Cross-Site Scripting
DOM Clobbering
Named HTML elements automatically become properties of the window object. Learn how attackers exploit id and name attributes to overwrite JavaScript variables, bypass security checks, and chain two-level clobbering to reach nested properties — all without a single script tag.
Intermediate35 min6 lessons1 hands-on
First lesson free. The full module is part of Pro.
You'll be able to
- ✓Explain how named HTML elements become global window properties
- ✓Clobber a single-level window property using an id attribute
- ✓Chain two anchor elements to overwrite a two-level property like window.app.settings
- ✓Bypass security checks that rely on JavaScript configuration objects