160
votes
Accepted
Important data can be modified from the developer console. What should I do?
Most of the details in your question are irrelevant. That the ID is stored in a HTML id attribute, the developer tools, that you are using jQuery... None of that really matters.
The only thing that ...
- 64.2k
115
votes
What could an "<img src=" XSS do?
Firefox (fixed in Nightly 59.0a1), Safari (fixed in Safari Technology Preview 54), Edge, and Internet Explorer display an authentication dialog if you request an image and the server asks that you ...
- 1,406
109
votes
Accepted
Are EU cookie consent forms safe?
It increases dialog box fatigue. By overflowing the user with mundane dialog boxes, they are more likely to get into the habit of just clicking OK to remove the dialog box from their screen. This ...
- 28.5k
101
votes
Is there a way to hide HTML source code yet keeping it effective?
Well, IMHO the only reliable way to prevent the user to know the mail address it to have the mail sent server side instead of client side. Said differently the client only gives their own mail address ...
- 25.5k
94
votes
Accepted
What could an "<img src=" XSS do?
Like Anders says: Blender makes a very good point about authentications dialogs, and multithr3at3d is right about the on attributes. Moreover, Anders add argues about the a tag and Matija have a good ...
- 5,647
90
votes
Accepted
Anonymous surveys that aren't so anonymous
If the site is based on ASPX files, then it is more than likely that this is a ASP.NET application - most probably hosted on IIS.
IIS has a very simple checkbox to enable Windows Integrated ...
AviD♦
- 71.8k
88
votes
Security risks of user generated HTML?
User-defined HTML
You're attempting to sanitize user input by blacklisting things you don't want to allow. Unfortunately, especially given the very large list of options for HTML5, it's quite easy to ...
- 29.7k
73
votes
Accepted
"Allow __ to be fullscreen?"
The question is asked mostly to protect you from phishing attacks. The website may fake an Operating system, and ask you to enter sensitive information like passwords. To quote the spec:
User ...
- 4,305
55
votes
Accepted
Is there a way to hide HTML source code yet keeping it effective?
You can't. The question doesn't even make sense on a conceptual level. A mailto: link is simply a convenient way to communicate to an end user where they can send email to. If your mailto link works, ...
- 636
53
votes
Accepted
How to launch XSS code from an INPUT HTML tag upon page load?
Try this:
" onfocus="alert(1)" autofocus="
It will expand to:
<input type="text" id="search-text" name="query" value="" onfocus="alert(1)" autofocus="" />
Which will cause an alert box, ...
- 32.6k
53
votes
Accepted
Why is "hovering over" a link in an email considered safe? Or is it harmful?
One of my employers told us that if we receive a suspicious email with links, we have to hover over the link (to check that it is not spoofed) before clicking it.
When you mouseover a link, the ...
- 43.6k
46
votes
What could an "<img src=" XSS do?
<img src=http://evil.com is not too much of an issue, but <img src=a onerror=alert('XSS')> can be used to inject any arbitrary JavaScript. In fact, any HTML tag combined with any "on" event ...
- 12.3k
44
votes
Accepted
Have computer criminals been known to exploit easily-edited websites like Wikipedia to embed malicious scripts?
Assuming that you are coming from a BT connection, it's possible that this is part of the BT parental controls program.
There is a discussion of a similar looking pop-up here , which seems to tie ...
- 60.6k
40
votes
Is it ever safe to open a suspicious HTML file (e.g. email attachment)?
Editors, and common libraries used by editors, may have vulnerabilities like buffer overflows. Your attacker would need to know (or guess) what editor you use and craft an exploit specifically for ...
- 509
38
votes
What could an "<img src=" XSS do?
Okay, how about this: (You should probably stand back.)
<img src="file://uhoh.gif”>
Oh I know, right? What a monster!
Well it could be, if you are using SMB...
It's a bug that has been ...
- 481
32
votes
Anonymous surveys that aren't so anonymous
That's incredible simple, and a really old trick.
Create a different survey for each department, even if the surveys have the same questions.
Everyone that answers to Survey X is from Department A.
...
- 538
29
votes
Does this CSS code expose if a message is read, and how long they have been reading it?
The email includes references to an externally-hosted images, like http://example.com/[tracking_id].png, where the tracking company controls the server hosting the image. The company records how and ...
- 5,780
28
votes
Accepted
How do the Stack Exchange sites protect themselves from XSS?
For general comments, the script tags are properly escaped, so that it's just interpreted as text instead of as actual code. In this case, that sort of thing is handled via something known as HTML ...
- 869
27
votes
Accepted
Why is CSP needed to protect against img-src leak?
Just to be clear about how the attack works:
A site allows you to enter text that is later displayed somewhere. It does not properly filter out HTML.
Mallory enters <img src='https://some-evil-...
- 64.2k
21
votes
What could an "<img src=" XSS do?
The D's answer points out that a GET can be used to issue commands both cross site and on the same site. I want to expand on that notion because saying "It's a GET request - be careful" doesn't ...
- 372
21
votes
Security risks of user generated HTML?
Currently these are the tags that are banned:
In addition to what's already been posted, make sure that banning means "don't letting the user save the data", not "remove the banned stuff and save ...
- 308
20
votes
Is it ever safe to open a suspicious HTML file (e.g. email attachment)?
Oh, these answers are way too sophisticated for your situation. It's highly unlikely that your IT department would be using some fancy workaround assuming they know what editor you're using, their ...
19
votes
Are EU cookie consent forms safe?
This form effectively gave all websites a valid excuse to interfere with browsing until the user clicks on something.
This is indeed a bad thing: browsers have gone a long way protecting the user ...
- 10k
19
votes
Is it ever safe to open a suspicious HTML file (e.g. email attachment)?
Okay, so, technically, you're never 100% safe. Yes, there could be attempted attacks on your text editor/ASCII viewer. Yes, someone could have somehow magically snuck a DLL into your temporary ...
- 2,153
18
votes
What could an "<img src=" XSS do?
I think by "img XSS" you mean "site that allows arbitrary values for the src="" attribute of <img /> elements".
...in which case the main risk is of Cross Site Request Forgery (CSRF) as it ...
- 1,686
17
votes
Set the max length for input
The "better way" is server-side validation, because you simply cannot control what the client will send. It does not matter what client-side method you use - <input maxlength=, javascript, what-...
- 71.3k
15
votes
Accepted
HTML password fields
If they have the real old password in the field you can retrieve it by looking at the source of the HTML page. But usually there is only a placeholder like "this was the old password" which is used to ...
- 181k
15
votes
Anonymous surveys that aren't so anonymous
The website will record your IP address. The Company's network assigns your IP address. Just associate the two ...
- 151
15
votes
Is there a way to hide HTML source code yet keeping it effective?
You can't. And neither can Javascript.
You have three options, and they all depend on a backend language. You have two options, one right way and two lunatic ways if you have no server:
The right way:...
- 251
Only top scored, non community-wiki answers of a minimum length are eligible