Questions tagged [xssi]

XSSI (Cross Site Script Inclusion) is an attack where JavaScript containing sensitive data from one domain is included into a site from a different domain. Not to be confused with XSS.

Filter by
Sorted by
Tagged with
3
votes
1answer
555 views

Is some kind of CSRF possible using img/script tag to read sensitive information

Let's say i have an API at https://mysite/api/getSensitiveData that: Uses GET Protected with cookie authentication Returns JSON with some sensitive data A bad guy creates a site on his server that ...
0
votes
3answers
221 views

Why can't bypass SOP using “src” attribut in script tag?

I'm not familiar with Javascript, but I want to know what can't be done in this steps in order to bypass SOP and extract sensitive data : set the tag <script src="https://facebook.com/messages">...
3
votes
1answer
214 views

How can I get dynamic JavaScript from a web page?

I am trying to understand Cross Site Script Inclusion (XSSI) attacks. For this, I have read the recent paper about this kind of attack. Now my main focus is on detecting dynamic javascript files ...
2
votes
1answer
573 views

How to get JS content fron XSSI vulnerability?

I'm learning about XSSI attacks and I'm wondering if the following dynamic JS can be used to access the content. Dinamic.js: if (window.location.hostname === 'Demo.site.com' ){ ...
19
votes
2answers
6k views

Will same-site cookies be sufficent protection against CSRF and XSS?

I must say, that I like this idea and it seems that it will bring a new form of protection against CSRF and XSS or at least it will reduce those attacks. So, how effective will this protection be? ...
13
votes
1answer
5k views

How does including a magic prefix to a JSON response work to prevent XSSI attacks?

While working on a project that used the REST API for Gerrit Code Review I noticed that they do something that I thought was strange Source: To prevent against Cross Site Script Inclusion (XSSI) ...