Skip to main content
14 votes

Preventing Javascript in a browser from connecting to servers

Firefox has an offline mode, just press “alt” to reveal the file menu, and select “Work offline”. Combine this with private browsing to make sure nothing is kept in storage for later. If you want to ...
Didier L's user avatar
  • 261
10 votes
Accepted

What are the reasons for CORS failure errors to not be available to JS?

The reason is that exposing error details in JavaScript can leak private information to a cross-site scripting attacker. For example, an attacker could scan private networks of the victim by ...
Ja1024's user avatar
  • 10k
9 votes

Preventing Javascript in a browser from connecting to servers

You can use an addon like uMatrix that injects CSP headers to prevent cross-site network requests.
allo's user avatar
  • 3,451
9 votes

Preventing Javascript in a browser from connecting to servers

You can use Firejail to sandbox a particular Firefox instance. This allows you to restrict network access, ranging from no access at all to forcing all traffic through a firewall for more fine-grained ...
Ja1024's user avatar
  • 10k
4 votes

Where to store JWT refresh tokens

Your question isn't clear whether you mean in the client (the thing that first receives and then uses the refresh token) or the server (where the token is generated and then consumed), nor as to ...
CBHacking's user avatar
  • 49.3k
4 votes

How can I identify open-source JavaScript libraries within minified code?

There are standard approaches for analyzing code similarity in general and for JavaScript in particular. Depending on the exact minifier, it's probably sufficient to look for Type-2 clones (formatting ...
Ja1024's user avatar
  • 10k
3 votes

Is JSON vulnerability still possible?

JSON Hijacking is pretty much dead - it's been patched in all major browsers for years. My colleague did some research into this in 2016 but all the bugs mentioned are now patched: https://portswigger....
albinowax's user avatar
  • 121
3 votes
Accepted

Timing Attack using bcrypt.js

The timing difference is between bcrypt.compare called in case of an existing user and not called when the user does not exist. To prevent this timing difference simply call bcrypt.compare also in the ...
Steffen Ullrich's user avatar
2 votes
Accepted

XSS in document.write(location.href)

Internet Explorer and possibly other old browsers might be vulnerable to this attack. In modern browsers, the URL-encoding of special characters within location.href effectively acts as HTML-escaping, ...
Ja1024's user avatar
  • 10k
2 votes

Secure way to output encoding HTML for insert raw html via javascript

If you want to insert untrusted HTML markup as text, then you should use the textContent property, not innerHTML. The textContent property reliably prevents XSS attacks, because the content is only ...
Ja1024's user avatar
  • 10k
1 vote

Preventing Javascript in a browser from connecting to servers

Most browsers, including Google Chrome and Firefox, support an offline setting in the F12 developer mode. While this is not targetted at the casual user, it's easy to temporarily set. See https://...
Marcel's user avatar
  • 4,093
1 vote

Preventing Javascript in a browser from connecting to servers

Is there a way to prevent javascript in a browser from doing anything that can communicate with the internet (e.g. loading additional images or requesting documents via the Fetch Api). Content ...
Sjoerd's user avatar
  • 31.4k
1 vote

how to send cookies or token in local storage to a remote server using reflected XSS

Do you understand how / why the approach with the Image is supposed to work? You're effectively creating an HTML <img src=...> tag, where the source is a URL starting with your listener and ...
CBHacking's user avatar
  • 49.3k
1 vote

is <script>javascript:alert(document.domain); a valid script for xss?

The correct syntax will look something like this <script>alert(document.domain)</script> , since if you do not close the script tag your script will continue to pickup anything that is ...
Aleks4920's user avatar
1 vote

Securely storing derived key in web app and handling user identity

With regard to (1): See Need some clarification regards end-to-end encryption process for a few ideas around how to store users' private keys in a zero-knowledge web application. With regard to (2): ...
mti2935's user avatar
  • 23.6k
1 vote
Accepted

Is it safe to store the OIDC token in a private field of a javascript object?

Safe enough, sure, lots of sites do this. An attacker who gets XSS on the site might still be able to extract the token, depending on exactly how the function that adds it to API calls is invoked (for ...
CBHacking's user avatar
  • 49.3k
1 vote

Is this a type of XSS attack?

It depends. The fact that the alert appears before sending means that there's client-side script reading your text input and injecting it into the DOM in some fashion, and doing so insecurely. It is ...
CBHacking's user avatar
  • 49.3k
1 vote

Why do browsers disallow accessing files from local file system even if the HTML document is also on the local file system?

It's been a few years since this was an issue for me, but here I am. I came to confirm that I remembered the state, but what I didn't see was a reference to HTAs. Hyper Text Applications (HTA) were an ...
Jefferey Cave's user avatar
1 vote

What are the potential consequences of evaluating user input with client side JavaScript?

Depends on what they can do really. Like if it's just an input that displays something on a button press, then not really all that much. At least not anything they couldn't do with devtools. If it's ...
Ja Da's user avatar
  • 111

Only top scored, non community-wiki answers of a minimum length are eligible