Collected research
DOM Clobbering strikes back
DOM clobbering gives HTML elements id and name attributes so they overwrite globals and object properties that script later trusts. New variants clobber three levels deep with forms and DOM collections, control an anchor username, password and href, steer values through a base tag, and nest srcdoc iframes to clobber arbitrarily deep without a timer.
Record
- Researcher
- Gareth Heyes
- Published by
- PortSwigger Research
- Date
- Topic
- XSS
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Gareth Heyes, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .