Methodology

A repeatable process for finding DOM XSS vulnerabilities. Follow these steps and iterate.

Methodology Checklist

  1. Get familiar with the application understand if this is a good target for client-side and learn the flows and functionality.
  2. Identify sources and sinks by searching through code and using the application.
  3. Set breakpoints in dev tools on a source or sink you want to analyze. Use the Sources panel to locate the code and click the line number.
  4. Use the debugger to follow the trace. Step through execution from source to sink. Watch how data transforms along the way.
  5. Make note of any data transformation or conditions that affect the code path. Look for encoding, filtering, sanitization, or conditional branches that might block or alter your payload.
  6. If a reachable path is identified, craft your payload. Build a payload that allows you to take the necessarily code path. Don't guess or spray wordlists, understand the context and preconditions for your XSS to fire.
  7. Rinse and repeat. Move to the next source/sink pair. Most of the time you will be chasing dead-ends, but persistence is key.

Quick Reference: What To Search For

Sources to Find
  • location.hash
  • location.search
  • location.href
  • location.pathname
  • URLSearchParams
  • addEventListener("message"
  • onmessage
Sinks to Find
  • innerHTML
  • outerHTML
  • document.write
  • import(
  • eval(
  • Function(
  • setTimeout(
  • setInterval(
  • location.href =
  • window.open(
  • .src =
  • .href =

Resources / Further Learning / Communities

Next: Planet Hacking →