Hello! While testing various applications, I encountered a scenario similar to the following (I've altered the names for this example):

var myObject = {
    mySubObject: {
        search: {
            type: 'irrelevant',
            result: '<payload>',
            origin: '<payload>',
            some_more_stuff: 'irrelevant'
        }
    }
}

The payload will be placed in both positions.

This application encodes entities such as <, >, ', ", etc. to HTML. However, it fails to sanitize certain entities like \, %0A (a literal newline), and other percent-encoded characters not mentioned above.

Any suggestions for a potential attack vector?

Hey, imagine that we have these tags filtered. script|iframe|svg and also the word 'on' is filter (which means we cannot use <img/src/onerror=alert> or other vectors like this). Could you guys please tell me which HTML tag I can use to run the JS code? (All the filters are case-insensitive.)

https://xss.challenge.training.hacq.me/challenges/easy04.php
I am trying to solve the above challenge
Not able to exploit the vulnerability with symbols blocked.
If you guys have solved it what is the solution??

I've recently started looking at web hacking on burpsuite and have just began the XSS module. In the labs im currently doing : Lab: DOM XSS in document.write sink using source location.search. I've completed the lab but I don't understand how the XSS works in some places not others. On the test i search for 'abc' and notice it's reflected in two places. <h1>0 search results for 'abc'</h1> and <img src="/resources/images/tracker.gif?searchTerms=abc" e17walpp1="">. I figured out how to cause an XSS in the <img tag> with " onerror="alert(1)". I then wanted to try cause an xss in the <h1> tag and ended up with this <h1>0 search results for ''</h1><script>alert(1)</script>'<h1></h1> even though it's perfectly reflected in the source code, why does this not cause an alert? Sorry if this is a stupid question but I've just started and can't figure it out, thanks.

Hey, I’m testing my friends website. How would someone extract everyone’s cookies or session ID’s from an insecure website? Any templates or prompts?

Thanks

Hi,

There's a feature on burp which allows us to filter by parameter's, is such a feature available on zap? I was able to spider a website with zap, now I want to view the request which have parameter's in them, any idea how I can achieve this?

Thank you!

Am I allowed to test for reflected XSS on any website? Like, if the website dont have bug bounty program, can i still test on it?

I have a question, or rather two, first, in what environment do hackers work? Maybe Kali Linux?, and second, where do these hackers get their training, because really to what extent I have studied and my thoughts tell me that Black hats are always one step ahead of white hats or Ethical Hackers.

A lot of websites now have chatbots that are just wrappers around an API call to GPT3 or a comparable LLM.

Sometimes these chatbot interfaces aren't properly sanitised. The user inputs won't work, but if you can talk the GPT into writing the XSS payload for you, it actually executes because the devs didn't anticipate their own chatbot attacking the site.

I was trying on my own website to steal my cookies of another website but I don't really know how to...

Any help? I mean, once you get into my website a script appears and steal my cookies from a specific domain, is that possible?

​

Thank you in advance

A part of the page we add a bunch of hidden inputs into which we write string values, primarily for changing language strings. The values are loaded from a database table

In the javascript we might do something like

var welcome = $('#lang_welcome').val();
$('#head_title').innerHtml(welcome);

This is a bit of a contrived example but is a simplified version of what we are doing. As none of the values are user entered data or taken from queries or param I would have thought this is safe but the argument is that someone could change the value of the input to be something malicious which would then been written to the dom. I'd have thought that if someone has access to change the input value then they've got enough access to write to the dom anyway.

Can someone explain what the security issue is here as my understanding was you always escape untrusted data but it appears that I have to sanitise every change to the dom regardless of the source.

first char: ~ second char: . third char: _ fourth char: - and of course all alphabets are allowed

Although it seems very vulnerable, I can't seem to find an XSS that works on chrome ( haven't tried other browsers )

Here is a link to play around with:
https://xsstests.tiiny.site/

Tried googling but didn't find any way! I found a directory of domain where images are broken and page is messed up any ways i can inject xss ? I tried it on inspection it goes self attack

