2 ms·

Wouldn't evilCredntialStealingJavascript() have to be stored on the server in the first place...?

• marcosdumay 9y ago
  It needs to be echoed into somewhere on the page. Not necessarily stored on the server.
• thephyber 9y ago
  No. DOM-based XSS is when JavaScript running on the client takes data from a "source" (URL parameter, DOM content, cookie, LocalStorage, etc), manipulates it, and then executes it on a "sink" without properly escaping it. Examples of "sources" and "sinks"[1]. I've reported DOM-based XSS on a website that parses user-generated comments for URLs then converts the comment by adding hyperlink markup to the URL. It was done insecurely, so I managed to use combinations of spaces and other HTML attribute delimiters to inject an "onMouseOver" attribute and collect a bounty (about $2000 IIRC). In my case, the payout was large because the data was stored on the server (therefore it was persistent XSS), but with URL fragments, it's possible for the server to never see the content that is passed to the "source". [1] https://docs.google.com/spreadsheets/d/1Mnuqkbs9L-s3QpQtUrOkPx6t5dR3QyQo24kCVYQy7YY/edit https://docs.google.com/spreadsheets/d/1Mnuqkbs9L-s3QpQtUrOk...