Collaborate Disseminate
I got suspicious messages from the same person on Ebay and was wondering if anyone knows what kind of command this is supposed to be. It could be that Ebay actually recognized the attempted xss-attack and cut out the malicious part, so now… Continue reading Is this an attempted xss-attack? [closed]
I have written a Python script to inject a payload through the requests library, but the payload is being added instead of injecting
xsstestscript=html.unescape("<script>alert(1)</script&am… Continue reading Failed to inject payload with Python requests library in DVWA forms
I have been playing around with the DVWA stored XSS page and wondered if someone could help.
I used XSS Validator in Burp and found numerous payloads that give a prompt, indicating that XSS is present.
One of the payloads that was successf… Continue reading XSS Payload Cookie Stealing
It’s been quite a few years since the last time I did web development and I realized many things have changed: instead of stateful server-side sessions with authentication cookies and CSRF tokens now we have localStorage/sessionStorage, Si… Continue reading JSON Web Token splitting
Hello I was testing on a private program where I was able to inject XSS but for some reason it is not popping up when I put the mouse over the input field.
<input type="text" onmouseover="alert(document.cookie)">
… Continue reading XSS attack not executing with correct payload
I’m building an application which will support both browser and application access to REST resources.
Applications will POST a username/password JSON body to a login endpoint which will return a signed JWT token in the response body. This… Continue reading CSRF and XSS Protection with a Static Site and REST API
In a scenario where an attacker has control over the src attribute of an img HTML tag, they could easily inject a simple JavaScript XSS payload like the following:
<img src="javascript:alert(1)">
The attacker can not manag… Continue reading Can XSS ever occur in an <img> tag’s "src" attribute?
I have an object that is stored in the server side of the application. It is never inserted into the DOM. The object looks like this:
{"id": "34245425", "field": false, "information": [{"message… Continue reading Is this server side object vulnerable to XSS?
I have been looking into XSS pertaining to base64 encoding a data URI into an <object> tag (which is typically considered only a feasible XSS payload in Firefox), but I am failing to understand how this is a XSS attack? For example (… Continue reading How is Object Tag data URI XSS actually XSS?
There are demonstrations of how to get cookies when person visits site with xss, but is it possible to get his User-Agent?
If yes, how?
Continue reading Getting User-Agent and cookies parameter with XSS