Practical Web Penetration Testing

DOM XSS

In the first two types above, we've used the HTML to exploit the XSS vulnerability. DOM XSS injection, however, is accomplished through the JavaScript code instead of the HTML elements. Let's see a practical example:

1. Go to the homepage of Mutillidae, then on the left Menu, choose OWASP 2017 | Cross-Site Scripting | DOM-Based | Password Generator.

This page uses the username query string value (which is anonymous in this case) to display on the page (it shows in the message This password is for [username]).

2. First, let's try to change the anonymous username value to gus in the URL:

3. Let's inspect the page source by hitting the