Hunt Dom
Hunt client-side DOM vulnerabilities, DOM Clobbering (overwrite JS globals via HTML...
Install
npx skills add elementalsouls/Claude-BugHunter --skill hunt-dom -g -a claude-code -y- Repository
- elementalsouls/Claude-BugHunter5.4k
- Category
- Design
- Updated
- 3d ago
- License
- MIT
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Hunt client-side DOM vulnerabilities, DOM Clobbering (overwrite JS globals via HTML injection), PostMessage hijacking (missing origin check), Service Worker abuse (intercept requests from same-origin script), CSS Injection/Exfiltration (attribute selectors → token char-by-char via OOB), client-side template injection, dangerouslySetInnerHTML. Grounded in named public research: Gareth Heyes / PortSwigger DOM-clobbering + DOM-Invader, Michał Bentkowski DOMPurify clobbering bypasses, jQuery htmlPrefilter XSS (CVE-2020-11022 / CVE-2020-11023), d0nut CSS-exfil research. Use when hunting DOM-XSS, client-side auth bypass, or token exfiltration without server-side interaction.
HUNT-DOM, DOM Clobbering / PostMessage / Service Worker / CSS Exfil
Crown Jewel Targets
DOM-based attacks execute in the victim's browser, the server often never sees the payload, so WAFs and server-side input filters do not apply. PostMessage missing-origin-check = cross-origin token theft with no XSS needed.
Highest-value chains:
- DOM Clobbering → DOM-XSS / auth bypass, HTML markup injection (no
<script>) overwrites a JS global likewindow.configor shadowsdocument.getElementById, and the app later treats that value as a URL/code → sink fires under a markup-only injection where script is filtered. - PostMessage no origin check → session theft / DOM-XSS, a
messagehandler that trustsevent.datawithout validatingevent.originlets an attacker iframe/opener drive privileged actions or feed a sink. - Service Worker abuse, register a same-origin SW script (reachable because of an upload / open-redirect / path the target serves) via stored XSS → intercept all in-scope
fetch→ persistent credential capture. - CSS Exfil, attribute-value selectors (
input[value^="a"]) leak a CSRF token / API key / nonce char-by-char to an OOB host with zero JS.
