This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Testing for JavaScript Execution (OTG-CLIENT-002)
From OWASP
Revision as of 17:42, 14 December 2013 by Mmeucci (talk | contribs) (Created page with "{{Template:OWASP Testing Guide v4}} == Brief Summary == a == Description of the Issue == a The first hypothetical example uses the following client side code: <script>...")
This article is part of the new OWASP Testing Guide v4.
Back to the OWASP Testing Guide v4 ToC: https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table_of_Contents Back to the OWASP Testing Guide Project: https://www.owasp.org/index.php/OWASP_Testing_Project
Brief Summary
a
Description of the Issue
a
The first hypothetical example uses the following client side code:
<script> aaa </script>
Black Box testing and example
Blackbox testing for JavaScript Execution is not usually performed since access to the source code is always available as it needs to be sent to the client to be executed.
Gray Box testing and example
Testing for JavaScript Execution vulnerabilities:
a
<script> aaa </script>
References
OWASP Resources
- DOM based XSS Prevention Cheat Sheet
- DOMXSS.com - http://domxss.com
Whitepapers
- Browser location/document URI/URL Sources - https://code.google.com/p/domxsswiki/wiki/LocationSources
- i.e., what is returned when you ask the browser for things like document.URL, document.baseURI, location, location.href, etc.
