How To Search For DOM-Based XSS!

👩‍🎓👨‍🎓 Learn how to find DOM-based cross-site scripting vulnerabilities. We are looking at the browser's developer tools, the Javascript debugger, and the concept of sources and sinks!
Overview:
00:00 Intro
00:29 Inspecting Sources
02:15 DOMXSS Wiki
02:44 Location.search
03:44 Inspect the DOMXSS source
05:25 Using the Debugger
06:16 Inspecting the DOMXSS sink
07:10 Exploiting the vulnerability
07:49 Summary
For more information, check out blog.intigriti.com/hackademy/cross-site-scripting-xss/dom-based-cross-site-scripting/.
🔗 DOM-XSS Wiki: github.com/wisec/domxsswiki/wiki
🔗 Portswigger XSS Challenge: portswigger.net/web-security/cross-site-scripting/dom-based/lab-document-write-sink-inside-select-element
---
🧑‍💻 Sign up and start hacking right now - go.intigriti.com/register
👾 Join our Discord - go.intigriti.com/discord
🎙️ This show is hosted by PascalSec (@Hacksplained) & intigriti
👕 Do you want some Intigriti Swag? Check out swag.intigriti.com/

[@UnknownSend3r]

BRILLIANT! two days of surfing the web to understand it and you explained it in under 10 mins. just subbed!

[@intigriti]

Awww, glad to hear that 😇. Thanks, more easy to understand videos to come!

[@Truth_Seeeker]

two days worth it bro

[@salman2464]

Best XSS methodology explanation I’ve found in Years. Great work Bro, kudos for Intigriti 👍

[@intigriti]

Ohh wow 😊. in years? Thanks for that super lovely feedback!! More videos to come 😇

[@user-ev6fj4bt7x]

That video just saved me from hours of headaches. It is much more detailed then the writeup for that lab. Thank you

[@intigriti]

Thank you very much for that great feedback! ❤️ super glad it helped you!

[@exohive5608]

Been working on this lab too; was focused too much on the additional js files at the end of the script. You’ve explained it well! Thank you!

[@intigriti]

Awesome, glad it helped 💜

[@jmcsmtp]

Excellent explanation. Thank you so much. I have been a researcher for years and have searched almost an equal amount of time for a simple explanation of DOM XSS. This tutorial is even better than the training material provided by PortSwigger. Well done.

[@intigriti]

Thank you so much for your very kind words! This feedback is really heartwarming! Coming from Pascal ❤️

[@dennismunyaka6537]

surely did learn something new. awesome content well articulated

[@intigriti]

Thanks Dennis 😎 We are glad you like it!

[@lucasGAM1005]

one of the best practic explanations I've ever seen

[@intigriti]

Thank you very much! We really appreciate that 😇

[@reubenroyal4234]

This video was put together very well. It is thoroughly and simply explained. It is really hard to find this quality content online for cybersecurity

[@intigriti]

Thanks a lot Reuben ❤️

[@lucanicolini4721]

Great explanation! Thank you!

[@intigriti]

Thank you very much for your kind words 🥰

[@amol5436]

really great explanation. thanks a lot for making such videos, it helped a lot..cheers..

[@intigriti]

You are very welcome! :) We are glad it helped 😇

[@lesleybw]

Excellent explanation.

[@intigriti]

Glad you liked it ❤️

[@CALVIS-1]

Thanks sir ,😇 You earned my respect!

[@intigriti]

Thank you very much. That's very kind of you ❤️

[@kiki-ig8fq]

Nice video would be nice to include how to fix these as well

[@camelotenglishtuition6394]

So much better than the portswigger video. You're an angel!

[@intigriti]

Thank you very much for those kind words ❤️

[@camelotenglishtuition6394]

@@intigriti anytime dude have a great day

[@AshishSingh-jq6de]

Great man 🔥

[@intigriti]

Thank you Ashish 🥰

[@user-ns5ti4uj3h]

Good one！ Amazing for me！！！

[@intigriti]

🙏🥰

[@meljithpereira5532]

Awsme explain .. 💐

[@intigriti]

Thanks a lot 😊 We really appreciate your feedback!

[@JITHUC2000]

Good one! Thanks

[@intigriti]

You're welcome! 😇

[@TheBroadwood]

What a great explanation. Especially the part where you show us how to use the debugger. But i have one question... isn't this example a little bit unrealistic? I mean the GET-Request only includes one parameter (productID). The serverside Javascript also already includes all stores in an array, so what practical purpose exists when a user is able to alter the list options? It's still great for teaching purposes.

[@intigriti]

Thank you very much ❤️ The lab by Portswigger was definitely designed to be simple. We agree with that. But you need a simple demonstration to start grasping the concepts!

