PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

DOM Invader and the case of direct eval vs indirect eval

portswigger.net | blog | #portswigger-research | #dom-invader | #dom-xss | #javascript | #eval
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Gareth Heyes explains why DOM Invader can trigger eval exceptions: direct eval calls can access local scope variables, while indirect eval via a renamed reference runs in global scope and cannot.
Published
Collected

Related coverage

blog · portswigger.net
Finding client-side prototype pollution with DOM Invader
DOM Invader has been upgraded to detect client-side prototype pollution (CSPP) in a couple of clicks. The post explains pollution sources, gadgets, and how the tool finds and exploits them.
blog · portswigger.net
Introducing DOM Invader: DOM XSS just got a whole lot easier to find
PortSwigger introduced DOM Invader, an extension in Burp's embedded browser whose Augmented DOM maps all sources and sinks in a tree view, making DOM-based XSS far easier to find and exploit.
research · portswigger.net
Finding DOM Polyglot XSS in PayPal the Easy Way
Using DOM Invader, PortSwigger found a polyglot DOM XSS in PayPal hidden in CSS-selector handling, then chained unintended script gadgets to bypass the site's CSP after triage dismissed the report.
blog · portswigger.net
How Burp AT helped expose whistleblower reports via a critical vulnerability that was overlooked for years
A customer story on how Burp AT, Burp Suite's agentic testing capability, helped Orange Cyberdefense analyst Ray Huygen work through 66,000 lines of minified JavaScript to find a critical access flaw that exposed confidential whistleblower reports, and turn the finding into a confirmed exploit.
blog · portswigger.net
Try it for yourself: the latest PortSwigger Research from Black Hat USA
At Black Hat USA, PortSwigger Research debuted practical web timing attack techniques by James Kettle, now in Param Miner, plus email parsing discrepancy research and new training labs.
blog · portswigger.net
New techniques and tools for web race conditions
James Kettle's Black Hat and DEF CON talk introduces new web race condition classes beyond limit-overrun, plus the single-packet attack that sends parallel requests within 1ms, now in Burp Repeater.
Back