You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/pentesting-web/xss-cross-site-scripting/dom-invader.md
+89-47Lines changed: 89 additions & 47 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,80 +4,123 @@
4
4
5
5
## DOM Invader
6
6
7
-
DOM Invader is a browser tool installed in Burp's inbuilt browser. It assists in **detecting DOM XSS vulnerabilities**using various sources and sinks, including web messages and prototype pollution. The tool is preinstalled as an extension.
7
+
DOM Invader is a browser tool installed in **Burp Suite's built-in Chromium browser**. It assists in **detecting DOM XSS and other client-side vulnerabilities**(prototype pollution, DOM clobbering, etc.) by automatically **instrumenting JavaScript sources and sinks**. The extension ships with Burp and only needs to be enabled.
8
8
9
-
DOM Invader integrates a tab within the browser's DevTools panel enabling the following:
9
+
DOM Invader adds a tab to the browser’s DevTools panel that lets you:
10
10
11
-
1.**Identification of controllable sinks** on a webpage for DOM XSS testing, providing context and sanitization details.
12
-
2.**Logging, editing, and resending web messages** sent via the `postMessage()` method for DOM XSS testing. DOM Invader can also auto-detect vulnerabilities using specially crafted web messages.
13
-
3. Detection of **client-side prototype pollution** sources and scanning of controllable gadgets sent to risky sinks.
14
-
4. Identification of **DOM clobbering vulnerabilities**.
11
+
1.**Identify controllable sinks** in real time, including context (attribute, HTML, URL, JS) and applied sanitization.
12
+
2.**Log, edit and resend `postMessage()` web-messages**, or let the extension mutate them automatically.
13
+
3.**Detect client-side prototype-pollution sources and scan for gadget→sink chains**, generating PoCs on-the-fly.
14
+
4.**Find DOM clobbering vectors** (e.g. `id` / `name` collisions that overwrite global variables).
15
+
5.**Fine-tune behaviour** via a rich Settings UI (custom canary, auto-injection, redirect blocking, source/sink lists, etc.).
15
16
16
-
### Enable It
17
+
---
17
18
18
-
In the Burp's builtin browser go to the **Burp extension** and enable it:
A **canary** is a random marker string (e.g. `xh9XKYlV`) that DOM Invader tracks. You can:
27
31
28
-
In the previous image you can see a **random group of chars, that is the Canary**. You should now start **injecting** it in different parts of the web (params, forms, url...) and each time click search it. DOM Invader will check if the **canary ended in any interesting sink** that could be exploited.
32
+
***Copy** it and manually inject it in parameters, forms, Web-Socket frames, web-messages, etc.
33
+
* Use **Inject URL params / Inject forms** buttons to open a new tab where the canary is appended to every query key/value or form field automatically.
34
+
* Search for an **empty canary** to reveal all sinks regardless of exploitability (great for reconnaissance).
29
35
30
-
Moreover, the options **Inject URL params** and Inject forms will automatically open a **new tab****injecting** the **canary** in every **URL** param and **form** it finds.
36
+
#### Custom canary (2025+)
31
37
32
-
### Inject an empty Canary
38
+
Burp 2024.12 introduced **Canary settings** (Burp-logo ➜ DOM Invader ➜ Canary). You can:
33
39
34
-
If you just want to find potential sinks the page might have, even if they aren't exploitable, you can **search for an empty canary**.
40
+
***Randomize** or set a **custom string** (helpful for multi-tab testing or when the default value appears naturally on the page).
41
+
***Copy** the value to clipboard.
42
+
* Changes require **Reload**.
35
43
36
-
### Post Messages
44
+
---
37
45
38
-
DOM Invader allows testing for DOM XSS using web messages with features such as:
46
+
### 3. Web-messages (`postMessage`)
39
47
40
-
1.**Logging web messages** sent via `postMessage()`, akin to Burp Proxy's HTTP request/response history logging.
41
-
2.**Modification** and **reissue** of web messages to manually test for DOM XSS, similar to Burp Repeater's function.
42
-
3.**Automatic alteration** and sending of web messages for probing DOM XSS.
48
+
The **Messages** sub-tab records every `window.postMessage()` call, showing `origin`, `source`, and `data` usage.
43
49
44
-
#### Message details
50
+
• **Modify & resend**: double-click a message, edit `data`, and press **Send** (Burp Repeater-like).
