4 ms·
To be fair, you don’t need JS in the exploited website to do XSS.
by IggleSniggle 5y ago
To be fair, you don’t need JS in the exploited website to do XSS.
- calcifer 5y agoBut they also said non-interactive, so I'm assuming no forms of any kind either.
- IggleSniggle 5y agoTrue. Although…you could also potentially use reflected URLs or cookies to pull off some kind of XSS attack.
- schemescape 5y agoI just confirmed this on my own static site which has no forms or any input whatsoever (and no JavaScript, cookies, or external resources either). But I guess I wouldn’t use this tool on such a trivial site anyway.
- agilob 5y agoI moved my website from wordpress with 20 plugins, comments, disqus and lazy loaded images to static pages generated from markdown using Hugo. It's literally plaintext no JS, no tracking, no cookies at all. I got downgrade from B to D for not having CSP, XSS and XFrames protections. I don't even have forms or JS on my blog anymore. All content is loaded from 1 domain.