If we consider that JavaScript is not disabled on front-end server. If so, can we configure server to run all javascript in some kind of sandbox. Something like codepen for example.

  • 1
    Yes. This can occur, because you're inserting the <script> tags yourself. – Mark Buffalo Mar 15 '16 at 19:44
  • 1
    @iUuax - please don't make changes like that to a question. Especially once answers have been posted. – Rory Alsop Mar 17 '16 at 9:55

You really have two questions here.

Does DOM XSS work on pages that don't use js?

I'm assuming that you mean DOM based XSS, and in that case, no. DOM based XSS requires that user input is put into the DOM client side, which happens via JavaScript.

A simple example is JavaScript reading out part of a URL and writing it into the document.

Can an XSS attack be done on a static page that doesn't use any JavaScript?

Sure. If you echo user input into the static page - which, in contrast to DOM based XSS, happens server side -, a user can simply add script tags themselves, or enter a JavaScript context via various event attributes.

If you know that you will only have static pages, you can prevent the execution of injected JavaScript by using a Content Security Policy. Note that it is the job of the browser to actually enforce this policy, so this may not help with older browsers, and proper defenses against XSS should still be applied.


The DOM XSS attack needs DOM elements to be a successful attack and it's necessary JS code. Now, you can do XSS attacks on page without JS Code, this is possible using the reflected or persistent XSS attacks, for example, you have the next field on your HTML form and the web application reflects the value on that field or gets the value from a database or another kind of data storage, and places that data on the value attribute of the field:

<input id="user" name="user" value="{value_from_server}" />

You can inject something like this:

" /><script>alert("XSS");</script><input id="user2" name="user2" value="

Then if you replace {value_from_server} for the text above, you will have the following result:

<input id="user" name="user" value=" " /><script>alert("XSS");</script><input id="user2" name="user2" value=" " />

As you can see, you just need to know how the web application places the data on your web page and the rest is just creativity, in this case, a web page without JS code could be vulnerable to XSS attacks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.