answers
4k
views
Using DOM-based XSS to redirect to different domain or execute script?
I was trying my hands at DOM-based XSS. I came across a scenario where a user-controlled string from the URL is included in JavaScript as below.
var userControlled=substring of URL;
window.location="/...
- 830
13
votes
1
answer
3k
views
Closing an HTML element without using literal slashes?
I'm investigating a vulnerability in an application that echoes a user-supplied filename without sanitizing the filename.
E.g. a file named test-<script>alert("evil");.txt will result in that ...
- 4,888
6
votes
4
answers
2k
views
Server wide javascript injection
UPDATE: The server was rooted, php.ini was replaced that cause the injection to appear. Still haven't figured out which directive is injecting the javascript.
I'm troubleshooting a hacked website ...
6
votes
1
answer
21k
views
URLEncode vs HTMLEncode for XSS prevention
I have one project (in Java) that the programmer used URLEncode to output content as part of HTML instead of HTMLEncode.
What is the risk that it is XSS vulnerable? (Let’s forget that it’s different ...
- 2,575
12
votes
4
answers
15k
views
PHP functions for preventing XSS
Is there a proven library with functions for preventing XSS attacks? Many people don't realise that htmlspecialchars is not enough to prevent XSS attacks. There are various contexts that need their ...
- 601
15
votes
3
answers
7k
views
How serious are XSS attacks
A website I visit allows this kind of attack, to be implemented with GET in the URL
<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
Along with many others on this page: http://ha.ckers....
- 259
33
votes
2
answers
16k
views
JavaScript written only with brackets?
I once saw JavaScript code which was only written as multiple brackets (). Does anybody remember this kind of code? There was also an online converter to convert "normal" JS into this style of code. I ...
- 769
3
votes
1
answer
468
views
Has The IE8 XSS Filter XSS Flaw Been Fixed?
You may remember: X-XSS-Protection: 0
http://hackademix.net/2009/11/21/ies-xss-filter-creates-xss-vulnerabilities/
Has this been fixed in IE8? IE9? IE10? Is it implemented in IE7?
- 257
22
votes
1
answer
7k
views
Does the practice of blocking an off-site "Referer:" HTTP requests improve website security?
Is there any benefit for a security-paranoid website to disallow HTTP requests that have a Referer: from 3rd party sites?
The pitch is that if such a HTTP request were to come in, then certain XSS ...
- 50.5k
3
votes
5
answers
1k
views
Is it possible to see if a script on a website steals session cookies?
I'm looking as some web analytics solutions, I know it sounds paranoid. but cookie-based web analytics need for you to paste their JavaScript code on your web-site.
I don't like the idea too much of ...
- 257
6
votes
2
answers
6k
views
Are PHP Sessions based on cookies or a cookie-IP pair?
I have a PHP website and my question is:
If someone manages to steal my users' cookies via an XSS attack,
is it enough for him to be identified as the user?
Or does his IP also have to be the same as ...
- 257
4
votes
2
answers
1k
views
Is this an example of XSS attack?
A scripter sees on certain web pages it's technically possible to include markup like HTML and CSS/JS. It's technically possible to submit a javascript or iframe and have it display to the visitor ...
7
votes
4
answers
1k
views
Is XSS dangerous in application without database?
I think it definitelly isn't, because XSS which isn't saved anywhere would damage ONLY attacker.
Am I right or are there any cases where XSS could hurt non-db-application? (I mean datas are not saved ...
- 718
16
votes
6
answers
6k
views
Solution to allow JavaScript input but prevent XSS
We have a simple Blog system that allows users to input html and JavaScript to build a blog page. I'm aware that allowing javascript open up the door to xss attacks. We do however need to allow users ...
- 263
11
votes
3
answers
1k
views
Cross site scripting verification on a field which does not accept more than 20 characters
While performing penetration testing, I got stuck to a point. There is a text field which does not accept more than 20 characters(server side validation). I inserted following piece of code to check ...
- 1,131
4
votes
2
answers
3k
views
How to protect from new Javascript Injection technique that doesn't use eval()?
There is a new Javascript injection technique that is generating chatter on the forums mentioned here
Here is the code sample:
String.prototype.code = function(){ return (new Function('with(this) { ...
- 50.5k
10
votes
2
answers
884
views
Recent Facebook XSS exploit details
There was a recent XSS exploit on Facebook that posted a vulgar message and got users to click on a link to spread the payload. What vulnerability was exploited, and what can other sites do to avoid a ...
