159 votes
Accepted

Important data can be modified from the developer console. What should I do?

Most of the details in your question are irrelevant. That the ID is stored in a HTML id attribute, the developer tools, that you are using jQuery... None of that really matters. The only thing that ...
Anders's user avatar
  • 65.6k
115 votes

What could an "<img src=" XSS do?

Firefox (fixed in Nightly 59.0a1), Safari (fixed in Safari Technology Preview 54), Edge, and Internet Explorer display an authentication dialog if you request an image and the server asks that you ...
Blender's user avatar
  • 1,406
107 votes
Accepted

Are EU cookie consent forms safe?

It increases dialog box fatigue. By overflowing the user with mundane dialog boxes, they are more likely to get into the habit of just clicking OK to remove the dialog box from their screen. This ...
Sjoerd's user avatar
  • 30.7k
102 votes
Accepted

What could an "<img src=" XSS do?

Like Anders says: Blender makes a very good point about authentications dialogs, and multithr3at3d is right about the on attributes. Moreover, Anders add argues about the a tag and Matija have a good ...
grochmal's user avatar
  • 5,877
101 votes

Is there a way to hide HTML source code yet keeping it effective?

Well, IMHO the only reliable way to prevent the user to know the mail address it to have the mail sent server side instead of client side. Said differently the client only gives their own mail address ...
Serge Ballesta's user avatar
90 votes
Accepted

Anonymous surveys that aren't so anonymous

If the site is based on ASPX files, then it is more than likely that this is a ASP.NET application - most probably hosted on IIS. IIS has a very simple checkbox to enable Windows Integrated ...
AviD's user avatar
  • 73.3k
90 votes

Security risks of user generated HTML?

User-defined HTML You're attempting to sanitize user input by blacklisting things you don't want to allow. Unfortunately, especially given the very large list of options for HTML5, it's quite easy to ...
Conor Mancone's user avatar
71 votes

Are Cyrillic characters a real threat?

Cyrillic characters by themselves are not a threat. There are whole nations which use these characters without additional risks. The problem is when characters look similar to others, since these then ...
Steffen Ullrich's user avatar
54 votes
Accepted

Why is "hovering over" a link in an email considered safe? Or is it harmful?

One of my employers told us that if we receive a suspicious email with links, we have to hover over the link (to check that it is not spoofed) before clicking it. When you mouseover a link, the ...
Arminius's user avatar
  • 44.8k
54 votes
Accepted

Is there a way to hide HTML source code yet keeping it effective?

You can't. The question doesn't even make sense on a conceptual level. A mailto: link is simply a convenient way to communicate to an end user where they can send email to. If your mailto link works, ...
Cubic's user avatar
  • 626
51 votes

What could an "<img src=" XSS do?

<img src=http://evil.com is not too much of an issue, but <img src=a onerror=alert('XSS')> can be used to inject any arbitrary JavaScript. In fact, any HTML tag combined with any "on" event ...
multithr3at3d's user avatar
42 votes

What could an "<img src=" XSS do?

Okay, how about this: (You should probably stand back.) <img src="file://uhoh.gif”> Oh I know, right? What a monster! Well it could be, if you are using SMB... It's a bug that has been ...
Adam White's user avatar
40 votes

Is it ever safe to open a suspicious HTML file (e.g. email attachment)?

Editors, and common libraries used by editors, may have vulnerabilities like buffer overflows. Your attacker would need to know (or guess) what editor you use and craft an exploit specifically for ...
Thomas's user avatar
  • 509
32 votes

Anonymous surveys that aren't so anonymous

That's incredible simple, and a really old trick. Create a different survey for each department, even if the surveys have the same questions. Everyone that answers to Survey X is from Department A. ...
T. Sar's user avatar
  • 537
29 votes

Are Cyrillic characters a real threat?

As you say, most browsers will display punycode URLs, so that something like http://exаmple.org will be displayed as http://xn--exmple-4nf.org. However, there are cases where an attacker may be able ...
Gh0stFish's user avatar
  • 11k
27 votes
Accepted

Why is CSP needed to protect against img-src leak?

Just to be clear about how the attack works: A site allows you to enter text that is later displayed somewhere. It does not properly filter out HTML. Mallory enters <img src='https://some-evil-...
Anders's user avatar
  • 65.6k
22 votes

Security risks of user generated HTML?

Currently these are the tags that are banned: In addition to what's already been posted, make sure that banning means "don't letting the user save the data", not "remove the banned stuff and save ...
Matsemann's user avatar
  • 318
20 votes

What could an "<img src=" XSS do?

The D's answer points out that a GET can be used to issue commands both cross site and on the same site. I want to expand on that notion because saying "It's a GET request - be careful" doesn't ...
VLAZ's user avatar
  • 370
20 votes

Is it ever safe to open a suspicious HTML file (e.g. email attachment)?

Oh, these answers are way too sophisticated for your situation. It's highly unlikely that your IT department would be using some fancy workaround assuming they know what editor you're using, their ...
George M Reinstate Monica's user avatar
20 votes

Is it ever safe to open a suspicious HTML file (e.g. email attachment)?

Okay, so, technically, you're never 100% safe. Yes, there could be attempted attacks on your text editor/ASCII viewer. Yes, someone could have somehow magically snuck a DLL into your temporary ...
Lightness Races in Orbit's user avatar
19 votes

Are EU cookie consent forms safe?

This form effectively gave all websites a valid excuse to interfere with browsing until the user clicks on something. This is indeed a bad thing: browsers have gone a long way protecting the user ...
Dmitry Grigoryev's user avatar
18 votes

What could an "<img src=" XSS do?

I think by "img XSS" you mean "site that allows arbitrary values for the src="" attribute of <img /> elements". ...in which case the main risk is of Cross Site Request Forgery (CSRF) as it ...
Dai's user avatar
  • 1,726
15 votes

Anonymous surveys that aren't so anonymous

The website will record your IP address. The Company's network assigns your IP address. Just associate the two ...
Jim's user avatar
  • 151
15 votes

Is there a way to hide HTML source code yet keeping it effective?

You can't. And neither can Javascript. You have three options, and they all depend on a backend language. You have two options, one right way and two lunatic ways if you have no server: The right way:...
The Anathema's user avatar
13 votes
Accepted

Why shouldn't I put user input in HTML comments?

The relevant entries in the HTML5 Security Cheatsheet are: Ending HTML comments with a backtick character: html5sec#133 (IE6, IE8) Injecting XSS or with a conditional comment html5sec#115 (older IE, ...
Steffen Ullrich's user avatar
12 votes

HTML broken and comments inserted in website

After checking the websites which contained such comments, I found that all of them are Wordpress sites. 3 of them contained an injected Javascript (in our site, all javascript is removed from posts, ...
lepe's user avatar
  • 2,194
12 votes
Accepted

Is autocomplete="off" bad for username input fields?

autocomplete off is for sensitive information, for example credit card numbers. The exception is the input type password, because modern browsers do not store input for that type, and disabling ...
tim's user avatar
  • 29.6k
12 votes

Why is CSP needed to protect against img-src leak?

If a user presses "View Source" and sends data manually, that's their choice, and nothing the site does will prevent it. However, CSP configurations are generally part of a defense in depth strategy - ...
Matthew's user avatar
  • 27.3k

Only top scored, non community-wiki answers of a minimum length are eligible