skills.rest
inventashif
inventashifCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-dom

Detect client-side DOM vulnerabilities including clobbering, postMessage hijacking, service worker abuse, and CSS exfiltration.

Updated Sep 6, 2026
Search Tags:#service worker#web security#bug bounty#postmessage#dom clobbering#dom-xss#css exfiltration
One-click install
npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-dom-inventashif
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-dom
Source: https://github.com/inventashif/helpful-code-sidekick/tree/main/scripts/hackerai/skills/bughunter/hunt-dom
Command: npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-dom-inventashif

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Client-side vulnerabilities like DOM-XSS, postMessage hijacking, and CSS-based token exfiltration execute entirely in the victim's browser, so server-side WAFs and input filters never see them. This Skill gives security researchers a structured, research-grounded methodology to find, exploit, and validate these DOM-based attack paths during authorized bug bounty hunting. ## Core Features & Use Cases - DOM Clobbering Detection: Identify markup-only injections that overwrite JS globals (window.config, baseURI) and reach sinks like script.src or location, including jQuery htmlPrefilter XSS (CVE-2020-11022/11023) checks. - PostMessage & Service Worker Analysis: Find message handlers with missing or weak origin checks, senders leaking secrets with targetOrigin '*', and same-origin service worker registration paths for persistent interception. - CSS Exfiltration & Framework Sinks: Leak CSRF tokens char-by-char via attribute selectors with OOB confirmation, and audit dangerouslySetInnerHTML, v-html, and client-side template injection sinks. - Use Case: While testing a target's SSO widget iframe, you find a message listener with no origin check; the Skill walks you through building a PoC that drives event.data into an innerHTML sink and captures the session token via an OOB callback. ## Quick Start Ask the AI to hunt for DOM-based vulnerabilities on an authorized bug bounty target, starting with postMessage handlers and clobberable globals in the site's JavaScript bundles.

Frequently Asked Questions about hunt-dom

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find DOM-XSS vulnerabilities in a web application?▼

Map client-side sources to sinks by grepping JavaScript bundles for innerHTML, eval, location, and document.getElementById patterns, then test markup injection points like bios and comments. Tools like Burp's DOM Invader automate source-to-sink tracing and clobbering detection.

How to test postMessage handlers for missing origin checks?▼

Grep the target's JavaScript for addEventListener('message') handlers lacking event.origin validation, then frame the page from an attacker-controlled host and postMessage a crafted payload. Weak checks like indexOf or endsWith can be bypassed using look-alike origins such as target.com.evil.com.

Can CSS injection really steal CSRF tokens?▼

Yes, CSS attribute selectors like input[value^="a"] can leak token values character-by-character by triggering requests to an attacker server when a prefix matches. However, it fails when CSP headers like img-src or connect-src restrict external origins, so always read the Content-Security-Policy first.

Can a service worker be registered from a cross-origin script?▼

No, service worker script URLs must be same-origin as the registering page; cross-origin registration throws a SecurityError. The realistic attack path requires getting a script onto the target origin via file upload or a route serving attacker content as text/javascript.

Why does my DOM clobbering payload not count as a valid finding?▼

A clobberable global only matters if it actually reaches a sink like script.src, location, or innerHTML and produces observable impact. Bug bounty programs require demonstrated impact, such as executed XSS or navigation to an attacker URL, not just a clobbered namespace.

What tools are used for client-side vulnerability hunting?▼

DOM Invader in Burp Suite's browser finds sources, sinks, postMessage flows, and clobbering automatically. Burp Collaborator, interactsh, or request-bin provide the mandatory out-of-band callbacks needed to prove CSS exfiltration and service worker interception.

Related Skills

Explore More Software Engineering Skills→
bpnrockstarbpnrockstar

web2-recon

Automate web2 reconnaissance with subdomain discovery, live host enumeration, URL crawling, and JavaScript bundle analysis.

Community
Advanced
marcboggsmarcboggs

report-writing

Writes impact-first bug bounty reports for HackerOne, Bugcrowd, Intigriti, and Immunefi with CVSS scoring.

Community
Intermediate
hhjkjkjkhhjkjkjk

hunt-xss

Detect and validate reflected, stored, and DOM-based XSS vulnerabilities on web targets.

Community
Advanced
securityfortechsecurityfortech
6

cspt

Analyze JavaScript fetch() and XHR requests for Client-Side Path Traversal vulnerabilities.

Official
Advanced