DOM XSS
DOM XSS (Document Object Model) is a programming interface that defines hoe to create modify or erase in HTML or XML documents.
A DOM model represents each element as a node with in a tree like system, enabling easler programmatic access and Management of elements
Dom based XSS is a cross site scripting vulnerability that enables attackers to inject a malicious payload into a web page by manipulating the client browser
DOM based XSS attacks can only be seen by checking the document object model and client side scripts at runtime.
Fundamentally, attackers perform DOM-based Cross-site scripting attacks on applications with an executable path for data to travel from a source to a sink. Sources are JavaScript properties that can act as the location of malicious input. These include document.URL, document.referrer, location.search, and location.hash among others. A sink is a location or function that executes the malicious function in an HTML rendering. Example of sinks include: eval, setTimeout, setInterval and element. innerHTML among others
DOM XSS Attack
Using JavaScript Frameworks
JavaScript frameworks such as React and AngularJS are built with security best practices that eliminate ad-hoc HTML construction, making it harder for developers to include loopholes that allow adversaries to embed malicious user input into web Document Object models.
div>{{dynamicContent}}</div>
Binding content in ReactJS within curly braces also enables automatic escaping
render() {
return <div>{dynamicContent}</div>
}
1)Attack Based on Vulnerable content
<html>
<title>Welcome!</title>
Hi
<script>
var pos=document.URL.indexOf("name=")+5;
document.write(document.URL.substring(pos,document.URL.length));
</script>
<br>
Welcome
…
</html>
2) Vulnerable user Forms
<select><script>
document.write("<OPTION value=1>"+document.location.href.substring(document.location.href.indexOf("default=")+8)+"</OPTION>");
document.write("<OPTION value=2>CET</OPTION>");
</script></select>
Attackers can launch a DOM-based XSS attack by sending a malicious URL through a script as below:
http://www.example.site/page.html?default=<script>alert(document.cookie)</script>
page executes the (alert(document.cookie)) malicious script.
