#domxss — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #domxss, aggregated by home.social.
-
10 DOM Invader sink hits. 0 vulnerabilities.
And that's actually the lesson.
On a real bug bounty target, the hard part isn't finding sink hits. It's quickly figuring out which ones aren't worth chasing.
Real-world DOM XSS triage:
-
10 DOM Invader sink hits. 0 vulnerabilities.
And that's actually the lesson.
On a real bug bounty target, the hard part isn't finding sink hits. It's quickly figuring out which ones aren't worth chasing.
Real-world DOM XSS triage:
-
Clobbering DOM Attributes to Bypass HTML Filters and Trigger DOM-Based XSS
This article demonstrates a unique form of DOM-based Cross-Site Scripting (XSS) by exploiting property collisions in the Document Object Model (DOM). The application filters user comments for restricted HTML but overlooks unsafe assumptions about specific DOM properties. By intentionally clobbering an existing property (onclick), the researcher overwrites its original value with malicious code, effectively bypassing filtering mechanisms that should have removed it. Although event handlers such as onclick and onfocus were supposed to be removed, the clobber attack allowed their retention. This vulnerability can result in sensitive data exposure or account takeover. The researcher did not disclose a bounty amount, but the article serves as a valuable lesson for security researchers to scrutinize assumptions about DOM properties during sanitization. Key lesson: Carefully examine all DOM properties when implementing HTML filtering to avoid clobber attacks. #BugBounty #Cybersecurity #DOMXSS #InformationDisclosure -
Clobbering DOM Attributes to Bypass HTML Filters and Trigger DOM-Based XSS
This article demonstrates a unique form of DOM-based Cross-Site Scripting (XSS) by exploiting property collisions in the Document Object Model (DOM). The application filters user comments for restricted HTML but overlooks unsafe assumptions about specific DOM properties. By intentionally clobbering an existing property (onclick), the researcher overwrites its original value with malicious code, effectively bypassing filtering mechanisms that should have removed it. Although event handlers such as onclick and onfocus were supposed to be removed, the clobber attack allowed their retention. This vulnerability can result in sensitive data exposure or account takeover. The researcher did not disclose a bounty amount, but the article serves as a valuable lesson for security researchers to scrutinize assumptions about DOM properties during sanitization. Key lesson: Carefully examine all DOM properties when implementing HTML filtering to avoid clobber attacks. #BugBounty #Cybersecurity #DOMXSS #InformationDisclosure -
🔍 ZAST.AI discovered vulnerabilities in “mall” <=1.0.3 7a1ca5d:
• DOM XSS (CVE-2025-8191)
These issues could lead to client-side attacks and unauthorized access.
🔗 Vulnerability report: https://tinyurl.com/4jrrjkcb
#DOMXSS #CVE #WebSecurity #ZASTAI -
🔍 ZAST.AI discovered vulnerabilities in “mall” <=1.0.3 7a1ca5d:
• DOM XSS (CVE-2025-8191)
These issues could lead to client-side attacks and unauthorized access.
🔗 Vulnerability report: https://tinyurl.com/4jrrjkcb
#DOMXSS #CVE #WebSecurity #ZASTAI -
VIDEO: BSidesNYC 2024 - Trusted Types: DOM XSS Protection at Scale - Jen Ozmen & Youssef Attia - @google https://www.youtube.com/watch?v=rM_CqA1BQzY&list=PLlg8We3ePxcMDrUFNWs7hyx3uJwnhK-_a #BSidesNYC #BsidesNYC2024 #bsidesnyc0x04 #cybersecurity #InfoSec #TrustedTypes #DOMXSS #WebSecurity
