skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

hunt-dom

Identify and exploit client-side DOM vulnerabilities in modern web applications.

3|1|Updated Jul 2, 2026
Search Tags:#security#exfiltration#redteam#postmessage#dom-xss#clobbering
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-dom-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-dom
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/hunt-dom
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-dom-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the difficulty of identifying and exploiting complex client-side vulnerabilities like DOM Clobbering, PostMessage hijacking, and CSS exfiltration, which often bypass traditional server-side security controls.

Core Features & Use Cases

  • DOM Clobbering Analysis: Identify and exploit JS global overwrites to achieve XSS or auth bypass.
  • PostMessage & Service Worker Auditing: Detect insecure cross-origin communication and persistent credential interception.
  • CSS Exfiltration: Perform char-by-char data leakage of sensitive tokens using attribute selectors.
  • Use Case: Use this skill when you need to audit a modern web application for DOM-based XSS or session theft that occurs entirely within the victim's browser.

Quick Start

Use the hunt-dom skill to analyze the target application for DOM clobbering and insecure postMessage handlers.

Frequently Asked Questions about hunt-dom

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect DOM-based XSS and DOM Clobbering vulnerabilities in modern web applications?▼

DOM-based XSS and DOM Clobbering vulnerabilities are identified by analyzing the client-side DOM for JavaScript global overwrites and insecure sink reachability, uncovering potential cross-site scripting or authentication bypass chains.

How does CSS exfiltration allow char-by-char data leakage of sensitive tokens?▼

CSS exfiltration allows char-by-char data leakage of sensitive tokens by using attribute selectors to style target elements conditionally, triggering out-of-band callbacks that reveal the content of protected attributes.

How do I audit insecure postMessage handlers and Service Worker abuse for session theft?▼

Auditing insecure postMessage handlers and Service Worker abuse for session theft involves inspecting cross-origin communication flows to detect persistent credential interception and hijacking vectors.

Can I use client-side DOM vulnerability hunting to bypass server-side security controls?▼

Client-side DOM vulnerability hunting bypasses server-side security controls by uncovering DOM-XSS, session theft, and CSRF chains that execute entirely within the victim's browser without direct server interaction.

Does client-side DOM vulnerability hunting require manual verification of OOB callbacks?▼

Client-side DOM vulnerability hunting requires manual verification of OOB callbacks and sink reachability to confirm actual impact and eliminate false positives from theoretical execution paths.

Related Skills

Explore More Software Engineering Skills→
salmanabdurrahmansalmanabdurrahman

recon-js-analysis

Extract API endpoints, routing tables, and environment configurations from client-side JavaScript bundles.

Community
Advanced
sseshachalasseshachala

hunt-xxe

Identify XXE vulnerabilities in XML parsers via inline and DTD payloads.

Community
Advanced
dreadnodedreadnode
11

esi-injection

Detect and exploit ESI and SSI injection vulnerabilities in CDN-cached web applications.

Official
Intermediate
0xShe0xShe
386

php-sql-audit

Trace PHP SQL execution points from user input to assess injection risk.

Community
Advanced