45
51
46
-
Detailed information can be viewed about each message by clicking on it, which includes whether the client-side JavaScript accesses the `origin`, `data`, or `source` properties of the message.
52
+
• **Auto-fuzz**: enable **Postmessage interception ➜ Auto-mutate** in settings to let DOM Invader generate canary-based payloads and replay them to the handler.
47
53
48
-
-**`origin`** : If the **origin information of the message is not check**, you may be able to send cross-origin messages to the event handler **from an arbitrary external domain**. But if it's checked it still could be insecure.
49
-
-**`data`**: This is where the payload is sent. If this data is not used, the sink is useless.
50
-
-**`source`**: Evaluates if the source property, usually referencing an iframe, is validated instead of the origin. Even if this is checked, it doesn't assure the validation can't be bypassed.
54
+
Field meaning recap:
51
55
52
-
#### Reply a message
56
+
***origin** – whether the handler validates `event.origin`.
57
+
***data** – payload location. If unused, the sink is irrelevant.
58
+
***source** – iframe / window reference validation; often weaker than strict‐origin checking.
53
59
54
-
1. From the **Messages** view, click on any message to open the message details dialog.
55
-
2. Edit the **Data** field as required.
56
-
3. Click **Send**.
60
+
---
57
61
58
-
### Prototype Pollution
62
+
### 4. Prototype Pollution
59
63
60
-
DOM Invader can also search for **Prototype Pollution vulnerabilities**. First, you need to enable it:
64
+
Enable under **Settings ➜ Attack types ➜ Prototype pollution**.
Then, it will **search for sources** that enable you to add arbitrary properties to the **`Object.prototype`**.
68
+
1.**Browse** – DOM Invader flags pollution **sources** (`__proto__`, `constructor`, `prototype`) found in URL/query/hash or JSON web-messages.
69
+
2.**Test** – clicks *Test* to open a PoC tab where `Object.prototype.testproperty` should exist:
65
70
66
-
If anything is found a **Test** button will appear to **test the found source**. Click on it, a new tab will appear, create an object in the console and check if the `testproperty` exists:
3.**Scan for gadgets** – DOM Invader bruteforces property names and tracks whether any end up in dangerous sinks (e.g. `innerHTML`).
76
+
4.**Exploit** – when a gadget-sink chain is found an *Exploit* button appears that chains source + gadget + sink to trigger alert.
67
77
68
-
```javascript
69
-
let b = {}
70
-
b.testproperty
71
-
```
78
+
Advanced settings (cog icon):
72
79
73
-
Once you found a source you can **scan for a gadget**:
80
+
***Remove CSP / X-Frame-Options** to keep iframes workable during gadget scanning.
81
+
***Scan techniques in separate frames** to avoid `__proto__` vs `constructor` interference.
82
+
***Disable techniques** individually for fragile apps.
74
83
75
-
1. A new tab is opened by DOM Invader when the **Scan for gadgets** button, which can be found next to any identified prototype pollution source in the **DOM** view, is clicked. The scanning for suitable gadgets then begins.
76
-
2. Meanwhile, in the same tab, the **DOM Invader** tab should be opened in the DevTools panel. After the scan completes, any sinks accessible via the identified gadgets are displayed in the **DOM** view. For instance, a gadget property named `html` being passed to the `innerHTML` sink is shown in the example below.
84
+
---
77
85
78
-
##DOM clobbering
86
+
### 5. DOM Clobbering
79
87
80
-
In the previous image it's possible to see that DOM clobbering scan can be turned on. Once done, **DOM Invader will start searching for DOM clobbering vulnerabilities**.
88
+
Toggle **Attack types ➜ DOM clobbering**. DOM Invader monitors dynamically created elements whose `id`/`name` attributes collide with global variables or form objects (`<input name="location">` → clobbers `window.location`). An entry is produced whenever user-controlled markup leads to variable replacement.
89
+
90
+
---
91
+
92
+
## 6. Settings Overview (2025)
93
+
94
+
DOM Invader is now split into **Main / Attack Types / Misc / Canary** categories.
95
+
96
+
1.**Main**
97
+
***Enable DOM Invader** – global switch.
98
+
***Postmessage interception** – turn on/off message logging; sub-toggles for auto-mutation.
99
+
***Custom Sources/Sinks** – *cog icon* ➜ enable/disable specific sinks (e.g. `eval`, `setAttribute`) that may break the app.
0 commit comments