This is how DOM clobbering works. When you create an element with an id, the browser automatically creates a global variable for that ID: Now points to that single element. But when you create multiple elements with the same id: Now becomes an HTMLCollection, not a single element. Add... a name attribute: And now points to that element (works in Chromium/WebKit browsers, but not Firefox). Now combine that with a common JS pattern like: var someObject = window.someObject || {}; This is meant to provide a fallback if the global doesn't exist. However, if window.someObject has been clobbered by injected HTML, the fallback silently trusts a DOM object instead of a real JS object. Now imagine this JS logic: let imgSrc = someObject.avatar; If an attacker clobbered someObject.avatar with: If HTML is set via innerHTML or similar, then this could render as: Which triggers XSS! Here's a quick walkthrough of the DOM clobbering Web Security Academy lab👇 Try this lab:show more

André Baptista

18,697 subscribers

分享 下载