Can an attacker use inspect element harmfully?

The changes are temporary on the individual user’s browser.

However, the changes will allow that user to interact with your backend however they choose to do so. This is one way in which sites are attacked.

The standard rule is to never trust input coming from the user / browser. Do not trust the value of hidden fields, do not trust that they have not changed the length, do not trust that they have not added new values (e.g. to a drop down), do not trust any validation that has been done in Javascript, etc.

Some examples:

  • Some shopping sites in the past would include the amount to be paid as a hidden field in the form. Changing this value changed the amount charged to a credit card while still approving the transaction.
  • Sites with Javascript validation rules that could be skipped by posting directly to the backend service opening themselves up to SQL and HTML / Script injection attacks.
  • Drop downs, radio button, and checkbox inputs where unexpected values can be added to the form.

Related Posts:

  1. What is the difference between a cer, pvk, and pfx file?
  2. How to solve “Kernel panic – not syncing – Attempted to kill init” — without erasing any user data
  3. What’s the best approach for generating a new API key?
  4. Is it possible to decrypt SHA1
  5. How does the SQL injection from the “Bobby Tables” XKCD comic work?
  6. Error `sec_error_revoked_certificate` when viewed in Firefox only
  7. Convert .pfx to .cer
  8. How can bcrypt have built-in salts?
  9. Getting a List of Currently Available Roles on a WordPress Site?
  10. Why should I use the esc_url?
  11. How safe / sanitized is wp_insert_posts()?
  12. From a security standpoint, should bloginfo() or get_bloginfo() be escaped?
  13. Where to securely store API keys and passwords in WordPress?
  14. Why are passwords exportable as plain text in WordPress?
  15. Full path disclosure on rss-functions.php
  16. What to use instead of wp_kses() in user output
  17. Are the default salts secure?
  18. Is there a way to force ssl on certain pages
  19. Subscribe to email for security fixes?
  20. What is the purpose of having a token in cookies?
  21. How to escape custom css?
  22. Understanding SVG vulnerabilities in WordPress related to a specific fix
  23. How is password strength calculated?
  24. How to secure or disable the RSS feeds?
  25. Regular security checks – what steps should be included?
  26. What are the pros and cons of using a custom front-end to retrieve content from a WordPress back-end
  27. Do Cookies Need to be Sanatized Before Being Saved?
  28. Disable external access to REST API Endpoint
  29. Make password invalid once logged out of password-protected page
  30. What is the wp-includes/certificates/ca-bundle.crt used for?
  31. Do you need to escape hard coded plain text?
  32. Encrypt emails?
  33. Garbage in beginning of wp-config.php – was this WP installation compromised?
  34. WordPress salts set in config and database
  35. Disallow file edit not preventing plugin install
  36. How to secure WordPress XMLRPC?
  37. Protecting HTML5 video [closed]
  38. What is the relationship between cURL, WordPress and cacert.pem?
  39. How can I find security hole in my wordpress site?
  40. Does WP show me if I’m logged in from multiple locations?
  41. Do I need to use the esc_html() function on hard coded links?
  42. How to prevent bot or someone to modify any file automatically?
  43. WordPress Malware Problem help! [duplicate]
  44. Frontend Password change
  45. Restrictive File Permissions
  46. Downloading File from Outside Web Root
  47. Why are xmlrpc.php and wp-cron.php being called so often?
  48. Using esc_html with HTML purifier and CSSTidy: Overkill?
  49. wordfence scan warning on W3 Total Cache [closed]
  50. site get login attempts after htaccess ip restriction
  51. Is it good security advice to install wordpress in subdirectory but link to root?
  52. wp-config.php modified?
  53. Moving wp-config.php up 2 levels
  54. How Could I sanitize the receive data from this code
  55. WordPress SQL Injections through User Agent
  56. How to save iframe tag into a post?
  57. How to prevent wp-login brute force attack from thousand of different IP? [duplicate]
  58. What permissions should I give directories if I want to make WordPress more secure?
  59. How to protect wp-admin through .htaccess?
  60. Something is unescaping all html entities before output to browser [closed]
  61. my wordpress website is suspended [closed]
  62. Is wp_kses the right approach in sanitizing this string?
  63. Renaming install.php for security?
  64. Is WordPress MultiSite secure & how much can it scale? [closed]
  65. Limit Login Attempts BEFORE PHP is executed?
  66. Which Versions of WordPress Ship with the Patched TimThumb?
  67. Safe to say WordPress security releases don’t have database upgrades
  68. Use global variables or function that returns said variables for site-wide private-ish WP settings?
  69. fail2ban to prevent Brute Force Attacks on WordPress?
  70. Use Google authentication for pages within a website [closed]
  71. How to give the same error message when the wrong password or wrong username is used?
  72. should I escape a literal url added in functions.php
  73. Someone keeps changing my SITEURL (mysql injection or xss?) [closed]
  74. Moving wp-config.php outside root folder where we have multiple wordpress websites for enhanced security [duplicate]
  75. Adding Security Keys?
  76. How might I sanitize an XML file before WP Import? (Does wordpress verify or clean text when importing from an XML document? )
  77. Secret keys in SCM
  78. Secure Server after configuration
  79. Uploading attachment (pdf) and prevent download for anonymous user
  80. After limiting the access to my wp-login.php by IP through .htaccess, all my password-protected posts stopped working. What’s the best solution now?
  81. Specific Page/Post Need to Stay Non SSL
  82. Block JSON access over the net
  83. Can someone do something to my website if I posted a snapped image of the header and covered my logo? (On reddit, when explaining a question)
  84. Scan multiple websites for malware that are in same webhost root?
  85. The in-famous Unable to locate WordPress Content directory (wp-content) and the Direct Method
  86. Security: AWS (shared hosting) claims template file malicious
  87. Why are the latest visits to my website originating from my own website?
  88. How to check whether a site has been compromised without browsing into it?
  89. My site thinks it’s secure when it is fact not
  90. Is it possible to only have the admin interface bind to the local loopback?
  91. PHP Code Sniffer – WordPress VIP Coding Standards
  92. Trying to understand nature of hacking
  93. Default installation permissions for wp-config.php
  94. Correct setup to block file modifications from hackers
  95. Is my WP site being hacked?
  96. How do you search for backdoors from the previous IT person?
  97. Possible to change email address in keypair?
  98. Why is SSH password authentication a security risk?
  99. Is wp-cron.php vulnerable to external attacks and how to protect it?
  100. How to address security vulnerabilities: LUCKY13, BEAST, and BREACH

Leave a Comment