1. Advertising
    y u no do it?

    Advertising (learn more)

    Advertise virtually anything here, with CPM banner ads, CPM email ads and CPC contextual links. You can target relevant areas of the site and show ads based on geographical location of the user if you wish.

    Starts at just $1 per CPM or $0.10 per CPC.

Nginx X-XSS-Protection 0

Discussion in 'Nginx' started by xss, May 9, 2018.

0
  1. #1
    Hello guys,
    Im new on this Forum I hope you can help me.

    I want to test a easy <script> alert("XSS"); </script> XSS attack on my Webseite.
    I have a nginx/1.13.12 Webserver and I think in the default settings is the X-XSS Protection on.

    So how can I enable X-XSS attacks in the webconfiguration?
    I try this on the screenshot but dont work.
    upload_2018-5-9_11-16-16.png
     
    xss, May 9, 2018 IP
  2. hostechsupport

    hostechsupport Well-Known Member

    Messages:
    413
    Likes Received:
    23
    Best Answers:
    7
    Trophy Points:
    138
    #2
    A 0 value disables the XSS Filter, as seen below.


    x-xss-protection:0;


    A 1 value allows the XSS Filter. If a cross-site scripting attack is recognized, to stop the attack, the browser will clean the page.


    x-xss-protection:1;


    A 1; mode=block value enables the XSS Filter. Instead of sanitizing the page, when an XSS attack is detected, the browser will prevent delivering of the page.


    x-xss-protection:1; mode=block
     
    hostechsupport, May 9, 2018 IP
  3. xss

    xss Peon

    Messages:
    2
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    1
    #3
    Thank you for your answer, I try "x-xss-protection:0;" but get a error message from my browser "ERR_CONNECTION_REFUSED"
    I dont know why it dosent work....
     
    xss, May 9, 2018 IP
  4. hostechsupport

    hostechsupport Well-Known Member

    Messages:
    413
    Likes Received:
    23
    Best Answers:
    7
    Trophy Points:
    138
    #4
    >> Can you share your URL to check the errors?
     
    hostechsupport, May 9, 2018 IP