Bug Bounty Hunting Essentials

DOM-based XSS

In reflected and stored XSS, there is something in common, a user or a data source that interacts with the application by inserting a value, which is then read by the application. The third kind of XSS is different.

In a DOM-based XSS, the user sends a crafted URL with the code injected into it. Then, the server processes the information, but in the response, it does not include the injection; instead of it, the user's browser processes the response and the script is executed.

To understand how DOM-based XSS works, it is necessary to explain the DOM concept.

The Document Object Model (DOM) is an interface for HTML and XML documents to modify the document itself in a structured way. The DOM structures a document in a series of ...