Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [dom]

The tag has no usage guidance.

0
votes
0answers
72 views

Is this script vulnerable to xss? If yes, how can i get an alert box?

I think this code may be vulnerable to dom based xss but i wasn't able to get an alert box. I am able to control the userTitle field, i tried using </script> but it get changed to u003c/...
0
votes
0answers
22 views

Is this code vulnerable to DOM based XSS? jquery wrap()

Data is read from window.location and passed to the wrap() function of function of jQuery via the following statement: t.Location.wrap(window.location) The version of jQuery in use is the 1.12.1 - ...
4
votes
0answers
94 views

XSS with escaped equal sign inside jQuery selector

Web-site uses jQuery 1.8.3 which has known XSS vulnerability in selector. (https://snyk.io/vuln/npm:jquery:20120206). It passes filtered and urldecoded document.location.hash (val2 below) value ...
3
votes
0answers
557 views

Is it safe to use DOMParser to parse client side XML files?

Some JavaScript frameworks or libraries use the DOMParser API to parse XML files from the client. Is it safe to do this? Malicious code can easily be embedded into the XML file (in either the ...
1
vote
1answer
67 views

Is this code vulnerable to DOM based XSS jquery animate? [duplicate]

Is this code vulnerable to DOM based XSS? The application is using jQuery 1.12.4 and i noticed that Data is read from window.location.hash and passed to $() via the following statements: var target_ ...
0
votes
1answer
86 views

Is this code vulnerable to dom based XSS? [duplicate]

Is this code vulnerable to DOM based XSS? The application is using jQuery 3.3.1 and i noticed that Data is read from window.location.hash and passed to $() via the following statements: var hash = ...
1
vote
1answer
1k views

Security risks with setDomStorageEnabled(true) in Android?

What are the security risks associated with enabling setDomStorageEnabled(true) method? Reference.
0
votes
1answer
63 views

Is the following javascript code vulnerable to DOM XSS? [duplicate]

I have the following javaScript code in an application, which BURP flags as being possibly vulnerable. However, i have had no luck trying to get it to execute. var hash = window.location.hash; if(...
2
votes
1answer
45 views

DAST Output in Burp and Understanding It

I have recently upgraded to the newest version of Burp which includes the new DAST tools. I am receiving reports from the tool that it has found DOM-Based Javascript Injection, but I am having ...
1
vote
0answers
80 views

Bypassing double quote in DOM based XSS?

I am trying to generate a POC for DOM XSS exploit. I could inject a code using the following link: <a href="wepage.jsp" target='&quot;><script> alert(document.cookie)</script>&...
0
votes
1answer
67 views

DOMXSS - Is Input Field Content an Attack Vector?

A typical example for DOMXSS is that vulnerable code carelessly processes the part after the hash mark as in https://www.example.org/path/param1=val1&...#PAYLOAD_HERE without validation. For ...
0
votes
1answer
169 views

Why this XSS payload doesn't work?

TOday I needed to demo DOM Based XSS, and I came across this page which is made for the same exact purpose. I wonder why <img+src+onerror=alert(1)> works but <script>alert(1)</script>...
1
vote
2answers
1k views

Is the payload for DOM based XSS defined to originate from only inside the browser or even outside of it

I have read in multiple places contradictory views on what might be considered a DOM based XSS. It seems that the original definition says that it is a form of XSS where the payload originates ...
0
votes
0answers
68 views

Shouldn't I follow the OWASP DOM based XSS recommendations no matter where the payload is injected?

I heard/read at various contexts that DOM based XSS is caused by untrusted client side input and developers need to follow instructions at the OWASP "DOM based XSS Prevention Cheat Sheet" in order to ...
1
vote
1answer
230 views

How do browsers handle document.write in this DOM based XSS case?

OWASP mentions the following example of code vulnerable to a DOM based XSS attack: Select your language: <select><script> document.write("<OPTION value=1>"+document....
1
vote
1answer
476 views

Is echoing GET parameters into a script tag reflected or DOM based XSS?

I am struggling to understand whether the following would be considered as a DOM-based XSS or reflected XSS and was hoping that someone could help me distinguish the the difference. Imagine the ...
1
vote
3answers
4k views

Is this code JavaScript vulnerable to DOM based XSS?

