New answers tagged

0 votes

Is there any way to bypass javascript comment filtering (XSS)

If the server is "correctly" escaping forward slashes, then no, there's no way to specifically bypass that to insert a single-line comment in JS. You could try using escaped characters, to ...
user avatar
  • 39k
1 vote
Accepted

Is it possible to get xss in json body request?

So there any possibility to get XSS in json body? XSS is not about how the code fragment is transported but where it is included. Thus it does not matter if it is transport with JSON, XML, plain text,...
user avatar
4 votes
Accepted

Can a plain text email contain XSS injection?

No, plain-text email cannot contain a cross-site scripting (XSS) attack.XSS requires scripting, which even HTML email bodies* do not permit. (*HTML attachments opened in web browsers can trigger XSS ...
user avatar
  • 9,256
0 votes

Are XSS attacks, or any other where a third party script is used as the attack vector, Living Off the Land (LOtL) Attacks?

LOtL are commonly referred to when talking about internal testing EG using available binaries on the device to run commands instead of bringing your own. As far as XSS it could be possible to load ...
user avatar
1 vote
Accepted

How does this PortSwigger lab's XSS work?

When you place this payload in the website parameter value, sending a request like this: POST /post/comment HTTP/1.1 csrf=rJXP2IH8tuMQffr4Ao1XAW5pjCeVm3T8&postId=1&comment=test&name=test&...
user avatar
  • 1,148
2 votes

Is this SQLi or XSS? (or both/neither)

Assuming it works, this is both, in two separate places. It's SQL injection, quite straightforwardly. The attacker is breaking out of a SQL string, terminating the current query, and injecting their ...
user avatar
  • 39k
2 votes

Bypass double quotes " transformed to "

In general, no. If you see " getting transformed to " as it passes through the HTML, then that usually means that the application is doing output escaping properly. You may be able to ...
user avatar

Top 50 recent answers are included