Skip to main content
51 votes
Accepted

Is Dom based XSS still a valid security concern in modern browsers?

Yes, DOM-based XSS is still a concern. While some issues cannot be exploited due to URL encoding, there a number of situations where URL encoding will not stand in the way of exploitation. The gist ...
tim's user avatar
  • 29.7k
7 votes
Accepted

In what situations can element.setAttribute allow XSS?

setAttribute() is safe in that it does nothing more than setting the attribute's value. Even by using special characters in the string you cannot inject an additional attribute (as you attempted in ...
Arminius's user avatar
  • 44.9k
5 votes
Accepted

Is this codes usage of document.location.toString() a DOM based XSS vulnerability?

This code snippet is vulnerable to XSS in jQuery prior to 1.9 (and in conjunction with the jQuery Migrate plugin). Even now, it remains at least a bad practice. The string argument to $() (shortcut ...
Arminius's user avatar
  • 44.9k
3 votes
Accepted

Is this JavaScript mailto redirect vulnerable to XSS?

This is more injection than XSS, but Mailto links have a few features that you can abuse. For example, instead of the email program popping up with just the TO filled out, you can pre-fill the CC, BCC,...
Fire Quacker's user avatar
  • 2,432
3 votes

Is this javascript vulnerable to dom based XSS?

No it's not vulnerable to XSS based on the provided information. The interpolated URL query parameter token has quote marks escaped (\" instead of just ") so you cannot break out of the string. ...
ig-dev's user avatar
  • 1,108
3 votes
Accepted

Why this XSS payload doesn't work?

The page you refer to has the following code: <p id="p1">Hello, guest!</p> <script> ... var username = searchParams.get('name'); ... document.getElementById('p1').innerHTML = 'Hello,...
Steffen Ullrich's user avatar
3 votes

Is echoing GET parameters into a script tag reflected or DOM based XSS?

This is reflected XSS, not DOM-based XSS. The difference is subtle, but here are the key sentences. OWASP - DOM Based XSS the page itself (the HTTP response that is) does not change, but the ...
Alexander O'Mara's user avatar
2 votes

Is the payload for DOM based XSS defined to originate from only inside the browser or even outside of it

DOM based XSS vs Reflected XSS Should I interpret this as Reflected XSS means being able to injecting <script> tags in an HTML context, and DOM based XSS means being able to inject payload ...
tim's user avatar
  • 29.7k
2 votes

Possible Vulnerability in the following Php/JS code

Both codes are vulnerable, but neither is exploitable with most modern browsers. In the first example, could exploit the echoing of REQUEST_URI. Exploitability depends on the browser not ...
tim's user avatar
  • 29.7k
2 votes

DOM based XSS inside src attribute

Are there any other attacks that I didn't consider? To prevent the single quote form getting encoded, you could try to sneak your payload into the path instead of the query string. For example, if ...
Arminius's user avatar
  • 44.9k
2 votes

Secure way to output encoding HTML for insert raw html via javascript

If you want to insert untrusted HTML markup as text, then you should use the textContent property, not innerHTML. The textContent property reliably prevents XSS attacks, because the content is only ...
Ja1024's user avatar
  • 9,889
2 votes

Safely creating script tag and attaching to DOM

Is it safe to allow passing the [script URL] as a URL query param? No, this is very dangerous. See question #3. If this code is an issue, what are the specific attacks that could happen here? Since ...
Anders's user avatar
  • 65.6k
1 vote

Safely creating script tag and attaching to DOM

This is my own code, and I trust it as far as not having malicious code in it. This is just an assumption. As long as this assumption is not enforced it can not be relied on. The current proposal ...
Steffen Ullrich's user avatar
1 vote

Javascript: How to check SHA of fetched script before executing

https://en.wikipedia.org/wiki/Subresource_Integrity function includeJs(jsFilePath, sha) { let js = document.createElement("script"); js.src = jsFilePath; js.integrity ...
personal_cloud's user avatar
1 vote
Accepted

Reflected DOM XSS Portswigger Lab

That is because you are in the context of a string inside a JavaScript object. So you need to keep the string in a correct format for the payload to execute. By including the + or - you make sure the ...
Christiaan's user avatar
1 vote

Difference Between Reflected XSS and Reflected-DOM XSS

No - reflection into JavaScript is reflective XSS. It is in a JavaScript context, but the issue occurs during server-side rendering. No - as (1) Yes this is reflective, DOM-based XSS. There's no ...
paj28's user avatar
  • 33.5k
1 vote

How to test an Angular SPA for DOM XSS with OWASP ZAP?

Same as any other modern web app. The key thing it to explore it effectively - proxying unit tests is good if you have them but you will also need to use the Ajax spider to drive the UI. If your app ...
Simon Bennetts's user avatar
1 vote

DOM-based XSS - via URL

Since that's expecting a url (and not HTML tags), have you tried a javascript url? javascript:alert(1) Also, are you only testing for XSS, or would you also be interested in open redirect issues? ...
Mike Ounsworth's user avatar
1 vote
Accepted

How do browsers handle document.write in this DOM based XSS case?

First the browser hands over the incoming data to the HTML parser, that starts working from the top of the document and down. This can happend even before the document has finnished downloading. As ...
Anders's user avatar
  • 65.6k
1 vote

How can i get an alert box from this?

Is \ converted to \\? If not, break out of the string using \"; it'll be converted to \\", which will be treated as a sole (escaped) backslash and then a string-terminating quotation mark. Inserting ...
CBHacking's user avatar
  • 49.3k
1 vote

XSS with escaped equal sign inside jQuery selector

You would maybe be able to do it if the charset was not atypical, and then you may be able to get a valid result by using a multibyte character converting into an equals sign, but you can't change the ...
LTPCGO's user avatar
  • 1,055
1 vote

Is this code vulnerable to DOM based XSS jquery animate?

The code snippet you shared above is not vulnerable to DOM-based XSS. jQuery version 1.12.4 is not affected by the selector XSS bug. I highly recommend using http://research.insecurelabs.org/jquery/...
EdOverflow's user avatar
  • 1,316
1 vote
Accepted

DAST Output in Burp and Understanding It

I haven't used the new DAST scanner, but it seems like it injected (dkezib%2527%2522``'"/dkezib/>xrpjqc&) into the input field / variable, ran the javascript, and found that it reached the eval(...
Mike Ounsworth's user avatar
1 vote

Bypassing double quote in DOM based XSS?

In general, no. If you see " getting transformed to &quot; as it passes through the HTML, then that usually means that the application is doing output escaping properly.
Abhishek Morla's user avatar
1 vote
Accepted

DOMXSS - Is Input Field Content an Attack Vector?

That would be hard to exploit without combining it with another vulnerability. How would the exploit code get into the input? I suppose combining it with UI-redressing or something like that could ...
Erlend's user avatar
  • 2,255
1 vote

Is the payload for DOM based XSS defined to originate from only inside the browser or even outside of it

Since the payload is going from the victim's browser to the server and coming back to the browser, how is this not reflected XSS instead? In that example, it is not going to the server to come back ...
SilverlightFox's user avatar
1 vote

Is this codes usage of document.location.toString() a DOM based XSS vulnerability?

This was a pretty common XSS attack vector in jQuery, and can still affect sites using an outdated version of jQuery. https://bugs.jquery.com/ticket/9521 Basically, if a string was an invalid ...
Alexander O'Mara's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible