hunt-dom

Automate DOM XSS hunting and detection across browser vulnerabilities.

Updated Jul 1, 2026

Search Tags:#web security #vulnerability detection #DOM XSS #XSS hunting #client-side exploitation

Ready to run

npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill hunt-dom-bpnrockstar

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-dom
Source: https://github.com/bpnrockstar/UnifiedBugHunter/tree/main/skills/hunt-dom
Command: npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill hunt-dom-bpnrockstar

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill automates the detection and exploitation of client-side DOM-based Cross-Site Scripting (DOM XSS) vulnerabilities.

Core Features & Use Cases

DOM Clobbering Detection: Identifies client-side DOM Clobbering vulnerabilities.
PostMessage Hijacking: Detects and mitigates PostMessage hijacking issues.
Service Worker Abuse: Discovers Service Worker abuse for in-scope fetch and authentication header interception.
CSS Injection and Exfiltration: Detects and analyzes CSS-based DOM XSS vulnerabilities and exfiltration.
Client-Side Template Injection: Identifies template injection vulnerabilities within JavaScript frameworks.
Use Case: Use this Skill to automate the process of identifying DOM XSS vulnerabilities in web applications, saving manual time and reducing false positives.

Quick Start

To initiate a scan for DOM XSS vulnerabilities on the target 'https://example.com', use the following command: hunt-dom scan https://example.com

Frequently Asked Questions about hunt-dom

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate DOM XSS detection in web applications?▼

To automate DOM XSS detection, you can use a hunting skill to scan target URLs for client-side vulnerabilities. It identifies issues like DOM Clobbering, PostMessage hijacking, and Service Worker abuse by running automated browser checks.

What is DOM Clobbering and how do I detect it?▼

DOM Clobbering is a client-side vulnerability where global variables are overwritten via HTML markup. You can detect DOM Clobbering by running an automated client-side script scan that identifies unexpected DOM element injections.

How do I find PostMessage hijacking vulnerabilities in JavaScript?▼

You find PostMessage hijacking vulnerabilities by using an automated detection tool to scan your JavaScript frameworks. It analyzes message event listeners for insufficient origin validation and client-side exploitation risks.

Can I detect Client-Side Template Injection and CSS Exfiltration automatically?▼

Yes, you can detect Client-Side Template Injection and CSS Exfiltration automatically. An automated DOM XSS hunting skill identifies template injection within JavaScript frameworks and analyzes CSS-based exfiltration vectors.

What is the best way to scan for Service Worker abuse in client-side exploitation?▼

The best way to scan for Service Worker abuse is using an automated DOM XSS hunting tool. It discovers Service Worker abuse targeting in-scope fetch interception and authentication header theft during client-side checks.

How do I start a scan for DOM XSS payloads on a specific target URL?▼

To start a scan for DOM XSS payloads, execute a command targeting your specific URL. For example, run `hunt-dom scan https://example.com` to identify potential XSS payloads and client-side vulnerabilities automatically.