https://portswigger.net › web-security › cross-site-scripting › dom-based

In this section, we'll describe DOM-based cross-site scripting (DOM XSS), explain how to find DOM XSS vulnerabilities, and talk about how to exploit DOM XSS with different sources and sinks.

https://cheatsheetseries.owasp.org › cheatsheets › DOM_based_XSS_Prevention_Cheat_Sheet

The best way to fix DOM based cross-site scripting is to use the right output method (sink). For example if you want to use user input to write in a div tag element don't use innerHtml , instead use innerText or textContent .

https://owasp.org › www-community › attacks › DOM_Based_XSS

DOM Based XSS is an XSS attack that modifies the DOM environment in the victim's browser to execute client side code differently. Learn how it works, see an example, and explore advanced techniques and defenses from OWASP.

https://www.acunetix.com › blog › articles › dom-xss-explained

DOM-based XSS vulnerabilities are a type of Cross-site Scripting (XSS) vulnerabilities. A DOM-based XSS attack is possible if the web application writes data to the Document Object Model (DOM) without proper sanitization. The attacker can manipulate this data to include, for example, malicious JavaScript code.

https://portswigger.net › web-security › cross-site-scripting

Learn what cross-site scripting (XSS) is, how it works, and how to prevent it. Find out the differences between reflected, stored, and DOM-based XSS, and how to exploit them with examples and labs.

https://github.com › ... › 01-Testing_for_DOM-based_Cross_Site_Scripting.md

DOM-based cross-site scripting is the de-facto name for XSS bugs that are the result of active browser-side content on a page, typically JavaScript, obtaining user input through a source and using it in a sink, leading to the execution of injected code. This document only discusses JavaScript bugs which lead to XSS.

https://portswigger.net › web-security › cross-site-scripting › cheat-sheet

This cross-site scripting cheat sheet contains many vectors that can help you bypass WAFs and filters. You can select vectors by the event, tag or browser and a proof of concept is included for every vector.

https://owasp.org › ... › 11-Client_Side_Testing › 01-Testing_for_DOM-based_Cross_Site_Scripting

DOM-based cross-site scripting is the de-facto name for XSS bugs that are the result of active browser-side content on a page, typically JavaScript, obtaining user input and then doing something unsafe with it, leading to the execution of injected code. This document only discusses JavaScript bugs which lead to XSS.

https://web.dev › articles › trusted-types

DOM-based cross-site scripting (DOM XSS) happens when data from a user-controlled source (like a username, or a redirect URL taken from the URL fragment) reaches a sink, which is a function like eval() or a property setter like .innerHTML that can execute arbitrary JavaScript code.