- 13.1k
7
votes
4
answers
8k
views
Does default ModSecurity protect enough against XSS?
It's been a few years since I mucked around with modsecurity...
Will simply installing the package with the default rules provide enough validation to prevent any (okay, let's be honest - best we ...
AviD♦
- 72.7k
18
votes
4
answers
3k
views
Web Security Cheatsheet / ToDo list
Can anyone suggest a cheatsheet or ToDo list of web site and application security?
A local small business owner prompted a question about web security, basically her company website just got XSS ...
- 283
6
votes
3
answers
594
views
Is Content Security Policy an approach that is worth to support?
Mozilla Firefox 4.0 supports something called Content Security Policy that disables the interpretation of embedded Java Script. Only external Java Script files that are referenced using a script tag ...
- 27.2k
1
vote
2
answers
771
views
AntiXSS for ASP.NET 1.1
Unfortunately, a client of mine still has an application based on ASP.NET 1.1.
Yes yes, I know - horribly insecure, support ending, and on and on... I've already been through that with them.
...
AviD♦
- 72.7k
1
vote
4
answers
595
views
Safely changing text links to HTML anchors
I'm trying to change text links to real anchors. So for example I want to change http://example.com to <a href="http://example.com">http://example.com</a>.
Since this is a user given ...
- 2,423
7
votes
3
answers
37k
views
Testing PHP form injection
I'm writing a very small PHP app that takes input via a form. As could be expected for a first revision, the code does no escaping or sanitisation of input:
if( $_POST["var"] != "" ) {
print "...
- 173
1
vote
1
answer
477
views
Is this enough to tackle script / malicious code insertion in GET, POST requests?
I've got legacy PHP code which attempts to prevent script/SQL injection with the following:
if (!empty($_POST)) {
reset($_POST);
while (list($k,$v)=each($_POST)) {
if(!is_array($_POST{...
- 469
4
votes
3
answers
6k
views
Altering a $_SESSION variable in PHP via XSS?
Not sure if what I'm saying makes sense... but is it possible for me to alter a $_SESSION variable from outside the target PHP script?
One of our scripts uses a $_SESSION variable and I'm not sure if ...
- 469
1
vote
1
answer
310
views
Replicating javascript actions from different website (XSS?)
I've got html / javascript code on my site like this:
<a onclick="validateForm('formEdit',...,'submitpage("mypaymentsettings","320")','show_confirmation_message(...
- 469
2
votes
2
answers
532
views
Protecting websites from outdated browsers and plugins via a whitelist/blacklist combination?
Aside from using browser headers, I want to blacklist/whitelist browser and plugins from my site so that I can prevent these older unpatched systems from (1) being a general user of my site (2) ...
- 50.5k
11
votes
2
answers
6k
views
How to address XSS security issues in FCKeditor / CKeditor?
A security report we conducted through an outside company reported XSS vulnerabilities in FCKeditor which we're using in our PHP application.
They pointed out that accessing URLs such as:
http://www....
- 1,087
92
votes
4
answers
19k
views
How does XSS work? [closed]
I have very little experience in web development, but I'm interested in security. However, I haven't fully understood how XSS works. Can you explain it to med? The Wikipedia article give me a good ...
- 1,039
8
votes
4
answers
3k
views
Escaping JavaScript constants
how can untrusted values be included in a html-page as javascript string constants? Although the case i am asking uses JSF and Rails, I think this is a general problem independent of the server side ...
- 27.2k
13
votes
7
answers
4k
views
Whitelisting DOM elements to defeat XSS
As we know, developers are responsible for correctly escaping/validating data provided by the user before rendering or storing them. However, we must agree that it's relatively easy to forget a single ...
- 187
50
votes
5
answers
10k
views
New XSS cheatsheet? [closed]
There is a great list of XSS vectors avaliable here: http://ha.ckers.org/xss.html, but It hasn't changed much lately (eg. latest FF version mentioned is 2.0).
Is there any other list as good as this, ...
- 1,115
29
votes
5
answers
2k
views
Is filtering of user input data enough, or should it be parsed?
In a web application there could be two approaches to mitigate XSS attacks:
all the input data could be filtered (removing all 'bad' data), or
the input could be parsed, tokenized and output with ...
- 2,749
23
votes
2
answers
4k
views
Rails - protection against code injection and XSS
I've started using Ruby on Rails, and I was wondering if there were any security gotchas to watch out for with Rails, particularly regarding code injection and XSS?
I know Rails tries to prevent ...
- 1,194