Skip to main content

Questions tagged [xssi]

XSSI (Cross Site Script Inclusion) is an attack where JavaScript containing sensitive data from one domain is included into a site from a different domain. Not to be confused with XSS.

Filter by
Sorted by
Tagged with
1 vote
0 answers

How to use html encoded characters to perform XSS?

I am trying to perform XSS but to get out of the context and write the payload I need to use Angle brackets and the angle brackets are html encoded. I tried double encoding technique with url encoding+...
Riaz Rabia's user avatar
0 votes
0 answers

Is POST-based XSSI possible?

With standard XSSI, an attacker can include a remote script which contains user-bound secrets across origins, and then read them out. I have an endpoint which returns sensitive Javascript code, but ...
tim's user avatar
  • 29.7k
2 votes
1 answer

Is JSON vulnerability still possible?

I have a bunch of REST APIs which would be consumed by frontend applications created by customers using our product. I have suggested to only use last 2 versions of Chrome for running frontend apps. ...
user120947's user avatar
0 votes
0 answers

XSSI, CSRF attackin REST API's POST method

I'm on a course and there is a bank application which I need to attack by getting users visit my site which instantly transfers X amount of money to my balance. Their transaction form posts the ...
Tudvari's user avatar
  • 123
7 votes
1 answer

Is some kind of CSRF possible using img/script tag to read sensitive information

Let's say i have an API at https://mysite/api/getSensitiveData that: Uses GET Protected with cookie authentication Returns JSON with some sensitive data A bad guy creates a site on his server that ...
Ilya Chernomordik's user avatar
0 votes
3 answers

Why can't bypass SOP using "src" attribut in script tag?

I'm not familiar with Javascript, but I want to know what can't be done in this steps in order to bypass SOP and extract sensitive data : set the tag <script src="">...
Reda LM's user avatar
  • 367
3 votes
1 answer

How can I get dynamic JavaScript from a web page?

I am trying to understand Cross Site Script Inclusion (XSSI) attacks. For this, I have read the recent paper about this kind of attack. Now my main focus is on detecting dynamic javascript files ...
Tasnim Fabiha's user avatar
2 votes
1 answer

How to get JS content fron XSSI vulnerability?

I'm learning about XSSI attacks and I'm wondering if the following dynamic JS can be used to access the content. Dinamic.js: if (window.location.hostname === '' ){ ...
pancho's user avatar
  • 65
53 votes
2 answers

Will same-site cookies be sufficient protection against CSRF and XSS?

I must say, that I like this idea and it seems that it will bring a new form of protection against CSRF and XSS or at least it will reduce those attacks. So, how effective will this protection be? ...
Mirsad's user avatar
  • 10.2k
21 votes
1 answer

How does including a magic prefix to a JSON response work to prevent XSSI attacks?

While working on a project that used the REST API for Gerrit Code Review I noticed that they do something that I thought was strange Source: To prevent against Cross Site Script Inclusion (XSSI) ...
ecnepsnai's user avatar
  • 367