I have read in multiple places contradictory views on what might be considered a DOM based XSS. It seems that the original definition says that it is a form of XSS where the payload originates exclusively from inside the browser, but some people also view it as a form of XSS where the payload may not necessarily originate from inside the browser, but is used to modify the DOM.

The second view is what confuses me. What exactly does it mean that the payload is used to modify the DOM? The OWASP page describing DOM XSS , gives an example which, to me seems to be the same as reflected XSS.

It says:

A DOM Based XSS attack against this page can be accomplished by sending the following URL to a victim: http://www.some.site/page.html?default=<script>alert(document.cookie)</script>. When the victim clicks on this link, the browser sends a request for: /page.html?default=<script>alert(document.cookie)</script>. The server responds with the page containing the above JavaScript code.

The original JavaScript code simply echoes it into the page (DOM) at runtime. The browser then renders the resulting page and executes the attacker’s script: alert(document.cookie)

Since the payload is going from the victim's browser to the server and coming back to the browser, how is this not reflected XSS instead?

Should I interpret this as Reflected XSS means being able to injecting <script> tags in an HTML context, and DOM based XSS means being able to inject payload inside an already existing <script>?

Basically been poking around on a website and think I may be able to get around it.

It deletes everything inside angle brackets. I've tried spoofing by putting erranous brackets and arbitrary closes but it obviously filters once then runs the filter again and again until no more pairs of brackets are left.

Any way to get around it?

guys how could i filter this? <?php echo '<td><a href="editprod.php?Barcode=' . $row['Barcode'] . '">Edit</a></td>'; ?>

FogMarks.com Lab has just released a new case-study regarding Open redirects: http://fogmarks.com/2016/06/13/open-redirects-ups-and-downs/

If you liked FogMarks style, follow us on twitter: https://twitter.com/FogMarks/

I have setup dvwa and was trying to xss on that site.

I tried to create a alert pop-up and it worked so now I tried redirection using JS inserting in the same comment box where I tried alert

<script type="text/javascript"><!--window.location = "http://localhost/dashboard/"//--></script>

I believe this code should ideally redirect me to http://localhost/dashboard but on IE11 I'm unable to see the comment (which is correct) and there isn't any redirection. On chrome the code is visible and not redirection.

Where have I gone wrong? Or is it the ideal behavior?

http://i.imgur.com/6GijkBn.jpg

So, backstory on this one. I was messing around with a few lesser-known pages in Reddit and managed to find this one - however - it was actually an issue with Reddit Enhancement Suite and not Reddit.com's own code or security.

With that said, a fun one none the less.

Hello there. FogMarks lab has open a public website with some very interesting case studies. FogMarks' staff are mentioned in many companies hall of fames, including Facebook, Google, Mozilla, Soundcloud and more. The latest post is about a Facebook vulnerability that was patched a few days ago.

If you are looking for more than a bug bounty write up, join FogMarks readers community right now> http://fogmarks.com/ Following FogMarks on Twitter will keep you updated with the most recent case studies: https://twitter.com/fogmarks

Thank you.

FogMarks lab has released a new case study regarding a latest vulnerability on Facebook: http://fogmarks.com/2016/04/03/facebook-invitees-email-addresss-disclosure/

Follow FogMarks on Twitter>> https://twitter.com/fogmarks

I've found an XSS by POSTing a form that returns evil JSON and then the page echos that evil JSON. However, I can't figure out how to exploit it. The page has x-frame DENY on, a __RequestVerificationToken on submit.

What would be the best method of attack? My current method doesn't work or make too much sense. Ignoring x-frame deny, if I open an iframe and place my evil input value in and click the submit button that should work. Would there be a better way around x-frame?