From fc36b38430e92a61fb61e750110ccbaa84f0d7c0 Mon Sep 17 00:00:00 2001 From: Swissky <12152583+swisskyrepo@users.noreply.github.com> Date: Sat, 10 Jun 2023 20:08:23 +0200 Subject: [PATCH] DOM Clobbering --- DNS Rebinding/README.md | 1 + Dom Clobbering/README.md | 132 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 133 insertions(+) create mode 100644 Dom Clobbering/README.md diff --git a/DNS Rebinding/README.md b/DNS Rebinding/README.md index c35ddaa..4391b6c 100644 --- a/DNS Rebinding/README.md +++ b/DNS Rebinding/README.md @@ -7,6 +7,7 @@ * [Tools](#tools) * [Exploitation](#exploitation) * [Protection Bypasses](#protection-bypasses) +* [References](#references) ## Tools diff --git a/Dom Clobbering/README.md b/Dom Clobbering/README.md new file mode 100644 index 0000000..70a80f8 --- /dev/null +++ b/Dom Clobbering/README.md @@ -0,0 +1,132 @@ +# Dom Clobbering + +> DOM Clobbering is a technique where global variables can be overwritten or "clobbered" by naming HTML elements with certain IDs or names. This can cause unexpected behavior in scripts and potentially lead to security vulnerabilities. + +## Summary + +* [Lab](#lab) +* [Exploit](#exploit) +* [References](#references) + + +## Lab + +* [Lab: Exploiting DOM clobbering to enable XSS](https://portswigger.net/web-security/dom-based/dom-clobbering/lab-dom-xss-exploiting-dom-clobbering) +* [Lab: Clobbering DOM attributes to bypass HTML filters](https://portswigger.net/web-security/dom-based/dom-clobbering/lab-dom-clobbering-attributes-to-bypass-html-filters) +* [Lab: DOM clobbering test case protected by CSP](https://portswigger-labs.net/dom-invader/testcases/augmented-dom-script-dom-clobbering-csp/) + +## Exploit + +Exploitation requires any kind of `HTML injection` in the page. + +* Clobbering `x.y.value` + ```html + // Payload +
I've been clobbered + + // Sink + + ``` + +* Clobbering `x.y` using ID and name attributes together to form a DOM collection + ```html + // Payload + + + // Sink + + ``` + +* Clobbering `x.y.z` - 3 levels deep + ```html + // Payload + +
+ + // Sink + + ``` + +* Clobbering `a.b.c.d` - more than 3 levels + ```html + // Payload + + + + // Sink + + ``` + +* Clobbering `forEach` (Chrome only) + ```html + // Payload +
+ + +
+ + // Sink + + ``` + +* Clobbering `document.getElementById()` using `` or `` tag with the same `id` attribute + ```html + // Payloads + clobbered + clobbered + + + // Sink + + ``` + +* Clobbering `x.username` + ```html + // Payload +
+ + // Sink + + ``` + +* Clobbering (Firefox only) + ```html + // Payload + + + // Sink + + ``` + +* Clobbering (Chrome only) + ```html + // Payload + + + // Sink + + ``` + + +## Tricks + +* DomPurify allows the protocol `cid:`, which doesn't encode double quote (`"`): `` + + +## References + +* [Dom Clobbering - PortSwigger](https://portswigger.net/web-security/dom-based/dom-clobbering) +* [Dom Clobbering - HackTricks](https://book.hacktricks.xyz/pentesting-web/xss-cross-site-scripting/dom-clobbering) +* [DOM Clobbering strikes back - @garethheyes - 06 February 2020](https://portswigger.net/research/dom-clobbering-strikes-back) +* [Hijacking service workers via DOM Clobbering - @garethheyes - 29 November 2022](https://portswigger.net/research/hijacking-service-workers-via-dom-clobbering) +* [Bypassing CSP via DOM clobbering - @garethheyes - 05 June 2023](https://portswigger.net/research/bypassing-csp-via-dom-clobbering) \ No newline at end of file