---
id: 5458
title: "Detecting web message misconfigurations for cross-domain credential theft"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/detecting-web-message-misconfigurations-for-cross-domain-credential-theft"
published_at: "2022-11-09T14:13:00Z"
tags: ["burp-suite", "credential-theft", "dom-invader", "oauth", "postmessage", "cross-domain"]
phying_url: "https://phying.com/item/5458"
lang: en
---

# Detecting web message misconfigurations for cross-domain credential theft

## Summary

DOM Invader gains cross-domain leak detection: it inspects web messages and flags secrets from the URL being sent to other origins, automating the hunt for OAuth credential-theft misconfigurations.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2022-11-09T14:13:00Z
- **Original:** https://portswigger.net/research/detecting-web-message-misconfigurations-for-cross-domain-credential-theft
- **Phying News:** https://phying.com/item/5458