33:I[204091,["/_next/static/immutable/chunks/0flq6dgj4r1ua.js"],"IconMark"] 2b:null 2c:["$","title",null,{"children":"XSS Hunter Report | Abhishek Chaudhary | Observable"}] 31:T2117,md`# XSS Hunter Report The page located at \`https://theabbie.static.observableusercontent.com/worker/worker.2e73608f8145b91e73428b4c507ff71657bde06e5c8a1470dff7af4714c84ae0.html\` suffers from a Cross-site Scripting (XSS) vulnerability. XSS is a vulnerability which occurs when user input is unsafely encorporated into the HTML markup inside of a webpage. When not properly escaped an attacker can inject malicious JavaScript that, once evaluated, can be used to hijack authenticated sessions and rewrite the vulnerable page's layout and functionality. The following report contains information on an XSS payload that has fired on \`https://theabbie.static.observableusercontent.com\`, it can be used to reproduce and remediate the vulnerability. ### XSS Payload Fire Details ##### Vulnerable Page \`https://theabbie.static.observableusercontent.com/worker/worker.2e73608f8145b91e73428b4c507ff71657bde06e5c8a1470dff7af4714c84ae0.html\` ##### Victim IP Address \`49.32.50.36\` ##### Referer \`https://observablehq.com/new\` ##### User Agent \`Mozilla/5.0 (Linux; Android 10; Redmi Note 7 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.111 Mobile Safari/537.36\` ##### Cookies (Non-HTTPOnly) ##### Document Object Model (DOM) \`\`\`html

XSS Test

\`\`\` ##### Injection Point (Raw HTTP Request) \`\`\`http Could not correlate XSS payload fire with request! \`\`\` ##### Origin \`https://theabbie.static.observableusercontent.com\` ##### HTML5 Canvas-Rendered Screenshot https://api.xsshunter.com/uploads/xsshunter_screenshot_920c4fce8011cf88461b1af2bbae5c61b494f51d6211cb13172f58691bf2289a04615b514f4962c09d5b71e7177b72b48e1553c32d5dfe72cf1f67bfb07a80b4c3b4b963a96bdc50ab340c33edd2eaace29f2e740e596b491c04beb4e99e8628dff8de9b.png ##### Injection Timestamp \`1597127790\` ## Remediation For more information about Cross-site Scripting and remediation of the issue, see the following resources: * [Cross-site Scripting (XSS) - OWASP](https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)) * [XSS (Cross Site Scripting) Prevention Cheat Sheet - OWASP](https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet) * [What is Cross-site Scripting and How Can You Fix it?](https://www.acunetix.com/websitesecurity/cross-site-scripting/) * [An Introduction to Content Security Policy - HTML5 Rocks](http://www.html5rocks.com/en/tutorials/security/content-security-policy/) * [Why is the same origin policy so important? - Information Security Stack Exchange](https://security.stackexchange.com/questions/8264/why-is-the-same-origin-policy-so-important) *This report was generated by the service hosted at [XSSHunter.com](https://xsshunter.com/).*`32:[] 2f:{"id":"2e3f371381315e66","slug":"xss-hunter-report","title":"XSS Hunter Report","thumbnail":"651d043732e1fde95c510ac7b81dace4c776333933c7ae4a6f5864dd6ab1360e","access_level":"public","create_time":"$D2020-08-11T06:47:15.937Z","update_time":"$D2020-08-11T06:49:45.493Z","view_time":null,"first_public_time":"$D2020-08-11T06:49:58.056Z","fork":false,"stars":0,"starred":false,"owner":{"type":"team","id":"ccf7cb5fa86fcb70","login":"theabbie","name":"Abhishek Chaudhary","avatar_url":"https://avatars-next.observableusercontent.com/df677d40f6d3c24c4c8348548d48cab73a603d1dae41ec75a6203e2e3220338b","tier":"starter_2024"},"version":6,"publish_version":6,"role":null,"authored":false,"authors":[{"type":"individual","id":"8ba558dab326138c","login":"theabbie","name":"Abhishek Chaudhary","avatar_url":"https://avatars-next.observableusercontent.com/df677d40f6d3c24c4c8348548d48cab73a603d1dae41ec75a6203e2e3220338b","tier":null}],"members":[{"type":"individual","id":"8ba558dab326138c","login":"theabbie","name":"Abhishek Chaudhary","avatar_url":"https://avatars-next.observableusercontent.com/df677d40f6d3c24c4c8348548d48cab73a603d1dae41ec75a6203e2e3220338b","tier":null,"role":"editor"}],"comments":[],"custom_thumbnail":false,"trashed":false,"subscribed":null,"forks":0,"collection":null,"type":"notebook","body":{"title":"XSS Hunter Report","cells":[{"id":0,"value":"$31","pinned":true,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined"}],"files":"$W32","stdlib":"1","titling":"auto"}} 30:"$2f:body" 24:null 28:[["$","title","0",{"children":"XSS Hunter Report | Abhishek Chaudhary | Observable"}],["$","meta","1",{"property":"og:title","content":"XSS Hunter Report"}],["$","meta","2",{"property":"og:description","content":"An Observable notebook by Abhishek Chaudhary"}],["$","meta","3",{"property":"og:url","content":"https://observablehq.com/@theabbie/xss-hunter-report"}],["$","meta","4",{"property":"og:site_name","content":"Observable"}],["$","meta","5",{"property":"og:image","content":"https://static.observableusercontent.com/thumbnail/651d043732e1fde95c510ac7b81dace4c776333933c7ae4a6f5864dd6ab1360e.jpg"}],["$","meta","6",{"property":"og:image:width","content":"640"}],["$","meta","7",{"property":"og:image:height","content":"400"}],["$","meta","8",{"property":"og:type","content":"article"}],["$","meta","9",{"name":"twitter:card","content":"summary_large_image"}],["$","meta","10",{"name":"twitter:title","content":"XSS Hunter Report"}],["$","meta","11",{"name":"twitter:description","content":"An Observable notebook by Abhishek Chaudhary"}],["$","meta","12",{"name":"twitter:image","content":"https://static.observableusercontent.com/thumbnail/651d043732e1fde95c510ac7b81dace4c776333933c7ae4a6f5864dd6ab1360e.jpg"}],["$","meta","13",{"name":"twitter:image:width","content":"640"}],["$","meta","14",{"name":"twitter:image:height","content":"400"}],["$","link","15",{"rel":"icon","href":"/favicon.ico?favicon.2hqc0rwsy9zm6.ico","sizes":"96x96","type":"image/x-icon"}],["$","link","16",{"rel":"icon","href":"/icon.png?icon.1mhghqfpotdlb.png","sizes":"512x512","type":"image/png"}],["$","$L33","17",{}]]