Hot answers tagged

207 votes
Accepted

Why is it dangerous to open a suspicious email?

There is a small risk of an unknown bug — or a known but unpatched one — in your mail client allowing an attack by just viewing a message. I think, though, that this very broad advice is also given ...
mattdm's user avatar
  • 2,731
135 votes
Accepted

Tell browser my site has no scripts

A good option is to harden your Content Security Policy. It allows you to fine-tune which resources the browser will load/run, and is supported by most browsers. Consider the following header: ...
grc's user avatar
  • 1,855
115 votes

What could an "<img src=" XSS do?

Firefox (fixed in Nightly 59.0a1), Safari (fixed in Safari Technology Preview 54), Edge, and Internet Explorer display an authentication dialog if you request an image and the server asks that you ...
Blender's user avatar
  • 1,406
107 votes

How hard should I try to prevent a user from XSSing themselves?

This is actually a real concept, "Self XSS" which is sufficiently common that if you open https://facebook.com and then open the developer tools, they warn you about it Obviously Facebook is a ...
Rory McCune's user avatar
  • 62.2k
101 votes
Accepted

What could an "<img src=" XSS do?

Like Anders says: Blender makes a very good point about authentications dialogs, and multithr3at3d is right about the on attributes. Moreover, Anders add argues about the a tag and Matija have a good ...
grochmal's user avatar
  • 5,867
100 votes

How dangerous is XSS?

Below are the things an attacker can do if there is XSS vulnerability. Ad-Jacking - If you manage to get stored XSS on a website, just inject your ads in it to make money ;) Click-Jacking - ...
Gowtham's user avatar
  • 1,003
83 votes
Accepted

Why aren't sessions exclusive to an IP address?

First, linking a session to an IP address will not make it secure since the server could see many different users as using the same IP address for various reasons (all types of proxy servers, for ...
Stephane's user avatar
  • 18.7k
78 votes

What are some important concepts to teach developers about cross-site scripting (XSS)?

From a developer's perspective, the first two points you have are not very relevant. Stored and Reflected XSS have the same mitigation: properly escape things you output according to their context. ...
bonsaiviking's user avatar
  • 11.6k
78 votes
Accepted

Why do I need two parameters in an HTTP parameter pollution attack?

The idea would be that different parts of the server code interpret the request in different ways, resulting in an application that is vulnerable to HTTP Parameter Pollution. For your example /...
Tobi Nary's user avatar
  • 14.4k
76 votes
Accepted

Why do XSS strings often start with ">?

This way you escape from a double-quoted attribute (") and close the previous tag (>) before opening a script tag that contains your payload. It's one of the most basic XSS patterns. Example: <...
Arminius's user avatar
  • 44.7k
66 votes
Accepted

Difference between XSS and CSRF?

In a cross-site request forgery attack, the attacker tries to force/trick you into making a request which you did not intend. This could be sending you a link that makes you involuntarily change your ...
Arminius's user avatar
  • 44.7k
63 votes
Accepted

How does CORS prevent XSS?

TL;DR: How does CORS prevent XSS? It does not. It is not meant to do so. CORS is intended to allow resource hosts (any service that makes its data available via HTTP) to restrict which websites may ...
marstato's user avatar
  • 2,315
61 votes

Why is it dangerous to open a suspicious email?

Not for gmail, but for Outlook there have been a number of "preview pane" exploits where simply looking at the email is enough to compromise: Can malware be activated by previewing email in Outlook&#...
pjc50's user avatar
  • 2,996
60 votes
Accepted

Will same-site cookies be sufficient protection against CSRF and XSS?

First, a definition from Chrome: Same-site cookies (née "First-Party-Only" (née "First-Party")) allow servers to mitigate the risk of CSRF and information leakage attacks by ...
Anders's user avatar
  • 65.6k
56 votes

Is including the data scheme in your Content Security Policy safe?

The note on whitelisting the data protocol which is referenced says data: Allows data: URIs to be used as a content source. This is insecure; an attacker can also inject arbitrary data: URIs. Use ...
zemnmez's user avatar
  • 681
52 votes
Accepted

Is Dom based XSS still a valid security concern in modern browsers?

