DOM Invader attack types - Port Swigger
Summary: PortSwigger's DOM Invader probes for ordinary DOM XSS sources and sinks by default, and can optionally be configured to attempt other attacks. When those settings are enabled, it automatically tries to identify sources for client-side prototype pollution and to find DOM clobbering vulnerabilities, with a cog icon next to the setting opening additional options for fine-tuning the prototype pollution behavior.
Bottom line: The tool's default coverage stops at DOM XSS, so prototype pollution and DOM clobbering are only hunted when someone turns those settings on - leaving two client-side vulnerability classes unexamined on any team that never enables them.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026