Collaborate Disseminate
I am attempting to perform an XSS attack on my server and have successfully bypassed the CSP. In my server code, I store all users in the following manner:
.get("/users", adminReq, (req, res) => {
…
})
Due to the adm… Continue reading Overcoming Middleware: Exploiting XSS to Retrieve Data
I have a website that includes CSP rules:
.use(
helmet.contentSecurityPolicy({
directives: {
defaultSrc: ["’self’"],
scriptSrc: [
"’self’",
"cdnjs.cloudflare.com"
],
},
})
)
… Continue reading Overcoming Cookie Theft Barrier in XSS Attack despite CSP Implementation
I am using Content Security Policy (CSP) rules in my code to defend against XSS attacks. Here are the CSP rules I have implemented using Helmet:
.use(
helmet.contentSecurityPolicy({
directives: {
defaultSrc: ["’self’"],
scriptSrc… Continue reading Bypassing CSP and implementing XSS attack
If a web app is giving normal "not found" page for /blablablaalsdf but for certain paths, it doesn’t give the normal 404 page but gives Cannot Get /<path> instead, would this be an indicator that this path (and whatever un… Continue reading Can we identify secondary contexts from web application error messages? [closed]
I would like to restrict the installation of npm package in some projects of my company to releases that are at least X weeks old.
The reason for that being that given enough time before installing a package version, it is likely that if t… Continue reading Only install packages that are at least X weeks old [migrated]
I want my expresJS server to detect and stop any request containing XSS input before it gets saved in the database, as my website does not utilize any html input, and it does not need to.
What is the best method for doing that?
Continue reading Preventing HTTP requests containing XSS in nodeJS
This week, Jonathan Bennett and Jeff Massie talk with Julian Lam about NodeBB! It’s modern forum software that actually has some neat tricks up its proverbial sleeves. From forking of …read more Continue reading FLOSS Weekly Episode 773: NodeBB — Don’t Do the Math
I only use two programs VSCode and Electron Fiddle for my crypto assets and token projects. Lately I’ve been getting the same Java processing errors,
at internalCompileFunction (node:internal/VM:73:18
at wrapSafe (node:internal/modules/cjs… Continue reading IDE VSCode JavaScript [closed]
Does Node.js’s npm package manager cryptographically validate its payload’s authentication and integrity for all packages after downloading them and before installing them?
I see a lot of guides providing installation instructions with ste… Continue reading Does Node.js’s npm provide cryptographic authentication and integrity validation?
I’m currently learning React to host a personal website (on an Ubuntu server) and am port forwarding it to allow access from the internet.
However, for security reasons, I’d like one or more pages to only be accessed on my LAN. If an exter… Continue reading Is it possible to disallow external IPs from accessing a page of a React site? [migrated]