Other nomination

Dont Trust The DOM: Bypassing XSS Mitigations Via Script Gadgets

Sebastian Lekies, Krzysztof Kotowicz, Samuel Groß, Eduardo A. Vela Nava and Martin Johns · raw.githubusercontent.com · 25 May 2017

Script gadgets are legitimate JavaScript fragments inside popular frameworks that pick up injected, script-free HTML and turn it into executing code. Because the injected markup carries no script tag or event handler, HTML sanitisers, web application firewalls, browser XSS filters and CSP all let it through. The authors find such gadgets in most modern frameworks and across many live sites.

Record

Researcher

Sebastian Lekies, Krzysztof Kotowicz, Samuel Groß, Eduardo A. Vela Nava and Martin Johns

Published by

raw.githubusercontent.com

Date

25 May 2017

Format

Recording

In the archive

• Nominated for the 2016–17 Top 10 Web Hacking Techniques

Related sources

• Whitepaper
• Talk recording
• Talk recording

Tags

• xss
• gadget-chain
• sanitizer-bypass
• csp
• filter-bypass
• waf-bypass
• dom
• javascript
• measurement-study
• owasp-a03-2021
• owasp-a05-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Sebastian Lekies, Krzysztof Kotowicz, Samuel Groß, Eduardo A. Vela Nava and Martin Johns, first published at the original source. Preserved copies are kept so the citation survives its host.