53
votes
Accepted
Is Dom based XSS still a valid security concern in modern browsers?
Yes, DOM-based XSS is still a concern. While some issues cannot be exploited due to URL encoding, there a number of situations where URL encoding will not stand in the way of exploitation.
The gist ...
- 29k
5
votes
How can document.referrer be used for XSS?
Updated browsers will encode the referrer URL.
So your examples will not work to trigger XSS nowadays.
Try this:
<div id="cat"></div>
<script>
document.getElementById("cat")....
- 1,316
5
votes
Accepted
Exploiting XSS with window.name without iFrame
The other way to get hold of another window is to pop it up. You can specify the window name in the second parameter:
var victim= window.open('http://example.com/vulnerable', '<script>alert("...
- 12.4k
5
votes
Is this code JavaScript vulnerable to DOM based XSS?
Yes, it is vulnerable if document.theform.reference[id].value can be a value controlled by another user.
If this value was set to javascript:alert('xss') by an attacker then the line
window.location....
- 33.2k
5
votes
Accepted
Is this codes usage of document.location.toString() a DOM based XSS vulnerability?
This code snippet is vulnerable to XSS in jQuery prior to 1.9 (and in conjunction with the jQuery Migrate plugin). Even now, it remains at least a bad practice.
The string argument to $() (shortcut ...
- 43.6k
5
votes
Accepted
In what situations can element.setAttribute allow XSS?
setAttribute() is safe in that it does nothing more than setting the attribute's value. Even by using special characters in the string you cannot inject an additional attribute (as you attempted in ...
- 43.6k
3
votes
Accepted
Why this XSS payload doesn't work?
The page you refer to has the following code:
<p id="p1">Hello, guest!</p>
<script>
...
var username = searchParams.get('name');
...
document.getElementById('p1').innerHTML = 'Hello,...
- 181k
3
votes
Is echoing GET parameters into a script tag reflected or DOM based XSS?
This is reflected XSS, not DOM-based XSS.
The difference is subtle, but here are the key sentences.
OWASP - DOM Based XSS
the page itself (the HTTP response that is) does not change, but the ...
- 8,764
3
votes
Accepted
Why doesn't this XSS attack work?
$("div[id="+t+"]")
That's not JavaScript injection. For it to be JS injection, the attacker-supplied value would have to be written into the JavaScript code from the outside (for example in a server-...
- 12.4k
3
votes
Is this javascript vulnerable to dom based XSS?
No it's not vulnerable to XSS based on the provided information. The interpolated URL query parameter token has quote marks escaped (\" instead of just ") so you cannot break out of the string. ...
- 1,118
3
votes
Accepted
Is this JavaScript mailto redirect vulnerable to XSS?
This is more injection than XSS, but Mailto links have a few features that you can abuse. For example, instead of the email program popping up with just the TO filled out, you can pre-fill the CC, BCC,...
- 2,432
2
votes
How can document.referrer be used for XSS?
The following code is vulnerable to DOM based XSS, because the attacker-controlled value of document.referrer is tracked by the browser:
<script src="' + document.referrer + '"></script>
...
- 46.8k
2
votes
Accepted
Can location.pathname lead to XSS?
Yes, if a path containing script tags is resolved to the page containing this code on your server (for example, via a rewrite rule) then script could be rendered in your page. This will be DOM based ...
- 33.2k
2
votes
Exploiting XSS with window.name without iFrame
The method .text() seems more adequate/safer to solve the functional requirement of echoing the window.name in the page DOM.
<script>
$("div").text(window.name);
</script>
from jquery ...
- 51
2
votes
Accepted
exploit document.write with unsanitized user input
To put it simply, you can't because your your payload bob); alert(1 is a string, and JavaScript knows its a string so it won't execute it. The parenthesis and semi-colon characters can be inside the ...
- 2,220
2
votes
Dom based Xss Query - location.hash
XSS only happens when data is output.
In your code sample you are setting the variable myhash to the hash value in the address bar. As your code doesn't contain any sinks and your variable is not ...
- 33.2k
2
votes
Is the payload for DOM based XSS defined to originate from only inside the browser or even outside of it
DOM based XSS vs Reflected XSS
Should I interpret this as Reflected XSS means being able to injecting <script> tags in an HTML context, and DOM based XSS means being able to inject payload ...
- 29k
2
votes
Possible Vulnerability in the following Php/JS code
Both codes are vulnerable, but neither is exploitable with most modern browsers.
In the first example, could exploit the echoing of REQUEST_URI. Exploitability depends on the browser not ...
- 29k
2
votes
DOM based XSS inside src attribute
Are there any other attacks that I didn't consider?
To prevent the single quote form getting encoded, you could try to sneak your payload into the path instead of the query string. For example, if ...
- 43.6k
2
votes
Safely creating script tag and attaching to DOM
Is it safe to allow passing the [script URL] as a URL query param?
No, this is very dangerous. See question #3.
If this code is an issue, what are the specific attacks that could happen here?
Since ...
- 64.2k
1
vote
Accepted
How do browsers handle document.write in this DOM based XSS case?
First the browser hands over the incoming data to the HTML parser, that starts working from the top of the document and down. This can happend even before the document has finnished downloading. As ...
- 64.2k
1
vote
How can i get an alert box from this?
Is \ converted to \\? If not, break out of the string using \"; it'll be converted to \\", which will be treated as a sole (escaped) backslash and then a string-terminating quotation mark.
Inserting ...
- 38.7k
1
vote
XSS with escaped equal sign inside jQuery selector
You would maybe be able to do it if the charset was not atypical, and then you may be able to get a valid result by using a multibyte character converting into an equals sign, but you can't change the ...
- 959
1
vote
Is this code vulnerable to DOM based XSS jquery animate?
The code snippet you shared above is not vulnerable to DOM-based XSS. jQuery version 1.12.4 is not affected by the selector XSS bug. I highly recommend using http://research.insecurelabs.org/jquery/...
- 1,256
1
vote
Accepted
DAST Output in Burp and Understanding It
I haven't used the new DAST scanner, but it seems like it injected (dkezib%2527%2522``'"/dkezib/>xrpjqc&) into the input field / variable, ran the javascript, and found that it reached the eval(...
- 57k
1
vote
Accepted
DOMXSS - Is Input Field Content an Attack Vector?
That would be hard to exploit without combining it with another vulnerability. How would the exploit code get into the input? I suppose combining it with UI-redressing or something like that could ...
- 2,185
1
vote
Is the payload for DOM based XSS defined to originate from only inside the browser or even outside of it
Since the payload is going from the victim's browser to the server and
coming back to the browser, how is this not reflected XSS instead?
In that example, it is not going to the server to come back ...
- 33.2k
1
vote
Is this codes usage of document.location.toString() a DOM based XSS vulnerability?
This was a pretty common XSS attack vector in jQuery, and can still affect sites using an outdated version of jQuery.
https://bugs.jquery.com/ticket/9521
Basically, if a string was an invalid ...
- 8,764
1
vote
Is this code vulnerable to DOM based attacks?
This won't be problem as long as st_val is NOT under the client control. As you know, if you are setting value of the window.location.href variable it will redirect current page to the new value. If ...
- 248
1
vote
Safe to render data directly to DOM from localStorage? XSS attack possible?
Encoding / Decoding coupled with XSS sanitation pre save and pre dom render is best practice.
Mitigation strategies regarding browser DOM XSS attacks vary but can be strengthened with header options ...
- 931
Only top scored, non community-wiki answers of a minimum length are eligible