DaniEll
  • Member for 7 years, 2 months
  • Last seen this week
Any non alert() based non malicious XSS payloads?
6 votes

With DOM-Manipulation one could change the page itself. In case one knows the target page, it can be manipulated in some nice ways. An easy example would be: document.body.innerHTML = 'XSS';

View answer
Can play store applications be tampered with by Google?
3 votes

According to the Android Developer Documentation: Android requires that all apps be digitally signed with a certificate. [...] The certificate does not need to be signed by a certificate ...

View answer
How to make a victim submit a post via XSS?
2 votes

There is a major difference between code executed in the developer console step by step[!] and JavaScript that's part of the page: All running JavaScript is stopped when you navigate away to another ...

View answer
Is the separation of data from different applications via Oracle schemas considered secure?
Accepted answer
2 votes

It is a common concept to create specific Database-Users for each application. These users should have the minimum privileges needed to do their job. Lets apply this to your example: ApplicationA ...

View answer
Can “c:set” cause Cross Site Scripting (XSS) vulnerability?
1 votes

No, your code is fine. Cross Site Scripting requires untrusted input to be interpreted as code in the browser. Your code is safe, because it does not reflect the untrusted input (myVar) back into ...

View answer
Is it possible to make the back button work if we use one CSRF-token per request?
1 votes

The solution used in my Web-Applications (JSF) is to tell the browser to make a new GET-Request on browser-back (or reopen tab). This is done with the following HTTP Response Header: Cache-Control: ...

View answer