Testing for web message DOM XSS with DOM Invader - Port Swigger
Summary: PortSwigger describes web message DOM XSS as occurring when the destination origin for a web message trusts the sender not to transmit malicious data and then passes that data into a sink unsafely. DOM Invader, pre-installed in Burp's browser but disabled by default, logs messages sent via postMessage(), lets testers modify and resend them, and can generate a proof of concept when an exploitable vulnerability is found.
What's compelling: The flaw turns on trust: a destination origin that accepts a message's data without checking the sender hands an attacker a path straight into a client-side sink, and DOM Invader's ability to log, edit, and resend postMessage() traffic makes that path quick to confirm.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026