Collaborate Disseminate
I am trying to perform XSS but to get out of the context and write the payload I need to use Angle brackets and the angle brackets are html encoded. I tried double encoding technique with url encoding+html encoding, url encoding+url encodi… Continue reading How to use html encoded characters to perform XSS?
With standard XSSI, an attacker can include a remote script which contains user-bound secrets across origins, and then read them out.
I have an endpoint which returns sensitive Javascript code, but the request to fetch it is POST-based (th… Continue reading Is POST-based XSSI possible?
I have a bunch of REST APIs which would be consumed by frontend applications created by customers using our product. I have suggested to only use last 2 versions of Chrome for running frontend apps. They would be using Angular.
I was going through Angular’s security guide which says,
Cross-site script inclusion, also known as JSON vulnerability, can
allow an attacker’s website to read data from a JSON API. The attack
works on older browsers by overriding built-in JavaScript object
constructors, and then including an API URL using a tag.This attack is only successful if the returned JSON is executable as
JavaScript. Servers can prevent an attack by prefixing all JSON
responses to make them non-executable, by convention, using the
well-known string “)]}’,\n”.
I checked the related questions on SO/SE. Going by the accepted answers, it seems that this used be a vulnerability a long time ago when browsers allowed overriding Array constructor.
Is it still possible to have JSON vulnerability attack given latest version of Chrome will be used?
Related SE/SO questions:
I am performing penetration testing on a web application. Let’s say the site as "https://example.com"
There is a comment field , where a user can add data and it will be shown in the same page.
So I was trying multiple payloads a… Continue reading How to turn this particular HTML rendering into a XSS or open redirection
I was looking for xss vulnerabilities in a bitcoin exchange and came across a url like:
https://www.xyz.com/en/buy-crypto?cur=USD&cry=BTC&amount=500&ref=123456
I tried the standard cheat sheet to check for vulns in the ‘amount… Continue reading XSS with -prompt`1`-
I trying to gain a deeper understanding of XSSI.
What are some easy ways to test XSSI vulnerabilities?
And can I test XSSI by Xampp Apache server?
Let’s say i have an API at https://mysite/api/getSensitiveData that:
Uses GET
Protected with cookie authentication
Returns JSON with some sensitive data
A bad guy creates a site on his server that has an image tag:
<i… Continue reading Is some kind of CSRF possible using img tag to read sensitive information
I’m not familiar with Javascript, but I want to know what can’t be done in this steps in order to bypass SOP and extract sensitive data :
set the tag <script src=”https://facebook.com/messages”></script>
the bro… Continue reading Why can’t bypass SOP using "src" attribut in script tag?
I must say, that I like this idea and it seems that it will bring a new form of protection against CSRF and XSS or at least it will reduce those attacks.
So, how effective will this protection be?
SameSite-cookies is a mechanism for d… Continue reading Will same-site cookies be sufficient protection against CSRF and XSS?