_{_{This article is optimized for Desktop browsers and Peakd}}

----- ![watermark.png](https://files.peakd.com/file/peakd-hive/keys-defender/23wWpaeUGCucxr39rwxbbt4WREDfKtGT7ZFp9roiHeRJPzgZM9o16RowjZoFVtq93emMN.png) _{Image AI-generated by @karina.gpt in the Crypto Shots [server](https://crypto-shots.com/discord)} ----- I recently volunteered to test a Hive Dapp (that won't be named at the very least until all the flagged issues are resolved). #### Please find below my findings. Use these to ensure that your own Hive frontend has protections in place for things like these. #### Don't know how? Stay tuned for my guide on how to build `Secure Hive Applications` ! It should be out around mid-July with links to a test repo. -----
## 1- Stored XSS (Cross-Site-Scripting) Missing sanitization for SVG files. The following snippet was able to trigger the code execution every time the page was visited: ```

``` To learn more about XSS vulnerabilities see: https://owasp.org/www-community/attacks/xss -----
## 2- Open Redirect Triggered a redirect: `` Did not execute: `` To learn more about malicious redirect see: https://learn.snyk.io/lesson/open-redirect **Exploit:** > This can be used to redirect to a page very similar to yours and it could prompt you to start any operations (eg. transfer) from your Hive Keychain masking it as a simple login. -----
## 3- Pinata Gateway token leak This is what gets generated for all image uploads... `![](https://ipfs.VULNERABLE_DAPP.app/ipfs/QmaGDjdgPQcgpKUTEE9kD4YW9QLmLsodfQADhy51E65d46?pinataGatewayToken=nxHS...eXWH-gXCY....OOPS....XyFE)` Note the `?pinataGatewayToken` URL parameter. Impact: - Unauthorized Access: *If someone gains access to your Pinata gateway token, they can use it to interact with your IPFS content. This could lead to unauthorized modifications, deletions, or other actions on your data.* *It’s crucial to keep your gateway tokens secure and avoid sharing them publicly.* - Performance Issues: *Public IPFS gateways, including Pinata’s public gateway, have rate limits and can be slower due to heavy usage by users worldwide.* *When you use a public gateway frequently, you might experience slower loading times for your content.* *Pinata recommends using public gateways only for testing purposes, not production apps.* -----
_{Less critical ones...}
## 4- Clickjacking An attacker can simply embed full-screen your website as is and display an overlay with invisible fields on top of the real login fields, in order to steal users' credentials. Or they could show an overlay with an amazing offer to subscribe to your services with a huge discount by paying with a credit card or sending funds to the attacker's account. To learn more about clickjacking: https://owasp.org/www-community/attacks/Clickjacking -----
## 5- Reverse Tabnabbing: `test` None of the external links have rel=“noopener noreferrer” to protect from it. To learn more about reverse tabnabbing: https://owasp.org/www-community/attacks/Reverse_Tabnabbing -----
That's all folks. Stay tuned for my guide on Securing your Hive Apps!
-----

_{My security disclosures for Hive:}
_{- _{XSS vulnerabilities in #########.com}}
_{- _{XSS vulnerabilities in hive-db.com}

- _{XSS vulnerabilities in scribe.hivekings.com}

- _{XSS vulnerabilities in hiveblockexplorer.com}

- _{Malicious ads redirecting all Steemit iOS users to a phishing site}

- _{Reverse tabnabbing and clickjacking in steem.chat and steeemit registration page}}

_{Other contributions:}
_{- _{Universal script to prevent phishing in all Hive frontends}}
_{- _{Commands for community reports and ban/mute lists}} _{Future development: _plan} _{Last report: _{https://peakd.com/@keys-defender/monthly-report-june-july-august-2021-hive-13323}}

Keys-Defender features:

- _{Keys protection_{[live scan of transfers/posts/comments/other_ops.
Warnings (reply and memo), auto-transfers to savings until fully restored, auto-reset of keys, ..] {see automatic posts on leak and monthly reports}}}
- _{Phishing protection
_{[live scan of comments and posts to warn users against known phishing campaigns and compromised domains or accounts, scan of memos and auto-replies, anti phishing countermeasures - eg. fake credentials]}}
- _{Re-posting detection
_{[mitigates the issue of re-posters]}}
- _{Code injection detection
_{[live scan of blocks for malicious code targeting dapps of the Hive ecosystem]}}
- _{Anti abuse efforts
_{[counteracts spam from hive haters and milking campaigns]}}

-----

To support this project..

https://images.hive.blog/DQmWmRN7k741DbkG5jL19Y5h1H5tqhpHLJUtGiTgPUy3C4y/image.png

- _Delegations: _{10, 50, 100}

- _{Curation trail:} _{_{join my curation trail to upvote all my posts with a fixed weight.}}

- _{Downvote trail:} _{_{join my downvote trail to follow my downvotes on security threats and abuse.}}

- VOTE for our WITNESS !!

----- ----- _{This project is sponsored by} @cryptoshots.nft _{Browser-based play-to-earn} 3D Shooter on HIVE

https://youtu.be/H1LT1gLQZW0

_Discord _Twitter

Follow, be first to know