hunt-dom

Automate DOM XSS hunting and detection across browser vulnerabilities.

Updated Jul 1, 2026
One-click install
npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill hunt-dom-bpnrockstar
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: hunt-dom
Source: https://github.com/bpnrockstar/UnifiedBugHunter/tree/main/skills/hunt-dom
Command: npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill hunt-dom-bpnrockstar

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill automates the detection and exploitation of client-side DOM-based Cross-Site Scripting (DOM XSS) vulnerabilities.

Core Features & Use Cases

  • DOM Clobbering Detection: Identifies client-side DOM Clobbering vulnerabilities.
  • PostMessage Hijacking: Detects and mitigates PostMessage hijacking issues.
  • Service Worker Abuse: Discovers Service Worker abuse for in-scope fetch and authentication header interception.
  • CSS Injection and Exfiltration: Detects and analyzes CSS-based DOM XSS vulnerabilities and exfiltration.
  • Client-Side Template Injection: Identifies template injection vulnerabilities within JavaScript frameworks.
  • Use Case: Use this Skill to automate the process of identifying DOM XSS vulnerabilities in web applications, saving manual time and reducing false positives.

Quick Start

To initiate a scan for DOM XSS vulnerabilities on the target 'https://example.com', use the following command: hunt-dom scan https://example.com

Frequently Asked Questions about hunt-dom

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate DOM XSS detection in web applications?

To automate DOM XSS detection, you can use a hunting skill to scan target URLs for client-side vulnerabilities. It identifies issues like DOM Clobbering, PostMessage hijacking, and Service Worker abuse by running automated browser checks.

What is DOM Clobbering and how do I detect it?

DOM Clobbering is a client-side vulnerability where global variables are overwritten via HTML markup. You can detect DOM Clobbering by running an automated client-side script scan that identifies unexpected DOM element injections.

How do I find PostMessage hijacking vulnerabilities in JavaScript?

You find PostMessage hijacking vulnerabilities by using an automated detection tool to scan your JavaScript frameworks. It analyzes message event listeners for insufficient origin validation and client-side exploitation risks.

Can I detect Client-Side Template Injection and CSS Exfiltration automatically?

Yes, you can detect Client-Side Template Injection and CSS Exfiltration automatically. An automated DOM XSS hunting skill identifies template injection within JavaScript frameworks and analyzes CSS-based exfiltration vectors.

What is the best way to scan for Service Worker abuse in client-side exploitation?

The best way to scan for Service Worker abuse is using an automated DOM XSS hunting tool. It discovers Service Worker abuse targeting in-scope fetch interception and authentication header theft during client-side checks.

How do I start a scan for DOM XSS payloads on a specific target URL?

To start a scan for DOM XSS payloads, execute a command targeting your specific URL. For example, run `hunt-dom scan https://example.com` to identify potential XSS payloads and client-side vulnerabilities automatically.