DOM XSS Sources & Sinks
 Share
The version of the browser you are using is no longer supported. Please upgrade to a supported browser.Dismiss

 
View only
 
 
Still loading...
ABCDEFG
1
SourcesDescriptionExampleSinksDescription
2
document.URLAssigned valueeval1st Argument
3
document.documentURIAssigned valuefunction1st argument if only one else last
4
document.URLUnencodedAssigned value; IE onlysetTimeout1st If and only IF string
5
document.baseURIAssigned valuesetInterval1st If and only IF string
6
document.cookieAssigned valueexecScript1st Argument
7
document.referrerAssigned valuecrypto.generateCRFMRequest5th Argument
8
locationAssigned valueScriptElement.srcAssigned value
9
location.hrefAssigned valueScriptElement.textAssigned value
10
location.searchAssigned valueScriptElement.textContentAssigned value
11
location.hashAssigned valueScriptElement.innerTextAssigned value
12
location.pathnameAssigned valueanyTag.onEventNameAssigned value
13
localStorage.getItem1st ArgumentlocalStorage.getItem(literal);
localStorage.getItem(variable);
document.writeAny arugment
14
sessionStorage.getItem1st ArgumentsessionStorage.getItem(literal);
sessionStorage.getItem(variable);
document.writelnAny arugment
15
sessionStorage.key1st ArgumentsessionStorage.key(literal);
sessionStorage.key(variable);
anyElement.innerHTMLAssigned value
16
responseTextAssigned valuexhr.responseText; readonlyRange.createContextualFragment1st Argument
17
dataAssigned valuepostMessage; e.data;HTMLButton.valueAssigned value
18
valueAssigned value<textarea>.value; <input>.valuelocationAssigned value
19
nameAssigned valuelocation.hrefAssigned value
20
window.nameAssigned valuelocation.pathnameAssigned value
21
websockets.onMessage??location.searchAssigned value
22
location.protocolAssigned value
23
location.hostnameAssigned value
24
location.assign()1st Argument
25
location.replace()1st Argument
26
element.setAttribute('href', source);If element is img, iframe, script, anchor and source is not a literal
27
element.setAttribute('src', source);If element is img, iframe, script, anchor and source is not a literal
28
Legendelement.setAttribute('text', source);If element is script and source is not a literal
29
Sources Added by meelement.setAttribute('innerText', source);If element is script and source is not a literal
30
Confused...element.setAttribute('on*', source);If source is any element
31
Practical Use Case? Confused...element.setAttribute('value', source);If source is input element
32
Sinks added by me
33
Taken from DOMXSSWiki
Loading...
 
 
 
Native
jQuery 1.9.1
YUI 3