DOM-Based Cross-Site Scripting (DOM XSS) Explained

DOM-based cross-site scripting (DOM XSS) is a form of cross site scripting first noted by Amit Klein in July 2005 in his paper "DOM Based Cross Site Scripting or XSS of a Third King: A look at an overlooked flavor of XSS". In this paper, Amit argues that reflected typically refers to XSS that bounces off of a server, stored typically refers to XSS where the payload persists in a database - but there are also XSS attacks where the source and sink both reside inside of the browser and in the DOM. These attacks he denotes as DOM XSS.

[joshhubner]

5:50 - 6:04 = GOLD. That was exactly how I needed this worded to be able to explain this method better. Great video all around!

[crittice_]

Great explanation, I am working towards OSCP and this finally made DOM XSS click for me, thank you.

[hadestech]

Andrew, great detail in the explanation of DOM-Based Cross-Site attacks. Absolutely informative and thorough videos on your site. Thank you for the great work.

[xavierbourguignon]

This is exactly what I was looking for in term of information. I do have a question. Why do we need to use a signle quote to terminate the string when a double quote is clearly being used when looking at the code through the dev tools? I tried first to use a double quote and it did not terminate the string, only a single quote would do that.

[CrazyFanaticMan]

How does one prevent DOM XSS? I feel like this would particularly be an issue for ANY site including JAMstack sites no? Since this style of XSS is all client side

[astkh]

As I understand now script tag doesn’t execute inside innerHtml?

[transcribd]

Interesting that it doesn't even need to result in valid html since the browser parses html permissively.