Later archive addition

DOM Clobbering strikes back

Gareth Heyes · PortSwigger Research · 6 February 2020

DOM clobbering gives HTML elements id and name attributes so they overwrite globals and object properties that script later trusts. New variants clobber three levels deep with forms and DOM collections, control an anchor username, password and href, steer values through a base tag, and nest srcdoc iframes to clobber arbitrarily deep without a timer.

Record

Researcher

Gareth Heyes

Published by

PortSwigger Research

Date

6 February 2020

In the archive

• Added to the 2020 archive after the original list was published

Tags

• dom-clobbering
• dom
• xss
• iframe
• url-parsing
• javascript
• prior-art-extension
• owasp-a03-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Gareth Heyes, first published at the original source. Preserved copies are kept so the citation survives its host.