Yes, DOM-based XSS is still a concern. While some issues cannot be exploited due to URL encoding, there a number of situations where URL encoding will not stand in the way of exploitation. The gist ...
tim's user avatar
  • 29.6k
51 votes

What could an "<img src=" XSS do?

<img src=http://evil.com is not too much of an issue, but <img src=a onerror=alert('XSS')> can be used to inject any arbitrary JavaScript. In fact, any HTML tag combined with any "on" event ...
multithr3at3d's user avatar
45 votes
Accepted

What is meant by "Vulnerable with: css class selector" for JQuery?

In jQuery you can specify a CSS selector and HTML code with the same shorthand. This is a selector: $('#some-thing') This is HTML that gets evaluated immediately: $('<svg onload=alert(1)>') ...
Arminius's user avatar
  • 44.7k
42 votes

What could an "<img src=" XSS do?

Okay, how about this: (You should probably stand back.) <img src="file://uhoh.gif”> Oh I know, right? What a monster! Well it could be, if you are using SMB... It's a bug that has been ...
Adam White's user avatar
41 votes

How dangerous is XSS?

Maybe a real life example would help to understand how dangerous an apparently minor security flaw like XSS can be. As part of a security assessment, my company was tasked with trying to access the ...
Margaret Bloom's user avatar
40 votes
Accepted

SQL injection inside XSS

That depends on what you mean by "inside". For example, as Conor Mancone suggested, there could be a combined reflected XSS and SQL injection. That could look like this: http://example.com/...
Fire Quacker's user avatar
  • 2,442
39 votes

How hard should I try to prevent a user from XSSing themselves?

Although you are right in that it might not matter so much from an attack point of view. From a usability point of view, the user might come across some 'unexpected behavior'. A while ago I used to ...
meowcat's user avatar
  • 1,359
38 votes
Accepted

Secure big, old ecommerce website from XSS?

I propose the following four step program, where you first pick the low hanging fruit to give you some minimum of protection while you work on the bigger problems. 1. Activate client side filtering 1....
Anders's user avatar
  • 65.6k
35 votes
Accepted

When and why does bypassing XSS sanitizers with double encoding work?

Lets look at this example payload (A), encoded once (B) and twice (C): A. <script> alert(1) </script> B. %3Cscript%3E alert(1) %3C%2Fscript%3E C. %253Cscript%253E alert(1) %253C%...
Anders's user avatar
  • 65.6k
32 votes

Why does XSS affect so many websites?

XSS is a form of code injection, i.e. the attacker manages to inject its own malicious code (usually JavaScript) into trusted code (HTML, CSS, JavaScript) provided by the site. It is similar to SQLi ...
Steffen Ullrich's user avatar
32 votes

Is splitting a REST API server from a Web server considered a security threat?

It would be more accurate to say that "using two servers e.g. api.myservice.org and www.myservice.org has security implications " --in other words, would normally be blocked by default ...
MarkHu's user avatar
  • 421
31 votes
Accepted

Does incognito/private browsing prevent XSS attacks?

An XSS attack is not primarily about cookies. It is not about stealing sensitive data either. It is instead about executing attacker-controlled code on the client side within the context of the site ...
Steffen Ullrich's user avatar
30 votes

Why is it dangerous to open a suspicious email?

Even if nothing actively bad happens, many passively bad things can happen -- for example, you might view a one pixel transparent image tagged with your email address that flags you as the kind of ...
arp's user avatar
  • 531
29 votes

How does CORS prevent XSS?

Cross-Site-Scripting (XSS) is the execution of attacker defined script code in the context of another site. CORS does not prevent XSS, in fact it is unrelated to XSS. Instead CORS offers a way to ...
Steffen Ullrich's user avatar
28 votes

How do hackers make the victim access an XSS attack URL?

the user did some actions that they won't do as usual Clicking on a link does seem like a usual action for most users. See for example this study, in which 56% of users clicked on links in E-Mails ...
tim's user avatar
  • 29.6k

Only top scored, non community-wiki answers of a minimum length are eligible