Testing for DOM-based cross-site scripting
The Document Object Model (DOM) is a tree-like structural representation of all HTML web pages captured in a browser. Developers use the DOM to store information inside the browser for convenience. As a web penetration tester, it is important to determine the presence of DOM-based cross-site scripting (XSS) vulnerabilities.
Getting ready
We will use the OWASP Mutillidae II HTML5 web storage exercise to determine whether the application is susceptible to DOM-based XSS attacks.
How to do it...
- Navigate to HTML 5 | HTML5 Web Storage | HTML5 Storage:
Figure 9.10 – HTML5 Storage lesson
- Note the name/value pairs stored in the DOM using the HTML5 Web Storage locations. Web storage includes Session and Local variables. Developers use these storage locations to conveniently store information inside a user’s browser:
Figure 9.11 – Web storage...
