xss-dom

What problem does it solve?

This Skill helps penetration testers identify and exploit DOM-based Cross-Site Scripting vulnerabilities, which exist entirely within client-side JavaScript and are often missed by traditional scanners.

Core Features & Use Cases

• Source Identification: Detects user-controlled data inputs from URLs, cookies, and storage.
• Sink Analysis: Identifies dangerous JavaScript functions where data can be executed or rendered unsafely.
• Exploitation: Guides the user in crafting and delivering payloads to exploit the identified vulnerabilities.
• Use Case: A penetration tester suspects a web application is vulnerable to DOM XSS. They use this skill to analyze the client-side JavaScript, trace data flow from a URL fragment to an innerHTML sink, and successfully execute an alert() payload.

Quick Start

Use the xss-dom skill to analyze the target page at https://example.com/vulnerable.