Skip to main content
11 votes
Accepted

What is the term for when a hyperlink maliciously opens different URL from URL displayed when hovered over?

Such attacks have been called Click Interception in a fairly recent Usenix paper. They could also be considered a form of Action Spoofing. Disabling JavaScript for untrusted sites is definitely the ...
Ja1024's user avatar
  • 12k
8 votes

What is the next layers of defence against cookie stealing if GET parameter is vulnerable to XSS and there is no HttpOnly flag in a website?

Presented in order from "normal" to "insane, never attempt this": There might be mitigations against XSS, such as Content Security Policy (CSP). However, if you can execute an XSS ...
CBHacking's user avatar
  • 49.6k
7 votes

What is the next layers of defence against cookie stealing if GET parameter is vulnerable to XSS and there is no HttpOnly flag in a website?

Since other answers have focused briefly on the different techniques to mitigate or control XSS, but I want to just focus on CSP in this regard, because I’d say CSP is the most common tactic to battle ...
security_paranoid's user avatar
5 votes

What is the next layers of defence against cookie stealing if GET parameter is vulnerable to XSS and there is no HttpOnly flag in a website?

There might be layers which do not prevent stealing the cookie but which prevent using a stolen cookie. This might be a short lifetime or the cookie bound to IP address, device properties or other ...
Steffen Ullrich's user avatar
1 vote

Preventing Javascript in a browser from connecting to servers

As an alternative to all the offline-mode browser options (which are good, to be clear), you can also prevent a program from accessing the network, via outbound firewall rules. On Windows and Linux ...
CBHacking's user avatar
  • 49.6k

Only top scored, non community-wiki answers of a minimum length are eligible