I'm studying the DOM based XSS attack. I understand that briefly is an attack where in the attack payload is executed as a result of modifying the DOM “environment” in the victim’s browser. But I do not understand becouse in many tutorial this attack is related to the use of special characther "#"(hash) in order to not send the malicius string to the server. can I use "#"(hash) only in this version or in reflected NOT DOM based too?
1 Answer
The URL hash isn't transmitted to the server. It's only available to the client, so the server is never aware of its value. Thus, non-DOM XSS isn't possible via URL hash.
Since the client is aware of its value, it could try to use it, fail to sanitize its value, and insert malicious markup / execute some Javascript code, leading to a DOM XSS vulnerability.
answered Jun 9, 2017 at 20:43
-
Then for the DOM-based I no need to add javascript code in webpage using a vulnerable server, but I can change the HTML directely from the user's browser changing the DOM, right?– BobCommented Jun 10, 2017 at 9:20
-
For a DOM-based XSS, the server must send vulnerable JavaScript. If you were able to send JavaScript from the server, then it would be a classical (not DOM) XSS. Commented Jun 10, 2017 at 9:29
-
#) is never actually sent. Therefore it can't be reflected as in a reflected XSS attack.