Timeline for DOM based XSS and the “#” character
Current License: CC BY-SA 3.0
4 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 11, 2017 at 16:32 | comment | added | Bob | Thus the use of "#" is not mandatory for DOM XSS? | |
| Jun 10, 2017 at 9:29 | comment | added | Benoit Esnard | For a DOM-based XSS, the server must send vulnerable JavaScript. If you were able to send JavaScript from the server, then it would be a classical (not DOM) XSS. | |
| Jun 10, 2017 at 9:20 | comment | added | Bob | Then for the DOM-based I no need to add javascript code in webpage using a vulnerable server, but I can change the HTML directely from the user's browser changing the DOM, right? | |
| Jun 9, 2017 at 20:43 | history | answered | Benoit Esnard | CC BY-SA 3.0 |