Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Exploiting DOM clobbering to enable XSS

PhenomAnon | Last updated: Oct 27, 2022 08:45PM UTC

Within this lab it says that: "he defaultAvatar object is implemented using this dangerous pattern containing the logical OR operator in conjunction with a global variable. This makes it vulnerable to DOM clobbering." While Inspecting the Blog page I am able to find <img class="avatar" src="/resources/images/avatarDefault.svg"> But that is the closest thing to the defaultAvatar object that I can find. Am I looking in the wrong place? I have solved the lab but I am hoping to understand it better.

Ben, PortSwigger Agent | Last updated: Oct 28, 2022 10:58AM UTC

Hi, You can find this within the JavaScript resources on the page. There are a couple of ways to do this: If you open up the Developer Tools in your browser, navigate to 'Sources' and then view the js/loadCommentsWithDomClobbering.js file you can then view the code that is being referred to within the solution. Similarly, you can also view this within Burp itself. If you navigate to the Target -> Site map tab, select your lab host and expand the resources/js/loadCommentsWithDomClobbering.js section this will also show you the JavaScript file being referred to. I have provided a couple of screenshots below to illustrate both these methods: https://snipboard.io/814VXr.jpg https://snipboard.io/l1kKUX.jpg

PhenomAnon | Last updated: Oct 28, 2022 06:47PM UTC

Hi, Thanks for your reply! This is very strange... I have retried the lab but I am still not able to find the directory you mentioned. Not on Browser -> Inspect, and not on Burp Target either. I have included screenshots of both attempts respectively. https://snipboard.io/VMJFwu.jpg https://snipboard.io/7ADgih.jpg

Ben, PortSwigger Agent | Last updated: Oct 31, 2022 08:14AM UTC