Search Results
| Search type | Search syntax |
|---|---|
| Tags | [tag] |
| Exact | "words here" |
| Author |
user:1234 user:me (yours) |
| Score |
score:3 (3+) score:0 (none) |
| Answers |
answers:3 (3+) answers:0 (none) isaccepted:yes hasaccepted:no inquestion:1234 |
| Views | views:250 |
| Code | code:"if (foo != bar)" |
| Sections |
title:apples body:"apples oranges" |
| URL | url:"*.example.com" |
| Saves | in:saves |
| Status |
closed:yes duplicate:no migrated:no wiki:no |
| Types |
is:question is:answer |
| Exclude |
-[tag] -apples |
| For more details on advanced search visit our help page | |
Results tagged with xss
Search options not deleted
user 121141
Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).
2
votes
Why can't scanners usually detect stored XSS? Is there a way to automate the detection of st...
The same tools will detect stored XSS as well if the script is reflected in the immediate response.
But sometimes the immediate response may not reflect the script even if it is vulnerable to XSS. … In this case if the form is vulnerable to persistent XSS it will execute at the browser of high privileged user.
Persistent XSS mostly happen on POST request. …
- 3,951
2
votes
Can I prevent XSS attacks with MySQL REPLACE function?
This won't prevent reflected XSS.
This is not filtering all possible scripts.
In short, this won't prevent XSS. …
- 3,951
1
vote
0
answers
129
views
Is XSS possible when the user input gets reflected inside <textarea> when '<' and '>' symbol... [duplicate]
Theory, History and the whole story:
In theory to demonstrate XSS, I have to get an alert window. I am listing down the ideal test cases I have tried out. … The Question:
Would XSS be possible in this scenario?
What other encoding can I try? …
- 3,951
0
votes
1
answer
234
views
Is there a vulnerability other than XSS which can result in client side script execution?
If the intention of attacker is to execute an arbitrary client side script in the context of a web application, is XSS the only possible attack other than compromising the server with an RCE or a sub-resource … XSS is Cross Site Scripting - Be it reflected, persistent or DOM based. …
- 3,951
6
votes
1
answer
2k
views
What was the real reason for dropping reflected-xss directive from CSP?
X-XSS Protection: 1; mode=block
Content-Security-Policy: reflected-xss
X-XSS Protection
This header according to MDN;
Chrome has an "Intent to Deprecate and Remove the XSS Auditor"
Firefox have not, … and will not implement X-XSS-Protection
Edge have retired their XSS filter
Content Security Policy
The CSP 2.0 nor 3.0 specifies a directive reflected-xss. …
- 3,951