I have some JS code below that is redirecting to a location taken from a HTML form. Is this vulnerable to an attack like DOM based XSS? document.theform.reference.onchange = function(){ var id = ...
6
votes
1answer
501 views

DOM based XSS inside src attribute

I have the following JavaScript code: var url= document.location.href; document.write("<img src='?bla="+document.location.href+"'>"); I am able to inject code when I append e.g. ?b=a'onX=alert(...
2
votes
1answer
3k views

Can location.pathname lead to XSS?

<div id="cat"></div> <script> $("#cat").html(location.pathname); </script> I think that example would work, but anyway, if location.pathname has to be a valid page, can this ...
2
votes
1answer
107 views

Possible Vulnerability in the following Php/JS code

I was practicing on one of the open source penetration testing frameworks bWAPP. I came across this code, $url = "http://" . $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]; echo $url; I was able ...
9
votes
1answer
1k views

In what situations can element.setAttribute allow XSS?

Burp has identified a potential DOM XSS vulnerability: The application may be vulnerable to DOM-based cross-site scripting. Data is read from window.location.href and passed to the 'setAttribute()' ...
7
votes
1answer
715 views

Safe to render data directly to DOM from localStorage? XSS attack possible?

I read that localstorage is susceptible to XSS attacks. I currently store JSON Web Token (JWT) in localstorage, and I access and display data about the user through localstorage: var localstore = //...
5
votes
2answers
983 views

Is this codes usage of document.location.toString() a DOM based XSS vulnerability?

I have come across the following JS code in multiple web applications. I think the reason for the popularity of this code snippet is this accepted answer on SO. Developers seem to be using this code a ...
2
votes
1answer
253 views

Is this code vulnerable to DOM based attacks?

We are developing code for a Banking web application. We want to make sure that the code is secure and since we are using a lot of javascript code, we are kind of worried if any chance of a web based ...
5
votes
2answers
305 views

Limiting latter dom-based XSS when setting document.title

Given some JavaScript which modifies the page's title by taking in variable data document.title = someVariable I am looking to address dom based XSS while keeping the title fairly readable. ...
3
votes
1answer
2k views

Dom based Xss Query - location.hash

I was just looking at Dom based xss and wondering if hash value is written to a variable in javascript context can lead to Cross site scripting. The code looks something like this: <script> var ...
1
vote
1answer
373 views

Is this reflected or DOM-based XSS?

Scenario: Server-side script takes URL parameter parameter1 and writes it without encoding into cookie cookie1. Then regular HTML page containing client-side script is returned. Client-side script, ...
1
vote
2answers
236 views

XSS outside of the DOM

I have the following JS (using jQuery for brevity's sake but it isn't necessary for the question): $("<i></i>").html(userInput); Is it possible for someone to input some string, ...
8
votes
2answers
2k views

How is DOM XSS possible here?

I was looking at this website and trying to understand how this XSS is possible, but I just can't figure it out. Here's the URL: http://www.domxss.com/domxss/01_Basics/05_jquery_html.html?681973661 &...
10
votes
2answers
3k views

How can document.referrer be used for XSS?

A very simple example... <div id="cat"></div> <script> document.getElementById("cat").innerHTML = document.referrer; </script> or <script src="' + document.referrer + '"&...
0
votes
1answer
1k views

What is DOM based XSS? And How to prevent it? [duplicate]

I know very well about the classic XSS vulnerabilities such as reflected & stored XSS. I have read a lot about DOM and DOM based XSS vulnerabilities. I came to an inference that there is nothing ...
1
vote
2answers
1k views

Why doesn't this XSS attack work?

I have a site that has the following javascript that is being executed: var t=location.hash.slice(1); $("div[id="+t+"]").text("The DOM is now loaded and can be manipulated."); I was thinking that if ...
4
votes
2answers
2k views

Exploiting XSS with window.name without iFrame

I know XSS is possible if the window.name is echoed onto the page, but from my understanding, this requires you to use an iFrame, but what if the page has clickjacking protection, stopping the page ...
1
vote
1answer
5k views

exploit document.write with unsanitized user input

I'm trying to inject javascript into a js scriptfile but it's not working. I have the following setup: html file with javascript-file include (all inline js is blocked!) Welcome, <script src="js/...
0
votes
1answer
2k views

How can attacker bypass this dom xss filter? [closed]

I'm trying to solve an dom xss challenge where filter used is : var anchor = window.location.hash.substring(1); if (window.location.href.match(/(script|javascript|src|onerror|%|<|>)/g)) { ...