Search Results
| Search type | Search syntax |
|---|---|
| Tags | [tag] |
| Exact | "words here" |
| Author |
user:1234 user:me (yours) |
| Score |
score:3 (3+) score:0 (none) |
| Answers |
answers:3 (3+) answers:0 (none) isaccepted:yes hasaccepted:no inquestion:1234 |
| Views | views:250 |
| Code | code:"if (foo != bar)" |
| Sections |
title:apples body:"apples oranges" |
| URL | url:"*.example.com" |
| Saves | in:saves |
| Status |
closed:yes duplicate:no migrated:no wiki:no |
| Types |
is:question is:answer |
| Exclude |
-[tag] -apples |
| For more details on advanced search visit our help page | |
Results tagged with xss
Search options answers only
not deleted
user 294
Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).
1
vote
Is there a way to bypass escape function in javascript?
If you need to override the escape function for whatever reason (I am assuming an already persistent XSS?) … filters I recommend reading and trying this XSS cheat sheet: http://ha.ckers.org/xss.html …
- 16.2k
6
votes
Is XSS dangerous in application without database?
There are many ways XSS can exploit and do much damage without it having to be stored in a database. Remember that the XSS can even be stored in cookies! … This is because you have to actually distribute the XSS payload instead of it spreading on its own. …
- 16.2k
11
votes
How to address XSS security issues in FCKeditor / CKeditor?
This kind of exploit is a reflected XSS attack vector. You can read more about it in this question here: can-anybody-explain-xss. …
- 16.2k
3
votes
Accepted
Replicating javascript actions from different website (XSS?)
I can just include your javascript file on my page like this:
<script type="text/javascript" src="http://www.yourhomepage.com/xxx.js"></script>
This would allow me to reuse your submitpage() functi …
- 16.2k
85
votes
Accepted
How does XSS work?
XSS - Cross Site Scripting (but not limited to actual cross site scripting)
XSS is usually presented in 3 different ways:
Non-persistent (often called reflected XSS)
This is when you are able to inject … Two attack vectors
Now that you know the different ways of delivering a XSS payload I'd like to mention a few XSS attack vectors that can be very dangerous:
XSS defacement
XSS defacement is not a hard …
- 16.2k
8
votes
Accepted
Altering a $_SESSION variable in PHP via XSS?
Say for example that the $_SESSION['username'] is populated when the user logins like this:
$_SESSION['username'] = $_GET['login-username']
As the XSS owns your client he can also modify the content …
- 16.2k