PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Detecting web message misconfigurations for cross-domain credential theft

portswigger.net | research | #burp-suite | #credential-theft | #dom-invader | #oauth | #postmessage | #cross-domain
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

DOM Invader gains cross-domain leak detection: it inspects web messages and flags secrets from the URL being sent to other origins, automating the hunt for OAuth credential-theft misconfigurations.
Published
Collected

Related coverage

research · portswigger.net
Practical Web Cache Poisoning
James Kettle's whitepaper shows how to turn web caches into exploit delivery systems, hijacking JavaScript and poisoning responses across popular sites, plus defenses and open source tooling.
research · portswigger.net
Bypassing CSP via DOM clobbering
How to turn HTML injection into a CSP bypass via DOM clobbering: with a gadget like script.src reaching an allowed sink under strict-dynamic, injected scripts can run; DOM Invader can detect it.
research · portswigger.net
Widespread prototype pollution gadgets
Client-side prototype pollution gadgets in browser APIs: polluting Object.prototype can inject fetch bodies or defeat Object.defineProperty locks, with similar gadgets found across common libraries.
research · portswigger.net
Finding DOM Polyglot XSS in PayPal the Easy Way
Using DOM Invader, PortSwigger found a polyglot DOM XSS in PayPal hidden in CSS-selector handling, then chained unintended script gadgets to bypass the site's CSP after triage dismissed the report.
research · portswigger.net
Hackability inspector
Gareth Heyes presents the Hackability inspector, a browser tool that enumerates JavaScript objects and flags security-relevant properties like cross-domain leaks and Java bridges.
research · portswigger.net
Hidden OAuth attack vectors
Three new OAuth2/OpenID Connect vectors — Dynamic Client Registration SSRF by design, redirect_uri session poisoning, WebFinger user enumeration — shown on ForgeRock OpenAM and MITREid Connect.
Back