Analyzes JavaScript flows to locate and exploit XSS vulnerabilities in web applications.
npx skills add https://github.com/blacklanternsecurity/red-run --skill xss-dom
Please help me install this Agent Skill. Skill: xss-dom Source: https://github.com/blacklanternsecurity/red-run/tree/main/skills/web/xss-dom Command: npx skills add https://github.com/blacklanternsecurity/red-run --skill xss-dom
This Skill helps penetration testers identify and exploit DOM-based Cross-Site Scripting vulnerabilities, which exist entirely within client-side JavaScript and are often missed by traditional scanners.
innerHTML sink, and successfully execute an alert() payload.Use the xss-dom skill to analyze the target page at https://example.com/vulnerable.
High-intent search queries and answers about installing and using this skill.
To exploit DOM-based XSS vulnerabilities, you must identify untrusted user-controlled data sources like URL fragments and trace their data flow to dangerous JavaScript sinks that render or execute the data unsafely.
DOM XSS vulnerabilities exist entirely within client-side JavaScript execution, bypassing server-side processing. Traditional XSS relies on server-side reflection or storage, while DOM XSS exploits unsafe client-side data flow from sources to sinks.
Tracing data flow to an innerHTML sink requires analyzing client-side JavaScript execution to see how user-controlled inputs like URL fragments or cookies are passed to dangerous DOM manipulation functions without proper sanitization.
Yes, analyzing JavaScript sources and sinks is the core function. It detects user-controlled data inputs from URLs, cookies, and storage, then identifies dangerous JavaScript functions where that data can be executed or rendered.
DOM XSS payloads fail when client-side JavaScript sanitizes the input, uses safe rendering sinks, or when the data flow from the URL fragment source does not reach a dangerous execution sink within the browser environment.
Yes, exploiting DOM-based Cross-Site Scripting requires browser interaction and analysis of JavaScript execution to verify that payloads successfully reach dangerous sinks and trigger unauthorized code execution.
salmanabdurrahmanTrace attacker-controlled JavaScript sources to dangerous execution sinks.
xalgordDetect and analyze DOM-based XSS vulnerabilities in client-side applications.
vitoropereiraDetect stored, reflected, and DOM-based XSS and HTML injection vulnerabilities in web applications.
AndyAnh174Detect and exploit stored, reflected, and DOM-based XSS vulnerabilities.