PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Hijacking service workers via DOM Clobbering

portswigger.net | research | #web-security | #xss | #client-side-security | #csp-bypass | #dom-clobbering | #service-worker
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A new service worker hijacking variant using DOM clobbering: abusing a document.getElementById() quirk to control importScripts() and run script inside the SW, enabling filter evasion and CSP bypass.
Published
Collected

Related coverage

research · portswigger.net
Bypassing CSP via DOM clobbering
How to turn HTML injection into a CSP bypass via DOM clobbering: with a gadget like script.src reaching an allowed sink under strict-dynamic, injected scripts can run; DOM Invader can detect it.
research · portswigger.net
Blind CSS Exfiltration: exfiltrate unknown web pages
Blind CSS exfiltration extracts unknown page content when JavaScript is blocked by CSP or DOMPurify, chaining the :has selector and CSS variables into conditional requests that leak data.
research · portswigger.net
Ambushed by AngularJS: a hidden CSP bypass in Piwik PRO
A DOM Invader audit of Piwik PRO uncovered an AngularJS-based debugger whose script gadgets can bypass CSP; with an HTML injection, events like ng-focus could execute code despite the policy.
research · portswigger.net
AngularJS CSP bypass in 56 characters
Gareth Heyes chronicles trimming an AngularJS CSP bypass payload from 63 to 56 characters by exploiting the path property and filter syntax, evading the framework's window detection.
research · portswigger.net
Evading defences using VueJS script gadgets
VueJS script gadgets for evading defences: expression-based vectors, event tricks and mutation XSS in the framework, useful for bypassing WAFs and CSP and for developers guarding Vue apps.
research · portswigger.net
Finding DOM Polyglot XSS in PayPal the Easy Way
Using DOM Invader, PortSwigger found a polyglot DOM XSS in PayPal hidden in CSS-selector handling, then chained unintended script gadgets to bypass the site's CSP after triage dismissed the report.
Back