You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/pentesting-web/xss-cross-site-scripting/dom-invader.md
+90-46Lines changed: 90 additions & 46 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,80 +4,125 @@
4
4
5
5
## DOM Invader
6
6
7
-
DOM Invader is a browser tool installed in Burp's inbuilt browser. It assists in **detecting DOM XSS vulnerabilities**using various sources and sinks, including web messages and prototype pollution. The tool is preinstalled as an extension.
7
+
DOM Invader is a browser tool installed in **Burp Suite's built-in Chromium browser**. It assists in **detecting DOM XSS and other client-side vulnerabilities**(prototype pollution, DOM clobbering, etc.) by automatically **instrumenting JavaScript sources and sinks**. The extension ships with Burp and only needs to be enabled.
8
8
9
-
DOM Invader integrates a tab within the browser's DevTools panel enabling the following:
9
+
DOM Invader adds a tab to the browser’s DevTools panel that lets you:
10
10
11
-
1.**Identification of controllable sinks** on a webpage for DOM XSS testing, providing context and sanitization details.
12
-
2.**Logging, editing, and resending web messages** sent via the `postMessage()` method for DOM XSS testing. DOM Invader can also auto-detect vulnerabilities using specially crafted web messages.
13
-
3. Detection of **client-side prototype pollution** sources and scanning of controllable gadgets sent to risky sinks.
14
-
4. Identification of **DOM clobbering vulnerabilities**.
11
+
1.**Identify controllable sinks** in real time, including context (attribute, HTML, URL, JS) and applied sanitization.
12
+
2.**Log, edit and resend `postMessage()` web-messages**, or let the extension mutate them automatically.
13
+
3.**Detect client-side prototype-pollution sources and scan for gadget→sink chains**, generating PoCs on-the-fly.
14
+
4.**Find DOM clobbering vectors** (e.g. `id` / `name` collisions that overwrite global variables).
15
+
5.**Fine-tune behaviour** via a rich Settings UI (custom canary, auto-injection, redirect blocking, source/sink lists, etc.).
15
16
16
-
### Enable It
17
+
---
17
18
18
-
In the Burp's builtin browser go to the **Burp extension** and enable it:
> Burp remembers the state per profile. Disable it under *Settings ➜ Tools ➜ Burp’s browser ➜ Store settings...* if required.
25
29
26
-
### Inject a Canary
30
+
### 2. Inject a Canary
27
31
28
-
In the previous image you can see a **random group of chars, that is the Canary**. You should now start **injecting** it in different parts of the web (params, forms, url...) and each time click search it. DOM Invader will check if the **canary ended in any interesting sink** that could be exploited.
32
+
A **canary** is a random marker string (e.g. `xh9XKYlV`) that DOM Invader tracks. You can:
29
33
30
-
Moreover, the options **Inject URL params** and Inject forms will automatically open a **new tab****injecting** the **canary** in every **URL** param and **form** it finds.
34
+
***Copy** it and manually inject it in parameters, forms, Web-Socket frames, web-messages, etc.
35
+
* Use **Inject URL params / Inject forms** buttons to open a new tab where the canary is appended to every query key/value or form field automatically.
36
+
* Search for an **empty canary** to reveal all sinks regardless of exploitability (great for reconnaissance).
31
37
32
-
###Inject an empty Canary
38
+
#### Custom canary (2025+)
33
39
34
-
If you just want to find potential sinks the page might have, even if they aren't exploitable, you can**search for an empty canary**.
40
+
Burp 2024.12 introduced **Canary settings** (Burp-logo ➜ DOM Invader ➜ Canary). You can:
35
41
36
-
### Post Messages
42
+
***Randomize** or set a **custom string** (helpful for multi-tab testing or when the default value appears naturally on the page).
43
+
***Copy** the value to clipboard.
44
+
* Changes require **Reload**.
37
45
38
-
DOM Invader allows testing for DOM XSS using web messages with features such as:
46
+
---
39
47
40
-
1.**Logging web messages** sent via `postMessage()`, akin to Burp Proxy's HTTP request/response history logging.
41
-
2.**Modification** and **reissue** of web messages to manually test for DOM XSS, similar to Burp Repeater's function.
42
-
3.**Automatic alteration** and sending of web messages for probing DOM XSS.
48
+
### 3. Web-messages (`postMessage`)
43
49
44
-
#### Message details
50
+
The **Messages** sub-tab records every `window.postMessage()` call, showing `origin`, `source`, and `data` usage.
