Hot answers tagged

160 votes
Accepted

Important data can be modified from the developer console. What should I do?

Most of the details in your question are irrelevant. That the ID is stored in a HTML id attribute, the developer tools, that you are using jQuery... None of that really matters. The only thing that ...
user avatar
  • 64.2k
115 votes

What could an "<img src=" XSS do?

Firefox (fixed in Nightly 59.0a1), Safari (fixed in Safari Technology Preview 54), Edge, and Internet Explorer display an authentication dialog if you request an image and the server asks that you ...
user avatar
  • 1,406
109 votes
Accepted

Are EU cookie consent forms safe?

It increases dialog box fatigue. By overflowing the user with mundane dialog boxes, they are more likely to get into the habit of just clicking OK to remove the dialog box from their screen. This ...
user avatar
  • 28.5k
101 votes

Is there a way to hide HTML source code yet keeping it effective?

Well, IMHO the only reliable way to prevent the user to know the mail address it to have the mail sent server side instead of client side. Said differently the client only gives their own mail address ...
user avatar
94 votes
Accepted

What could an "<img src=" XSS do?

Like Anders says: Blender makes a very good point about authentications dialogs, and multithr3at3d is right about the on attributes. Moreover, Anders add argues about the a tag and Matija have a good ...
user avatar
  • 5,647
90 votes
Accepted

Anonymous surveys that aren't so anonymous

If the site is based on ASPX files, then it is more than likely that this is a ASP.NET application - most probably hosted on IIS. IIS has a very simple checkbox to enable Windows Integrated ...
user avatar
  • 71.8k
88 votes

Security risks of user generated HTML?

User-defined HTML You're attempting to sanitize user input by blacklisting things you don't want to allow. Unfortunately, especially given the very large list of options for HTML5, it's quite easy to ...
user avatar
73 votes
Accepted

"Allow __ to be fullscreen?"

The question is asked mostly to protect you from phishing attacks. The website may fake an Operating system, and ask you to enter sensitive information like passwords. To quote the spec: User ...
user avatar
  • 4,305
55 votes
Accepted

Is there a way to hide HTML source code yet keeping it effective?

You can't. The question doesn't even make sense on a conceptual level. A mailto: link is simply a convenient way to communicate to an end user where they can send email to. If your mailto link works, ...
user avatar
  • 636
53 votes
Accepted

How to launch XSS code from an INPUT HTML tag upon page load?

Try this: " onfocus="alert(1)" autofocus=" It will expand to: <input type="text" id="search-text" name="query" value="" onfocus="alert(1)" autofocus="" /> Which will cause an alert box, ...
user avatar
  • 32.6k
53 votes
Accepted

Why is "hovering over" a link in an email considered safe? Or is it harmful?

One of my employers told us that if we receive a suspicious email with links, we have to hover over the link (to check that it is not spoofed) before clicking it. When you mouseover a link, the ...
user avatar
  • 43.6k
46 votes

What could an "<img src=" XSS do?

<img src=http://evil.com is not too much of an issue, but <img src=a onerror=alert('XSS')> can be used to inject any arbitrary JavaScript. In fact, any HTML tag combined with any "on" event ...
user avatar
44 votes
Accepted

Have computer criminals been known to exploit easily-edited websites like Wikipedia to embed malicious scripts?

Assuming that you are coming from a BT connection, it's possible that this is part of the BT parental controls program. There is a discussion of a similar looking pop-up here , which seems to tie ...
user avatar
  • 60.6k
40 votes

Is it ever safe to open a suspicious HTML file (e.g. email attachment)?

Editors, and common libraries used by editors, may have vulnerabilities like buffer overflows. Your attacker would need to know (or guess) what editor you use and craft an exploit specifically for ...
user avatar
  • 509
38 votes

What could an "<img src=" XSS do?

Okay, how about this: (You should probably stand back.) <img src="file://uhoh.gif”> Oh I know, right? What a monster! Well it could be, if you are using SMB... It's a bug that has been ...
user avatar
32 votes

Anonymous surveys that aren't so anonymous

That's incredible simple, and a really old trick. Create a different survey for each department, even if the surveys have the same questions. Everyone that answers to Survey X is from Department A. ...
user avatar
  • 538
29 votes

Does this CSS code expose if a message is read, and how long they have been reading it?

The email includes references to an externally-hosted images, like http://example.com/[tracking_id].png, where the tracking company controls the server hosting the image. The company records how and ...
user avatar
  • 5,780
28 votes
Accepted

How do the Stack Exchange sites protect themselves from XSS?

For general comments, the script tags are properly escaped, so that it's just interpreted as text instead of as actual code. In this case, that sort of thing is handled via something known as HTML ...
user avatar
  • 869
27 votes
Accepted

Why is CSP needed to protect against img-src leak?

Just to be clear about how the attack works: A site allows you to enter text that is later displayed somewhere. It does not properly filter out HTML. Mallory enters <img src='https://some-evil-...
user avatar
  • 64.2k
21 votes

What could an "<img src=" XSS do?

The D's answer points out that a GET can be used to issue commands both cross site and on the same site. I want to expand on that notion because saying "It's a GET request - be careful" doesn't ...
user avatar
  • 372
21 votes

Security risks of user generated HTML?

Currently these are the tags that are banned: In addition to what's already been posted, make sure that banning means "don't letting the user save the data", not "remove the banned stuff and save ...
user avatar
  • 308
20 votes

Is it ever safe to open a suspicious HTML file (e.g. email attachment)?

Oh, these answers are way too sophisticated for your situation. It's highly unlikely that your IT department would be using some fancy workaround assuming they know what editor you're using, their ...
user avatar
19 votes

Are EU cookie consent forms safe?

This form effectively gave all websites a valid excuse to interfere with browsing until the user clicks on something. This is indeed a bad thing: browsers have gone a long way protecting the user ...
user avatar
19 votes

Is it ever safe to open a suspicious HTML file (e.g. email attachment)?

Okay, so, technically, you're never 100% safe. Yes, there could be attempted attacks on your text editor/ASCII viewer. Yes, someone could have somehow magically snuck a DLL into your temporary ...
user avatar
18 votes

What could an "<img src=" XSS do?

I think by "img XSS" you mean "site that allows arbitrary values for the src="" attribute of <img /> elements". ...in which case the main risk is of Cross Site Request Forgery (CSRF) as it ...
user avatar
  • 1,686
17 votes

Set the max length for input

The "better way" is server-side validation, because you simply cannot control what the client will send. It does not matter what client-side method you use - <input maxlength=, javascript, what-...
user avatar
  • 71.3k
15 votes
Accepted

HTML password fields

If they have the real old password in the field you can retrieve it by looking at the source of the HTML page. But usually there is only a placeholder like "this was the old password" which is used to ...
user avatar
15 votes

Anonymous surveys that aren't so anonymous

The website will record your IP address. The Company's network assigns your IP address. Just associate the two ...
user avatar
  • 151
15 votes

Is there a way to hide HTML source code yet keeping it effective?

You can't. And neither can Javascript. You have three options, and they all depend on a backend language. You have two options, one right way and two lunatic ways if you have no server: The right way:...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible