Search Results
| Search type | Search syntax |
|---|---|
| Tags | [tag] |
| Exact | "words here" |
| Author |
user:1234 user:me (yours) |
| Score |
score:3 (3+) score:0 (none) |
| Answers |
answers:3 (3+) answers:0 (none) isaccepted:yes hasaccepted:no inquestion:1234 |
| Views | views:250 |
| Code | code:"if (foo != bar)" |
| Sections |
title:apples body:"apples oranges" |
| URL | url:"*.example.com" |
| Saves | in:saves |
| Status |
closed:yes duplicate:no migrated:no wiki:no |
| Types |
is:question is:answer |
| Exclude |
-[tag] -apples |
| For more details on advanced search visit our help page | |
Results tagged with xss
Search options questions only
not deleted
user 36337
Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).
1
vote
2
answers
12k
views
XSS with input in onclick attribute
<table onclick="texttexttexttextUSERINPUTHERE"></table>
Would XSS be possible? I mean with > and " filtered out. …
- 751
3
votes
0
answers
82
views
XSS only works when GET request is submitted with form [duplicate]
If it isn't clear what my goal is, I'd like to make this an actual exploitable bug instead of simply being a self-XSS. …
- 751
7
votes
1
answer
9k
views
Host Header Attacks
So reading this blog post, I know how the password reset works and how it's exploitable, but in a real case scenario, how would XSS be possible? …
- 751
1
vote
2
answers
12k
views
Is cross site scripting possible with the img alt attribute?
If any characters are allowed in the alt attribute of an img tag (except for double quotes), is XSS possible? Valid image or not. …
- 751
5
votes
1
answer
2k
views
Style attribute XSS without quotes
If there is a page that allows user input into the following...
.page
{
background: #userinput;
}
can it be exploited if <>'" are all filtered? I've seen width: expression(alert(0));, but I cou …
- 751
8
votes
2
answers
4k
views
How is DOM XSS possible here?
I was looking at this website and trying to understand how this XSS is possible, but I just can't figure it out. Here's the URL: http://www.domxss.com/domxss/01_Basics/05_jquery_html.html? …
- 751
4
votes
2
answers
5k
views
Exploiting XSS with window.name without iFrame
I know XSS is possible if the window.name is echoed onto the page, but from my understanding, this requires you to use an iFrame, but what if the page has clickjacking protection, stopping the page from …
- 751
3
votes
1
answer
7k
views
Can location.pathname lead to XSS?
<div id="cat"></div>
<script>
$("#cat").html(location.pathname);
</script>
I think that example would work, but anyway, if location.pathname has to be a valid page, can this be exploited?
Edit: I'm …
- 751
12
votes
3
answers
26k
views
What is a good XSS vector without forward slashes and spaces?
I need an XSS vector that doesn't use forward slashes nor spaces. I've gone through lists of hundreds of vectors, but they usually have one of those two. …
- 751
11
votes
2
answers
6k
views
How can document.referrer be used for XSS?
A very simple example...
<div id="cat"></div>
<script>
document.getElementById("cat").innerHTML = document.referrer;
</script>
or
<script src="' + document.referrer + '"></script>
I've tried si …
- 751