45
51
46
-
Detailed information can be viewed about each message by clicking on it, which includes whether the client-side JavaScript accesses the `origin`, `data`, or `source` properties of the message.
52
+
• **Modify & resend**: double-click a message, edit `data`, and press **Send** (Burp Repeater-like).
47
53
48
-
-**`origin`** : If the **origin information of the message is not check**, you may be able to send cross-origin messages to the event handler **from an arbitrary external domain**. But if it's checked it still could be insecure.
49
-
-**`data`**: This is where the payload is sent. If this data is not used, the sink is useless.
50
-
-**`source`**: Evaluates if the source property, usually referencing an iframe, is validated instead of the origin. Even if this is checked, it doesn't assure the validation can't be bypassed.
54
+
• **Auto-fuzz**: enable **Postmessage interception ➜ Auto-mutate** in settings to let DOM Invader generate canary-based payloads and replay them to the handler.
51
55
52
-
#### Reply a message
56
+
Field meaning recap:
53
57
54
-
1. From the **Messages**view, click on any message to open the message details dialog.
55
-
2. Edit the **Data**field as required.
56
-
3. Click **Send**.
58
+
***origin**– whether the handler validates `event.origin`.
59
+
***data**– payload location. If unused, the sink is irrelevant.
60
+
***source** – iframe / window reference validation; often weaker than strict‐origin checking.
57
61
58
-
### Prototype Pollution
62
+
---
59
63
60
-
DOM Invader can also search for **Prototype Pollution vulnerabilities**. First, you need to enable it:
Enable under **Settings ➜ Attack types ➜ Prototype pollution**.
63
67
64
-
Then, it will **search for sources** that enable you to add arbitrary properties to the **`Object.prototype`**.
68
+
Workflow:
65
69
66
-
If anything is found a **Test** button will appear to **test the found source**. Click on it, a new tab will appear, create an object in the console and check if the `testproperty` exists:
70
+
1.**Browse** – DOM Invader flags pollution **sources** (`__proto__`, `constructor`, `prototype`) found in URL/query/hash or JSON web-messages.
71
+
2.**Test** – clicks *Test* to open a PoC tab where `Object.prototype.testproperty` should exist:
3.**Scan for gadgets** – DOM Invader bruteforces property names and tracks whether any end up in dangerous sinks (e.g. `innerHTML`).
78
+
4.**Exploit** – when a gadget-sink chain is found an *Exploit* button appears that chains source + gadget + sink to trigger alert.
72
79
73
-
Once you found a source you can **scan for a gadget**:
80
+
Advanced settings (cog icon):
74
81
75
-
1. A new tab is opened by DOM Invader when the **Scan for gadgets** button, which can be found next to any identified prototype pollution source in the **DOM** view, is clicked. The scanning for suitable gadgets then begins.
76
-
2. Meanwhile, in the same tab, the **DOM Invader** tab should be opened in the DevTools panel. After the scan completes, any sinks accessible via the identified gadgets are displayed in the **DOM** view. For instance, a gadget property named `html` being passed to the `innerHTML` sink is shown in the example below.
82
+
***Remove CSP / X-Frame-Options** to keep iframes workable during gadget scanning.
83
+
***Scan techniques in separate frames** to avoid `__proto__` vs `constructor` interference.
84
+
***Disable techniques** individually for fragile apps.
77
85
78
-
## DOM clobbering
86
+
---
79
87
80
-
In the previous image it's possible to see that DOM clobbering scan can be turned on. Once done, **DOM Invader will start searching for DOM clobbering vulnerabilities**.
88
+
### 5. DOM Clobbering
89
+
90
+
Toggle **Attack types ➜ DOM clobbering**. DOM Invader monitors dynamically created elements whose `id`/`name` attributes collide with global variables or form objects (`<input name="location">` → clobbers `window.location`). An entry is produced whenever user-controlled markup leads to variable replacement.
91
+
92
+
---
93
+
94
+
## 6. Settings Overview (2025)
95
+
96
+
DOM Invader is now split into **Main / Attack Types / Misc / Canary** categories.
97
+
98
+
1.**Main**
99
+
***Enable DOM Invader** – global switch.
100
+
***Postmessage interception** – turn on/off message logging; sub-toggles for auto-mutation.
101
+
***Custom Sources/Sinks** – *cog icon* ➜ enable/disable specific sinks (e.g. `eval`, `setAttribute`) that may break the app.
0 commit comments