dom-xss

a javascript static security analysis tool

XSSB is a proactive DOM sanitizer, defending against client-side injection attacks!

OWASP Xenotix XSS Exploit Framework is an advanced Cross Site Scripting (XSS) vulnerability detection and exploitation framework.

This is a script to exploit DOM XSS in jQuery anchor href attribute sink using location.search source in the PortSwigger Web Security Lab.

Discovering the JavaScript parameters for dom-xss

Find sources and sinks in js code that could lead to DOM XSS 🔎💧🚰

The 29th PoC Hacking Camp - Web Hacking CTF wargame

Advanced Cross-Site Scripting (XSS) vulnerability testing framework with WAF bypass, DOM XSS detection, and comprehensive reporting capabilities.

A chrome extension to detect DOM changes and reflections to find XSS

Ultimate DOM Clobbering Cheat Sheet - 100+ exploitation vectors for XSS, CSP bypass, and client-side attacks. Covers browser compatibility, framework evasion, and real-world exploit chains for security researchers and bug bounty hunters

DOM-based XSS where location.search is written into the page via innerHTML, letting us inject HTML and trigger alert(1) using an SVG onload payload.

DOM-based XSS flaw where location.search is injected into the page via innerHTML, letting us execute arbitrary JavaScript.

DOM XSS in jQuery anchor href attribute sink using location.search source

BRS-KB is XSS Knowledge Base API

MIT license BRS-XSS is a modular Python CLI scanner for XSS vulnerabilities. Features context-aware payloads, WAF evasion, DOM analysis via Playwright, ML-based risk scoring, and export in HTML/JSON/SARIF. Designed for integration with Brabus Recon Suite (BRS).

URDev’s Ultimate Injection Template is my personal payload collection: a comprehensive reference collection of web injection vectors, focused primarily on client-side execution surfaces in modern and legacy web applications.

Chrome DevTools extension for accelerating Trusted Types adoption with real-time CSP violation monitoring, sink analysis, policy generation, and developer-focused DOM XSS remediation workflows.

A fully automated DOM XSS scanner

Web application penetration testing project against OWASP Juice Shop, covering SQL Injection, Reflected XSS, Stored XSS and DOM XSS with Burp Suite, evidence, findings and remediation.

Professional bug bounty style write-up demonstrating exploitation of a DOM-Based Cross-Site Scripting (XSS) vulnerability via insecure postMessage() handling in the PortSwigger Web Security Academy lab.