HACKR.GG
Cross-Site Scripting

DOM-Based XSS

The server never sees this one. DOM XSS lives entirely in client-side JavaScript — the hardest type to detect and the easiest to miss in code review.

Intermediate45 min10 lessons1 hands-on
Start free →I have an account
Free account. No credit card.

You'll be able to

  • ✓Understand the difference between server-side and DOM-based XSS
  • ✓Identify dangerous DOM sinks: innerHTML, document.write, eval
  • ✓Trace tainted data from sources (location.hash, postMessage) to sinks
  • ✓Exploit DOM XSS without any server-side reflection

Lessons

  1. 1The XSS the Server Never Saw
  2. 2Craft Your First PayloadHANDS-ON
  3. 3Sources, Sinks, and How Data Flows
  4. 4Finding DOM XSS — Reading JavaScript
  5. 5Complete Source Catalogue
  6. 6Complete Sink Catalogue
  7. 7DOM XSS in Modern Frameworks
  8. 8Practice: Exploiting a URL Parameter Source
  9. 9Lab: Crapazon — Is It Reflected or DOM?
  10. 10Final Lab: NoteSnap — Hash Source to innerHTML Sink
Start free →