Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
Views views:250
Sections title:apples
body:"apples oranges"
URL url:"*"
Favorites infavorites:mine
Status closed:yes
Types is:question
Exclude -[tag]
For more details on advanced search visit our help page
Results tagged with Search options user 31625

Cross-Site Scripting: An attack method that involves injection of code or markup into a webpage. There are three major types of XSS: Reflected XSS, Stored XSS (aka persistent XSS) and DOM-based XSS (aka client side XSS).

XSS is both a vulnerability and an attack. If we were being very strict about terminology, we would say "my website has an XSS vulnerability" and "we logged an XSS attack at 08:43". Often for … shorthand people just say "XSS" and leave you to imply from the context whether they mean a vulnerability or an attack. I would say that "insufficient filtering" is not a vulnerability itself, it is a …
answered Oct 16 '14 by paj28
The impact of XSS is the same regardless of whether it is stored/reflective or DOM-based/server-side - the attacker gets full control of the web session. Stored XSS is more readily exploitable (you … don't need to get a user to click a link) so it's more serious. Whether a vulnerability is DOM-based or server-side doesn't greatly affect the severity. You can have stored DOM-based XSS. As an …
answered Aug 20 '15 by paj28
longer work. Are there any publicly known ways to bypass .Net 4.5 request validation, for XSS? The most recent link I found was this. …
asked Jan 26 '15 by paj28
Sounds like it is vulnerable, and you have hit the anti-XSS filter in modern browsers. For testing I suggest you disable the filter. When reporting these issues to clients, I take the line that you … can't be sure whether a user will have such a browser, and report anyway. That has been ok so far, although I can see in the future I will need to distinguish between XSS that is exploitable through the filter (high risk) and other XSS (should still be fixed, but lower risk). …
answered Mar 13 '14 by paj28
Try this: " onfocus="alert(1)" autofocus=" It will expand to: <input type="text" id="search-text" name="query" value="" onfocus="alert(1)" autofocus="" /> Which will cause an alert box, demonstrating XSS. …
answered Aug 22 '15 by paj28
XSS is serious Perform a demonstration of XSS to show that it has a real-world impact, beyond alert('xss'). XSS affects us Provide some statistics, e.g. 17 XSS flaws in our products were … pitfalls Page context. Even if you have an escaping template engine, untrusted data within a <script> tag can cause XSS. What data is untrusted? e.g if you fetch an RSS feed from an external site, it is …
answered Sep 2 '16 by paj28
If the page context of the XSS is a tag on an input attribute, e.g. <input type="text" name="address" value="<xsshere>"/> Then the following payload works: " onfocus="alert(1)" autofocus=" …
answered Jan 26 '15 by paj28
functions like .html() neither of these by default have XSS protection. One approach is for the client code to explicitly call an escaping function on all untrusted input. However, an approach I prefer is …
answered Oct 28 '13 by paj28
Cookies set over HTTP are presented over HTTPS. If an attacker has full control of a victim's network traffic, they can set a cookie over HTTP, and this will cause an XSS attack against the HTTPS site. I believe that HSTS would stop this, although I haven't confirmed myself. …
answered Oct 16 '14 by paj28
We need to consider exactly what a tight policy is. I have identified three levels: Level 1 - Stop XSS At this level, a tight policy will stop all XSS. If the site has XSS flaws, these will not be … exploitable (assuming the user's browser supports CSP). An XSS attacker could still reference resources on their own server, which creates a web beacon. They can see users' IP addresses, and deliver …
answered Jul 27 '16 by paj28
turned off. In practice, the risk of XSS on an internal network is pretty low. If external attackers are on the network, they can probably do worse things. Malicious insiders tend to abuse legitimate … (and tabs) while using the internal application, and logout when they are finished. This makes XSS in the internal app non-exploitable - although it's a pain for users. Ultimately though, your …
answered Oct 3 '16 by paj28
Yes most scanners can do this. For example, Burp Suite supports macros which allow you to configure a sequence of requests. The support is quite neat as various different Burp tools (scanner, intrude …
answered May 16 '14 by paj28
Burp has identified a potential DOM XSS vulnerability: The application may be vulnerable to DOM-based cross-site scripting. Data is read from window.location.href and passed to the 'setAttribute … ("fill", thing); The OWASP DOM XSS Cheat Sheet says "JavaScript Escape Before Inserting Untrusted Data into HTML Attribute Subcontext within the Execution Context". I'm not quite sure what they mean by …
asked Oct 14 '16 by paj28
challenges that do this. One approach was that a certain page (vulnerable to stored XSS) was requested by a browser on a periodic basis (every 10s I think). After successful attack, your payload ran in that … steal other people's ideas. An alternative idea was to have reflective XSS only, and a page where you can submit a link to the site, which admin will review before it goes live. How long to have the …
asked Dec 22 '16 by paj28
No it is not safe. You are correct that the JSONP service could deliver arbitrary JavaScript, which is then executed as part of your site. Because JSONP is essentially a hack to get around the same o …
answered Jul 10 '14 by paj28

15 30 50 per page