DB.
Courses

DOM-Based Cross-Site Scripting (Black Box)
OSWE · Chapter 19

DOM-Based Cross-Site Scripting (Black Box)

DOM-based XSS occurs entirely on the client: JavaScript reads data from an attacker-controllable source (like `location.hash`) and writes it to a dangerous sink (`innerHTML`, `eval`) without the payload ever necessarily touching the server. "Black box" testing here means finding it purely by observing browser behavior, without source code access.

Key concepts

  • Because the payload may never be sent to the server, traditional server-log-based detection completely misses DOM XSS — it has to be found by inspecting client-side behavior directly.
  • Common sources: `location.hash`, `location.search`, `document.referrer`, `window.name`. Common sinks: `innerHTML`, `document.write`, `eval`.
  • Testing approach: place a unique marker string into each source and use browser DevTools to search the live DOM (not "View Source", which shows only the original HTML) for where it ends up.
  • Burp Suite's DOM Invader tooling automates a lot of this source-to-sink tracing for black-box testers.

Example

// Vulnerable pattern
element.innerHTML = new URLSearchParams(location.search).get("name");
// ?name=<img src=x onerror=alert(1)> would execute

Try it yourself

On a lab DOM XSS challenge (PortSwigger has several), place a marker string into the URL fragment/query and use your browser's DevTools search to find where it lands in the live DOM.

ReferenceSearch video walkthroughs

@ Daniel Burlacu