Hello hackers, I would like to know if my find is a valid XSS or just an auto XSS. Well, I was browsing through the platform of an online course that I'm taking, so I decided to intercept some requests in a questionnaire that I was answering. When sending one of the requests to Burp's repeater, the site returned me with an error page, saying that something was wrong, and with a "try again" button, when I clicked on the button I intercepted a somewhat interesting response. Soon I decided to add a payload as shown in the following figure:

https://preview.redd.it/qxkeok3m4zjb1.png?width=796&format=png&auto=webp&s=1b11e7ae38c61f6a72e42a7059c9d4827f8bee47

When sending the edited response to the server, nothing happened, but when I clicked the "submit all and finish" button, I received an alert in my browser, as shown in the following figures:

https://preview.redd.it/czamq3jq4zjb1.png?width=1086&format=png&auto=webp&s=2a79feda6766217354637d09db3929f18af48b05

https://preview.redd.it/kjya6e9r4zjb1.png?width=567&format=png&auto=webp&s=916d7c6079a7ab4c9a594bbe8a85dae79e9cfe17

https://preview.redd.it/lgo998wr4zjb1.png?width=782&format=png&auto=webp&s=cd8974e6629a33d14165f7ebdceadbee479d65e8

In short: I already logged out of the account, I closed and reopened the browser and the payload continues on the button. That is, it is a stored XSS. In addition, the payload is found in buttons on other forms that have the name "submit all and finish".

So I would like to know if this is just a self XSS, and if so is there any way to escalate this to something reportable?

I'm trying to solve an XSS CTF challenge on a website and have found the XSS entry point via <img src=x onerror=alert(1)>. However, the url parameter I'm injecting this payload in is limited to 40 characters, which is checked by a global JavaScript function via m.length. But I need the actual executed code (instead of alert(1)) to be a fetch command with an url etc... Which obviously exceeds 40 characters. Now I'm stuck at this point. Any clues on this?

I'm testing for xss on a certain website inside search field.

As far as I have understood the website has some special characters blacklisted such as " and <> except for =

When I enter any of the blacklisted characters as plain text or url encoded it reflects in the source as HTML encoded. For example I entered " or %22, it reflects as " but on the webpage it reflects in plain text that is " .

If I enter html encoded character it seems like the website has completely ignored it and the value parameter of the search field appears empty in source code.

The code seems something like this when I put " or %22: <input placeholder="search" value=""" ....>

It seems like this when I put = or %3D:

<input placeholder="search" value="=" ....>

Any idea about how can I escape the quotes of the value parameter.

Thanks in advance.

I'm doing this lab on portswigger - https://portswigger.net/web-security/dom-based/controlling-the-web-message-source/lab-dom-xss-using-web-messages

I have looked at the solution, but I can't figure out why my solution won't work. Here is my solution:

<script> 
window.pwned=window.open('https://[LAB_ID].web-security-academy.net/');           window.pwned.postMessage('<img src=x onerror=print()>', '*'); 
</script> 

Why is this not working? It is sending postMessage to vulnerable website and executing print().

It is called XSS Survival Guide, by Wesley Thijs, is it worth it?

My XSS doesn't execute for some reason, i bypassed sanitization, CSP and SRI, but browser just ignores the script like it doesn't even exist, also there aren't any errors mentioning this in the console, when i tried this payload on other sites it works without a problem.

​

https://preview.redd.it/im9a7blkobbb1.png?width=340&format=png&auto=webp&s=deb63b5bbd825c789a17a537c0dd532475c37ab4

Been working on a WASM interopt layer for accessing DOM, and considering scenarios where data is being interpolated with user content and how to sanitize. Some of the edge cases like attribute execution I did not reallize until now were possible with things like jQuery.parseHtml. Reading through https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html I'm seeing that it's very context sensitive as to where the potentially unsafe content appears in the structure and what sanitization is necesary.

They use ESAPI for the different types of sanitization.

I'm wondering if anyone has familiarity with this library? Is it still a good tool for the job?

Hi,

Recently I learned React and read a post about XSS best practices.

I'm curios, if a website was built in React, is it vulnerable to cross site scripting?
Thanks!

Hey guys, so I found a place on a website where there's xss exploit .i.e. I used <script>alert(1)</script> and it's popping the alert. Now I was told there's a flag in this, any idea on how to get this flag ?