New answers tagged

0

TL;DR Is there any chrome:// url that allows script injection? And be one of the many on their glory list? I assume people are getting paid for this. I found you can run straight system commands through chrome:// urls What system commands can one run specifically through an internal chrome page? date, cal, rm? This statement does contradict with the ...


0

XSS generally impacts integrity and confidentiality (an attacker can read and modify data they shouldn't). If you only have static pages with no authentication and/or user-specific content, then confidentiality may not be as important (an attacker may eg still be able to log which specific pages a victim user views, which depending on the nature of the ...


1

It sounds like you are asking how to tamper with form submissions that are sent in the body via POST, not as part of the URL as with GET. The way to do this is with a man-in-the-middle proxy such as Burp or ZAP. They will allow you to intercept, read, and modify requests being sent from the browser to the server. As an example, if there are client-side ...


6

We will be deprecating that passive scan rule shortly. Here's the issue: https://github.com/zaproxy/zaproxy/issues/5849 Here are the related PRs: https://github.com/zaproxy/zap-extensions/pull/2297 https://github.com/zaproxy/zaproxy/pull/5850 You should really have CSP in place, as for whether or not it matters for those files it depends if they exist, ...


5

favicon.ico and robots.txt: No. Browsers do not execute JavaScript within these files. In theory, sitemap.xml could be an issue. There are lots of nasty tricks you can do with xml. In reality, it would be a very, very difficult attack to pull off (especially given the likely scenario that this is a static file).


0

The very first usage of XSS I thought of was in this very situation. Suppose the attacker wants to read all the private information stored in the user's account. The attacker crafts a phishing email that looks legitimate and even links to the real site, but the URL includes a concealed script that when it loads, screen-scrapes the webpage and sends all the ...


7

What if a user leaves their account logged in? Normally the attacker would only have a short window of time to exploit this but if there is an XSS vulnerability, they can leave a malicious script which might just give them permanent control of the account, even after password changes. The script does not even have to be ready at the time. An attacker can ...


1

I was wondering if antivirus software can detect when a PC get's hooked to BeEF No. However, it is possible for AV to detect the JS hook file in the browser's cache, similarly to how it will detect JavaScript based heap spraying libraries. A few years ago there was an open source browser plugin "Vegan" released that showed some examples of how BeEF could ...


2

I was wondering if antivirus software can detect when a PC get's hooked to BeEF. I am afraid you don't understand what BeEF is. BeEF is a browser exploitation framework that can inject malicious JavaScript into a website with XSS vulnerability. That in no way means hooking your PC, rather more like hooking your browser tab. Can an antivirus detect that? ...


28

tl/dr: Yes! Defense in depth is critical, so any XSS vulnerability is a vulnerability that needs to be fixed, regardless of whether or not a method of exploit is immediately obvious. The Underlying Question Whether intentional or not, there is a question behind your question that is much more important to answer. In essence what you are really asking ...


7

What you describe prevents only Stored XSS. But reflected XSS is still possible if cross-site requests are allowed by the server and the authentication status is transported between requests using a session cookie - both things are usually the case. And DOM XSS is even possible without cross-site requests and cookie based authentication since the request is ...


3

how does the 'Same origin policy' prevent XSS attacks It doesn't. The SOP works when there is no XSS vulnerability. It ensures that evil.com cannot read data with your authentication from eg facebook.com. This holds true as long as facebook.com doesn't introduce it's own vulnerability which allows bypassing of the SOP. And that is where XSS comes into ...


3

It's not enough. One possible bypass: </textarea ><script>alert(1)</script> This works because of the extra space after textarea. You could adapt your filter to catch this as well. But I wouldn't recommend it because the approach is already flawed. If you do not need to allow a user-supplied subset of HTML to be rendered (which isn't ...


1

An XSS attack here means that the attacker somehow must be able to compromise the HTML in the Ajax result. Assuming that the connection itself can be trusted (i.e. HTTPS) there are basically two options: sanitize the HTML in the client and/or make sure that there is no XSS in it in the first place in the server. The latter option is preferred if you have ...


4

First of all, I assume that you are the owner of the website disclosing the phpinfo, and you ask this for academic purposes. To achieve what you said, I would do the following : Create an invisible iframe (0px x 0px) Store cookies in var x by parsing the iframe content through contentDocument getter/setter Create an invisible <img/> (0px x 0px) with ...


Top 50 recent answers are included