New answers tagged xss
0
votes
What happens if my anti-CSRF token is compromised by an XSS attack?
An XSS attack, while it is ongoing, strictly dominates CSRF; anything an attacker could do with CSRF, they can do with XSS (and much more besides).
However, there is a question: what happens after the ...
- 46.3k
0
votes
XSS against jQuery PortSwigger challenge
The vulnerable code is this:
<script src="/resources/js/jquery_1-8-2.js"></script>
[...]
<script>
$(window).on('hashchange', function(){
var post = $('section.blog-list h2:...
- 29.5k
0
votes
Is it safe to store the OIDC token in a private field of a javascript object?
Safe enough, sure, lots of sites do this. An attacker who gets XSS on the site might still be able to extract the token, depending on exactly how the function that adds it to API calls is invoked (for ...
- 46.3k
0
votes
is a stored xss possible if user input is not saved?
Interestingly, I would say "yes".
For me the core difference between stored XSS (sXSS) and reflected XSS (rXSS) is in the exploitation. rXSS reflects input back for one user in the same HTTP ...
- 29.5k
Top 50 recent answers are included