Collaborate Disseminate
I’m attempting to make a site with an example of what XSS would look like, so in this I take user input and set a paragraph element’s innerHTML to the user input but the script isn’t running. However the script tag is present within the sp… Continue reading Why is this XSS not working on my site?
I found a curious website that shows listings. It allows you to type a description, and also allows for you to use tags like <b> and <u> for formatting.
But it doesn’t let you do more interesting things like <a> and <l… Continue reading HTML Injection into custom sanitiser
I have a requirement to support some external integration to a 3rd party vendor on our site (which is a SaaS site with multiple tenant logins). The vendor requires a script and a global variable to be available which the script reads to ge… Continue reading Threat Assessment Javascript User-controlled Variable Names on Window
I just noticed in my access.log several POST requests coming from a (hidden) registration sub page that is not accessible via any link. A ‘hacker’ seems to have posted a form from there (manually it seems), using a random email as input. I… Continue reading IP address in access.log is incorrect and likely hacked
I have an anchor that has href attribute populated by my input. I am trying to input javascript, but it always renders it useless since it always appears between double quotes.
So far, I have tried many inputs including:
javascript:alert(1… Continue reading XSS – Anyway to bypass double quotes in href of anchor?
I want to clear my doubt that Is there any issues coming from adding ‘Strict-Transport-Security’ and ‘X-XSS-Protection’ headers ?
Header set Strict-Transport-Security "max-age=10886400;
Header set X-XSS-Protection "1; mode=block&… Continue reading Headers X-XSS-Protection issue
I want to access data in a PHP variable from JavaScript code. An (old) OWASP cheat sheet recommends embedding it in HTML before accessing it, an approach like this:
<div id="init_data" style="display: none">
<… Continue reading Is PHP json_encode sufficient for HTML data blocks?
I’m testing a parameter for xss and getting reflection of input but all tags are filtered out and the value can’t be closed because double quotes are converted to ///////" is there anyway to bypass it to execute xss here?
Continue reading My input double quotes are converted to \\\\\\\" for XSS
<div class="comment">
—————
</div>
How to do XSS between div tags without angle bracket?
Continue reading How to XSS inside div tag without angle bracket?
I’m trying to make an automated XSS detection toolkit for myself and I’m using google’s firing range for testing it. For this particular case of escaped XSS in HTML context https://public-firing-range.appspot.com/escape/serverside/encodeUr… Continue reading How to bypass server-side URL encoding ? [Firing-Range automation]