New answers tagged

0

Trying to duct tape "more security" by trying to guess what is safe and what is not is going to fail. The only way to make sure you don't get code injected through input is to treat input as data and never mix it with code, whether it might be safe or not. For SQL that means prepared statements. For XSS attacks it gets a little trickier because there is ...


1

• Admin user adds malicious content into the user’s profile. Depending on the already existing power an admin user has adding a XSS gadget might not gain them more privileges, so integrity and confidentiality is low at best. • If someone can do a change in the database in another way. Thats similar or even more extreme, the person who can alter the ...


1

In much more complex cases I personally like to collect all experimental results (like you did) which I found through manual testing, sit down and try to implement such filtering locally and try to bypass it with different browsers and browser versions. Additionally you need to know in which programming language was written this web application - it might be ...


0

First of all, if " is transformed into \" but \ isn't itself escaped as \, you can simply break out of the string by using \" (which will be turned into \\" - a literal backslash as the last character of the string, then it terminates). Next, it probably won't work, but you could try putting an entire self-closing HTML element into the script body, such as &...


0

Thanks to Gareth Heyes! Payload: {{$on.constructor(toString().constructor.fromCharCode(120,61,97,108,101,114,116,40,49,41))()}} No strings / eval works on AngularJS 1.6.6


1

You seem to have a decent grasp of it. Anything that can redirect the user via a POST request can be used to exploit - this is often done via an HTML form but is by no means the only way it can be done. As you mentioned various javascript functions can also redirect the user. The most significant difference between POST XSS and GET XSS is how you phish the ...


1

That's correct: if you want to exploit a POST-based XSS, you need the user to do a POST request with malicious to the exploited page. This is most often done by adding a auto-submitting form in a HTML page hosted by the attacker. There are other techniques, like clickjacking, but hosting a HTML page is the easiest way to go. Using the Fetch API isn't ...


1

Suggest you look at some of the issues as they were filed against Bootstrap. Sample exploits are provided, examples: https://github.com/twbs/bootstrap/issues/20184 https://github.com/twbs/bootstrap/issues/27044 https://github.com/twbs/bootstrap/issues/27045


3

To avoid many attacks, you should pay attention to what type of content you're manipulating. What looks like text is not necessarily text. This applies both for SQL (SQL Injection) and HTML (XSS). The string abc is written abc as text. It is also written abc as HTML. So you may think that if you have text to display, you can just concatenate it with the ...


1

I agree with the answer from @RaimondsLiepiņš. To expand a bit more though, it's important to understand that the nature of how you prevent XSS depends on the context, which is why proper encoding of output is the most effective solution. Trying to preemptively clean all input can work, but also tends to be a clunky solution that causes other issues for ...


1

Is there any possibility to bypass these regex? I am not very confident in the regex, because if I do a string like "abc" or "alert(1)" it says no match on both. XSS can be obfuscated as well, meaning a good regex to catch XSS is not an easy task to write, for more information have a look at https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet ...


1

What happened? The vulnerability scanner thinks that it found a possible reflective XSS or HTML injection vulnerability in the page. When it injected Oui"sTYLe='acu:Expre/**/SSion(Afih(9717))'bad=" as a GET request parameter, the page rendered with the following element in it: <a href="https://trojanmart.com/SSionAfih9717" title="Français " class=" "&...


-3

Acunetix system was able to inject "sTYLe='acu:Expre/**/SSion(Afih(9717))'bad=" in your url and it is reflecting in your html code output. You should parse everything that is in double code especially special characters that is not normally used in url such as quote, double quote, stars... especially those that can affect an Sql Database. You can clean ...


11

That is just cargo cult security filling no real purpose. Any attacker who finds an XSS vulnerability could easily bypass that. Actually, probably they will never run into it the first place since there is no reason to include the name of the exploit in the payload. But if I discovered that any URL containing XSS resulted in a 404 I would be encouraged to ...


0

yes it is possible if only you could run the script on the same router page or with same url with some kind of local DNS rebinding to trick the browser that you are sending the request to the same site that the request is made from and both are the router page(address-ip) and redirecting only after you set the cookies manually ... or if some how you could ...


2

You should always validate user input. For example, since you're expecting an URL, you could check that the submitted string starts with http:// or https://. submitted_url.start_with?('http://', 'https://')


3

default-src * This is now the default policy for all directives that are absent. This is not as secure as it could be. Since there is no img-src directive, the value for default-src is used as img-src. This means that images can be loaded from any URL. This doesn't introduce a big security problem, since showing images is relatively benign. There is also ...


0

By default, XMLHttpRequest does not include cookies. Use withCredentials to send cookies along. As an alternative, you can create a HTML form and submit that with JavaScript. This sends cookies along by default.


3

If you have XSS, you can do literally anything that a script on the page could do. Read all the user's data on that site. Steal secrets (for that site) from their local storage. Prompt them to download malicious files from the trusted site. Tamper with the path to any file they do download, before they get it. Impersonate them in posts (on that site). Delete ...


Top 50 recent answers are included