Offensive security assessments
XSS
We validate this area during scoped assessments, documenting impact and remediation guidance.
Why it matters
DOM XSS in Details vulnerable sources and sinks for DOM-based XSS (DOM XSS) attacks. - Sources are locations where untrusted data originates, such as the URL, cookies, or storage. - Sinks are locations where this data is used, such as innerHTML, eval(), or event handlers, where malicious scripts can execute.
How we test it
Our operators follow a structured checklist for this topic, adapted to your API surface and authentication model.
Testing approach
- Bypassing WAF (Web Application Firewall) in XSS (Cross-Site Scripting) attacks relies on exploiting various techniques and methods to bypass the protection put in place by the firewall
- Below are some techniques and examples.
What we look for
- Bypassing WAF (Web Application Firewall) in XSS (Cross-Site Scripting) attacks relies on exploiting various techniques and methods to bypass the protection put in place by the firewall
- Below are some techniques and examples.
Sub-topics
| Topic | Summary |
|---|---|
| How to Identify DOM-Based XSS? | DOM-based XSS occurs when the vulnerability is in the JavaScript code running in the browser, rather than in the server-side response. The malicious script is executed purely on the client side without the server modifying the page. |
| XSS - Cross Site Scripting | XSS is exploited when the attacker can successfully execute any type of script (for example, JavaScript) on the victim's browser. These types of flaws exist because the developer did not validate the request or correctly encoded the response of the application. JavaScript is not… |
Related topics
| Topic | Summary |
|---|---|
| Application Logic Flaws | Application Logic Flaws occur when a web application's normal logic or workflow can be manipulated, allowing attackers to bypass security measures or misuse functionality in unexpected ways. |
| Arbitrary Cookie Flags | Cookies that hold session or sensitive data are set without the proper security flags (Secure, HttpOnly, SameSite). This lets cookies travel over cleartext, be read by JavaScript, or be sent on cross-site requests, enabling theft and CSRF. |
| Back Button Attack | After a user logs out (or on a shared device), pressing the browser Back button or reopening cached pages reveals sensitive data or restores an authenticated view. This happens when the server lets responses be cached and does not fully invalidate the session. |
| Broken Authentication | Flaws in how an application confirms a user's identity, letting attackers compromise passwords, tokens, or sessions and assume other users' identities. It is one of the highest-impact web risks (OWASP Top 10: Identification and Authentication Failures). |
| Brute Force Attack | An attacker systematically tries many credentials, tokens, or values until one works. It succeeds when an endpoint lacks rate limiting, lockout, or sufficient secret entropy. |
| Captcha Bypass | A CAPTCHA is meant to block automated requests, but flawed implementation lets attackers skip or solve it programmatically. Bypassing it re-enables brute force, spam, and other automation the control was meant to stop. |