Collaborate Disseminate
I was doing some challenges in portswigger, when I stumbled accross this xss exploit in a csrf lab solution :
<img src="https://YOUR-LAB-ID.web-security-academy.net/?search=test%0d%0aSet-Cookie:%20csrf=fake%3b%20SameSite=None"… Continue reading Control cookies with XSS by adding set-cookies inside a html code?
I’m learning about the different mitigations employed by browsers against XSS vulnerabilities.
Let’s say, the developer made a mistake and there is a XSS vulnerability on a site. Unfortunately, a hacker exploited the vulnerability and is a… Continue reading How do browsers defend the user against XSS?
var elem = document.createElement(untrustedinput1);
elem.style.paddingLeft = untrustedinput2;
I am just wondering if it’s possible to pass XSS payloads via tags while creating an element in Javascript.
I’m having a Spring Web Application that exposes REST APIs.
I have implemented XSS filter using Jsoup that strips the input using Safelist.NONE.
The penetration testing team raised a concern where the input field content is URL encoded, th… Continue reading Jsoup XSS attack with URL encoded input
Current projects webs application utilises a cookie based approach to store users auth token. Implemented with secure and http-only attributes set. All traffic over https. The application loads third party javascript from a range of extern… Continue reading Storing auth token in html
Sample code:
function winLoad() {
var sessionId = ”;
if (window.location == window.top.location) {
var semicolonIndex = window.location.href.indexOf(‘;’);
if (semicolonIndex != -1) {
var questionMarkInd… Continue reading Client-side Javascript injection by assinging the output of window.location.href.substr to a variable
I run a small blogging platform, and I want my users to be able to embed javascript that runs on their blogs (to manipulate the DOM, etc. as you might if you were hosting your own website). However, I do not want them to be able to:
It is known that in modern browsers you can’t run XSS in img src(assuming quotes are escaped), because neither javascript: protocol, nor svg will execute the code. But does it mean that trusted data with filtered quotes is unable to cause … Continue reading Vulnerabilities in img src
During our Red/Blue team practice my friend made a web forum application where people can post messages.
What he did was filtering:
The equal sign
The key words: "javascript", "alert", "url"
Some keywords tha… Continue reading Can someone bypass this XSS filter
What does this function do?
Which XSS script elements can bypass this function
preg_replace(‘/<script[^\>]*>|<\/script>|onabort|onblur
|onchange|onclick|ondbclick|onmousedown|onmousemove|onmouseout|
onmouseov… Continue reading Which XSS script elements can bypass this function? [closed]