Sekure4Sure

Posts

Showing posts from June, 2016

Location.Hash exploit || JQuery 1.11.3/1.7.2/1.6.1 Cross Site Scripting

June 03, 2016

This is the code for exploiting (location.hash) JQuery for Cross Site Scripting: <html> <head> <title>Jquery XSS Test 1</title> <script type="text/javascript" src=" https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js "> </script> <script> $(location.hash.split('#')[1]); </script> </head> <body> Jquery DOM XSS </body> </html> OR, <html> <head> <title>Jquery XSS Test 2</title> <script type="text/javascript" src=" https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js "> </script> <

Jquery Vulnerability Finder - Retire.js

June 03, 2016

There is a plenty of JavaScript libraries for use on the web and in node.js apps out there. This greatly simplifies, but we need to stay update on security fixes. " Using Components with Known Vulnerabilities " is now a part of the OWASP Top 10 and insecure libraries can pose a huge risk for your webapp. Configure Retire.js for Chrome Browser: Step#1 : Download the Retire.js libraries form " https://github.com/RetireJS/retire.js " in zip format. Step#2 : Extract the zip to folder. Step#3 : Now use Bash terminal (Cygwin for Windows) and executes build_chrome.sh file. Step#4 : Open Chrome and Go to Extensions tab. Step#5 : Click "Load unpacked extensions" and browse for chrome folder located in Retire.js libraries folder. Step#6 : Click Ok button, Retire.js extension got installed and listed in tab. Now you can use this extension for finding vulnerabilities in Jquery. Step#