Questions tagged [xssi]

XSSI (Cross Site Script Inclusion) is an attack where JavaScript containing sensitive data from one domain is included into a site from a different domain. Not to be confused with XSS.

Filter by
Sorted by
Tagged with
0 votes
0 answers

XSSI, CSRF attackin REST API's POST method

I'm on a course and there is a bank application which I need to attack by getting users visit my site which instantly transfers X amount of money to my balance. Their transaction form posts the ...
  • 123
7 votes
1 answer

Is some kind of CSRF possible using img/script tag to read sensitive information

Let's say i have an API at https://mysite/api/getSensitiveData that: Uses GET Protected with cookie authentication Returns JSON with some sensitive data A bad guy creates a site on his server that ...
0 votes
3 answers

Why can't bypass SOP using "src" attribut in script tag?

I'm not familiar with Javascript, but I want to know what can't be done in this steps in order to bypass SOP and extract sensitive data : set the tag <script src="">...
  • 367
3 votes
1 answer

How can I get dynamic JavaScript from a web page?

I am trying to understand Cross Site Script Inclusion (XSSI) attacks. For this, I have read the recent paper about this kind of attack. Now my main focus is on detecting dynamic javascript files ...
2 votes
1 answer

How to get JS content fron XSSI vulnerability?

I'm learning about XSSI attacks and I'm wondering if the following dynamic JS can be used to access the content. Dinamic.js: if (window.location.hostname === '' ){ ...
  • 65
47 votes
2 answers

Will same-site cookies be sufficient protection against CSRF and XSS?

I must say, that I like this idea and it seems that it will bring a new form of protection against CSRF and XSS or at least it will reduce those attacks. So, how effective will this protection be? ...
  • 10k
19 votes
1 answer

How does including a magic prefix to a JSON response work to prevent XSSI attacks?

While working on a project that used the REST API for Gerrit Code Review I noticed that they do something that I thought was strange Source: To prevent against Cross Site Script Inclusion (XSSI) ...
  • 347