[@HamsterLover1337]

Amazing video, best of the best Ive seen on the topic. But could you explain in another video what the real dangers are that come from different kinds of XSS (reflective, stored (DOM)) being possible? Such as stealing cookies, abusing SOP when CORS is misconfigured, etc?

[@intigriti]

Thank you! Request noted ✍

[@rangelbatista4594]

Thank you.

[@intigriti]

You're welcome! 💪

[@mehkpentester5824]

Thank You

[@intigriti]

Welcome! 💜

[@creationofislam]

Thank you

[@intigriti]

You're welcome!!

[@JuanBotes]

Thanks once again for great content - I am really late to the party \o/

[@intigriti]

No worries! We are glad you are watching at this point 😇

[@sahariarhasan2624]

Amazing

[@intigriti]

no, you! 💜

[@br_nidas]

thx!

[@intigriti]

Welcome! 💜

[@siefkhaled1374]

amazing

[@intigriti]

Thank you!

[@gdfghgfdti3097]

Goooooooood :)

[@intigriti]

Thank you very much! Keep watching all our videos 🙏🏻

[@PrakashKumar-se1qk]

It was damn good 😍

[@intigriti]

Thank you so much 😇 Please share it with your community!

[@mehadi0187]

perfect

[@intigriti]

thanks a lot 😇

[@Amir-qm5ns]

but how do you know what payload to use? tags, etc i mean, i found it is may be dom xss, but how do i know how to use the right payload?

[@intigriti]

You usually have a set of payloads in mind and you try them out and see how the app reacts. Another great resource is portswigger.net/web-security/cross-site-scripting/cheat-sheet

[@Amir-qm5ns]

@@intigriti thanks for the answer, what do you mean how the app react? what do you usally check for see and confrim there is some suspious reaction?

[@CyberSecForce]

Nice

[@intigriti]

Thanks 😇

[@newuser2474]

Great

[@intigriti]

Glad it helped!

[@satriawinarah1894]

Sorry I still don't understand. What we are doing is just in our browser, right? How can it affects another people browser? Because what I got is, we temper it after the server give the response which means only in our browser (in client side only) I understand about the common XSS, like a comment section case. We are successfully injected a script that will stay in the website for so long until another people open the same page and load all the injected script.

[@intigriti]

This vulnerability needs you to send the malicious URL (containing the XSS payload) to your victim. The victim then needs to click on it in order to get exploited. The most typical way this is happening in real-life is via an email phishing attack. However, you could also e.g. host that malicious URL on your own website and lure people into visiting that.

[@satriawinarah1894]

@@intigriti Thank you for the explanation Still wondering, if we need to send the script via a phishing attack, why do we still need to find the vulnerability as shown in the video?

[@eyadhussien1055]

King

[@intigriti]

Coming from @hacksplained: "Thank you very much, I really appreciate it!" 🔥

[@kunjanvarma78]

❤️

[@intigriti]

❤️

[@squattingnomad6298]

How do you prevent the injection?

[@intigriti]

Hey there, have a look at cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html.

[@itsm3dud39]

how to inspect source in firefox?

[@intigriti]

E.g. by clicking right click on your mouse! There's a couple of other methods but I let you google those. Googling is an important skill if you are a hacker!

[@Jpkb6]

thanks jesuscrist!!

[@intigriti]

Thanks a lot ❤️

[@lethalleet]

First comment 🔥

[@intigriti]

🔥🔥🔥

[@heuristicalgorithm8465]

confusing

[@intigriti]

Anything in specific that wasn't clear?

[@heuristicalgorithm8465]

​@@intigriti Where is img source script inserted in the source code? In the source itself? It's difficult to see in the vid. You can write to the website using both the source and sink? Also, How do you find that javascript debugger in Firefox? Thank you

[@UCallMeChef]

Start doing real world examples stop these bullshit vuln web apps

[@intigriti]

That would not be ethical and is not allowed by law. Those vulnerable boxes are directly derived from real life examples, so make sure to search for them in real applications!

[@UCallMeChef]

@@intigriti bug bounty’s

[@trustedsecurity6039]

stop using portswigger labs... people come here to learn what DOM XSS is for example (xD) and they are spoiled the better labs they could find and they cant learn from them. I know it is pratical and everybody do it but that sucks. i stopped the video and a lot of others due to this...

[@intigriti]

Hey, thanks for the feedback! We're still making Portswigger videos but it's now a lot clearer that the content is a practical run through a Portswigger lab (the title and description exactly match the lab, and include links to the relevant lab and learning material), which are also uploaded directly to the Web Security Academy.

[@trustedsecurity6039]

@@intigriti cool but it doesnt change the problem, people will learn and see the solution of the best labs on the subject and will lose the preciois hands-on experience which make portswigger academy so good. Thanks for your all you do and love hunting on your platform :) the best one where triagers arent there to avoid payement :D