Skip to main content

Questions tagged [xssi]

XSSI (Cross Site Script Inclusion) is an attack where JavaScript containing sensitive data from one domain is included into a site from a different domain. Not to be confused with XSS.

Filter by
Sorted by
Tagged with
1 vote
0 answers
97 views

How to use html encoded characters to perform XSS?

I am trying to perform XSS but to get out of the context and write the payload I need to use Angle brackets and the angle brackets are html encoded. I tried double encoding technique with url encoding+...
Riaz Rabia's user avatar
0 votes
0 answers
81 views

Is POST-based XSSI possible?

With standard XSSI, an attacker can include a remote script which contains user-bound secrets across origins, and then read them out. I have an endpoint which returns sensitive Javascript code, but ...
tim's user avatar
  • 29.7k
2 votes
1 answer
947 views

Is JSON vulnerability still possible?

I have a bunch of REST APIs which would be consumed by frontend applications created by customers using our product. I have suggested to only use last 2 versions of Chrome for running frontend apps. ...
user120947's user avatar
0 votes
0 answers
265 views

XSSI, CSRF attackin REST API's POST method

I'm on a course and there is a bank application which I need to attack by getting users visit my site which instantly transfers X amount of money to my balance. Their transaction form posts the ...
Tudvari's user avatar
  • 123
7 votes
1 answer
5k views

Is some kind of CSRF possible using img/script tag to read sensitive information

Let's say i have an API at https://mysite/api/getSensitiveData that: Uses GET Protected with cookie authentication Returns JSON with some sensitive data A bad guy creates a site on his server that ...
Ilya Chernomordik's user avatar
0 votes
3 answers
854 views

Why can't bypass SOP using "src" attribut in script tag?

I'm not familiar with Javascript, but I want to know what can't be done in this steps in order to bypass SOP and extract sensitive data : set the tag <script src="https://facebook.com/messages">...
Reda LM's user avatar
  • 367
3 votes
1 answer
517 views

How can I get dynamic JavaScript from a web page?

I am trying to understand Cross Site Script Inclusion (XSSI) attacks. For this, I have read the recent paper about this kind of attack. Now my main focus is on detecting dynamic javascript files ...
Tasnim Fabiha's user avatar
2 votes
1 answer
1k views

How to get JS content fron XSSI vulnerability?

I'm learning about XSSI attacks and I'm wondering if the following dynamic JS can be used to access the content. Dinamic.js: if (window.location.hostname === 'Demo.site.com' ){ ...
pancho's user avatar
  • 65
53 votes
2 answers
25k views

Will same-site cookies be sufficient protection against CSRF and XSS?

I must say, that I like this idea and it seems that it will bring a new form of protection against CSRF and XSS or at least it will reduce those attacks. So, how effective will this protection be? ...
Mirsad's user avatar
  • 10.2k
21 votes
1 answer
9k views

How does including a magic prefix to a JSON response work to prevent XSSI attacks?

While working on a project that used the REST API for Gerrit Code Review I noticed that they do something that I thought was strange Source: To prevent against Cross Site Script Inclusion (XSSI) ...
ecnepsnai's user avatar
  • 367