I'm studying the DOM based XSS attack. I understand that briefly is an attack where in the attack payload is executed as a result of modifying the DOM “environment” in the victim’s browser. But I do not understand becouse in many tutorial this attack is related to the use of special characther "#"(hash) in order to not send the malicius string to the server. can I use "#"(hash) only in this version or in reflected NOT DOM based too?

  • 1
    A value after the fragment identifier (#) is never actually sent. Therefore it can't be reflected as in a reflected XSS attack. – Arminius Jun 9 '17 at 22:01
  • Is the use of "#" mandatory for DOM XSS? I'm a bit confused becouse I see many example where "#" is not use, but if I do not use it I send the information to the server and it is a Reflected XSS. – Bob Jun 11 '17 at 16:48
  • It's the other way round: When the payload is sent as the URL fragment, then it (almost always) has to be DOM XSS. But not every DOM XSS works via URL fragments. – Arminius Jun 11 '17 at 16:52
  • Thus, for example using an optional query: some.site/page.html?default=1 The part default=1 si no send to the server? – Bob Jun 11 '17 at 17:00
  • A query part is sent. But here, the fragment wouldn't be: some.site/page.hmtl#default=1 – Arminius Jun 11 '17 at 17:07

The URL hash isn't transmitted to the server. It's only available to the client, so the server is never aware of its value. Thus, non-DOM XSS isn't possible via URL hash.

Since the client is aware of its value, it could try to use it, fail to sanitize its value, and insert malicious markup / execute some Javascript code, leading to a DOM XSS vulnerability.

| improve this answer | |
  • Then for the DOM-based I no need to add javascript code in webpage using a vulnerable server, but I can change the HTML directely from the user's browser changing the DOM, right? – Bob Jun 10 '17 at 9:20
  • For a DOM-based XSS, the server must send vulnerable JavaScript. If you were able to send JavaScript from the server, then it would be a classical (not DOM) XSS. – Benoit Esnard Jun 10 '17 at 9:29
  • Thus the use of "#" is not mandatory for DOM XSS? – Bob Jun 11 '17 at 16:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.