Portswigger Web Academy - DOM XSS - Lab Walkthroughs

[@1ko9]

Awesome! as always, Thank you 🥇

[@malavdipakmistry7270]

DOM XSS ftw 💯

[@SplitUnknown]

Oh thanks 10:22 i didn't know ssti didn't reflect on the view source then its not ssti

[@M4lch4t]

💜

[@user-rocker]

I have a query regarding DOM XSS, Please answer with your experience: In real world, How to perform DOM XSS attack on victim, If in case Firewall is placed and attacker is unable to bypass it ?

[@Tib3rius]

Do you mean a web app firewall? In that case it really depends because a lot of DOM XSS payloads remain client-side and so would never trigger a WAF. If there is such protection you need to try various encoding techniques, basically a lot of trial and error. It is depends entirely on the context.

[@TheWafflesalsa]

If you are doing a bug bounty you should read the scope and terms closely in this situation. If you are just trying to hack websites you probably shouldn't.

[@user-rocker]

@@Tib3rius Appreciate your reply.