52 lines
2.5 KiB
YAML
52 lines
2.5 KiB
YAML
id: dom-xss
|
|
|
|
info:
|
|
name: DOM Invader - Cross-Site Scripting
|
|
author: geeknik
|
|
severity: high
|
|
description: DOM Invader contains a cross-site scripting vulnerability in Sources & Sinks functionality.
|
|
reference:
|
|
- Inspired by https://portswigger.net/blog/introducing-dom-invader
|
|
classification:
|
|
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
|
|
cvss-score: 7.2
|
|
cwe-id: CWE-79
|
|
tags: xss,file
|
|
|
|
file:
|
|
- extensions:
|
|
- js
|
|
- ts
|
|
- html
|
|
- htm
|
|
- php
|
|
- cs
|
|
- rb
|
|
- py
|
|
|
|
extractors:
|
|
- type: regex
|
|
name: sink
|
|
part: body
|
|
regex:
|
|
- 'jQuery(\.globalEval|\.\$|\.constructor|\.parseHTML|\.has|\.init|\.index|\.add|\.append|\.appendTo|\.after|\.insertAfter|\.before|\.insertBefore|\.html|\.prepend|\.prependTo|\.replaceWith|\.replaceAll|\.wrap|\.wrapALL|\.wrapInner|\.prop\.innerHTML|\.prop\.outerHTML|\.attr\.onclick|\.attr\.onmouseover|\.attr.onmousedown|\.attr\.onmouseup|\.attr\.onkeydown|\.attr\.onkeypress|\.attr\.onkeyup|\.attr\.href|\.attr\.src|\.attr\.data|\.attr\.action|\.attr\.formaction|\.prop\.href|\.prop\.src|\.prop\.data|\.prop\.action|\.prop\.formaction)'
|
|
- 'eval|Function|execScript|msSetImmediate|fetch(\.body)?|form\.action|websocket|RegExp|javascriptURL|createContextualFragment|webdatabase\.executeSql|JSON\.parse'
|
|
- 'fetch(\.body)?'
|
|
- 'history(\.pushState|\.replaceState)'
|
|
- '(session|local)Storage(\.setItem(\.name|\.value))'
|
|
- 'anchor(\.href|\.target)'
|
|
- 'button(\.formaction|\.value)'
|
|
- 'set(Timeout|Interval|Immediate)'
|
|
- 'script(\.src|\.textContent|\.innerText|\.innerHTML|\.appendChild|\.append)'
|
|
- 'document(\.write|\.writeln|\.implementation\.createHTMLDocument|\.domain|\.cookie|\.evaluate)'
|
|
- 'element(\.outerText|\.innerText|\.textContent|\.style\.cssText|\.innerHTML|\.outerHTML|\.insertAdjacentHTML|\.setAttribute(\.onclick|\.onmouseover|\.onmousedown|\.onmouseup|\.onkeydown|\.onkeypress|\.onkeyup|\.href|\.src|\.data|\.action|\.formaction))'
|
|
- 'location(\.href|\.replace|\.assign|\.pathname|\.protocol|\.host|\.hostname|\.hash|\.search)?'
|
|
- 'iframe(\.srcdoc|\.src)'
|
|
- 'xhr(\.open|\.send|\.setRequestHeader(\.name|\.value)?)'
|
|
- type: regex
|
|
name: source
|
|
part: body
|
|
regex:
|
|
- 'location(\.href|\.hash|\.search|\.pathname)?'
|
|
- 'window\.name'
|
|
- 'document(\.URL|\.referrer|\.documentURI|\.baseURI|\.cookie)' |