Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
15

The malware in question is hosted elsewhere, and is (probably) being added by cross-site-scripting (XSS). If you have a look at the "var src" part, you'll see a long string of Base64-encoded text: ...


4

The only thing to know when coding an application is that you should not trust the client. This being said, all calculations that you do client-side need to be checked and sanitized by the server. If everything is properly sanitized, then you do not need to block something on the browser. Furthermore, let's say that you use a Javascript function ...


4

Certain browsers have certain features. The service runs JavaScript they provide you, so they can run a lot of feature tests in the actual browser. This can be used to validate your userAgent string. For example (purely hypothetical), if everyone knows that Chrome after v50 supports CSS variables, and any Chrome after v40 no longer support the old ...


3

Imagine that the superSecretToken token was something retrieved from your service's server and was specific to the authenticated user. Or imagine that it was the user's bank balance. Then any random webpage on the internet could embed your page in an iframe, and whenever someone visited the attacker's page and happened to be logged into your service, the ...


2

If using asymmetric encryption from openpgp.js, the private key is stored encrypted by default and then briefly decrypted to decrypt or sign a message with the users passphrase. It is never stored un-encrypted and relies on the user remembering the passphrase he used to create the key pair. In this case even if the hacker found the private keys they are ...


2

I agree with @BBerastegui, whenever you have an input filter, the first thing you want to do is load an external script so that you are not restricted anymore. I'll assume that that's not possible (eg because of a CSP). You can still steal the cookie or perform other actions. Second, whenever there is a ' symbol, any comment after it is ignored. That's ...


2

Yes some email harvesters will render the page and scrape the results therefore no matter how obfuscated your JavaScript is, if the JavaScript simply outputs a plain text email it's possible it will be harvested. On the other hand your html example above likely would not get harvested because they probably don't have that format built into many scrapers. ...


1

Mitigations for XSS attacks are not typically restricted to input filtering as you’re describing and attempting, as you’re experiencing it’s like playing whackamole with possible filter bypasses. That’s why the Filter Evasion cheat sheet from OWASP exists. Any untrusted input that’s reflected in a browser response needs to be output encoded. For example ...


1

No, this is not enough. An attacker does not necessarily need to call an external script. They can dump the payload directly into the inline script too. Depending on the length restrictions in place, this can become quite tricky, but still manageable. The main takeaway from this is that custom-made solutions are not very secure. Every now and then I see ...


1

Validation / sanitizing is done on server only. In your example there is no server side code. If your client loads files that should be available to everyone without any restriction, then there is no need on server to check anything. I.e. you don't have to do anything on the server. "anyone could just make the simple call anyways" - this is wrong statement. ...


1

You are correct. The update statement containing the single quotation mark would be broken due to the termination of the name's value and the ad hoc nature on the update. It is surprising that errors aren't occurring since the extra text after the closing of the single quotation isn't valid SQL. I have set up an example of both of these cases (as SELECTs ...


1

// is just the start of a protocol-relative URL. From this site, //google.com would take you to https://google.com. From a plain old http site, //google.com would take you to http://google.com (which would likely bounce you to the https site, but that's not tangential). The tag itself will set your relative URL interpretation to another domain. so with ...


1

It's virtually impossible to do this on your own. There are dozens of fingerprinting vectors that can be used to detect the operating system you are running or uniquely identify a browser, and sometimes even your individual hardware irrespective of the OS you use. Paradoxically, any changes you make to your browser configuration actually make this worse. In ...


1

This is not malware , this is a credential phish. If you enter your password and submit the stolen password is sent to this url hxxp://www.kamesinvestmentint[.]com/wp/xplore/kato/mail.php If you did not enter a password you are safe. If the page didn't load it probably means your browser failed to render the JavaScript ... either way sounds like you are ...


Only top voted, non community-wiki answers of a minimum length are eligible