> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/portswigger-web-academy/xss/dom-based-xss.md).

# DOM-Based XSS

DOM-based XSS vulnerabilities usually arise when JavaScript takes data from an attacker-controllable source, such as the URL, and passes it to a sink that supports dynamic code execution, such as `eval()` or `innerHTML`. This enables attackers to execute malicious JavaScript, which typically allows them to hijack other users' accounts.

{% hint style="info" %}
**DOM XSS is specifically a bug in JavaScript code** (client-side code running in the browser).

**Reflected and Stored XSS are bugs in server-side code** (Python, PHP, Node, Java, whatever the backend is written in).
{% endhint %}

### HTML Sink

**HTML sinks** = JS that writes attacker data *into the page as HTML*. Examples: `innerHTML`, `document.write`, `outerHTML`, jQuery `.html()`. Your payload becomes part of the rendered DOM — you can literally see it in the Elements tab.

### Javascript Sink

JS that *executes attacker data as code*. Examples: `eval()`, `setTimeout(string)`, `Function()`, `setInterval(string)`. Your payload becomes executed code, not visible HTML. There's nothing to "see" — it just runs.\
\
HTML Sink:\
\
![](/files/NYKwIvCsmjfVFJ4ggUfU)

We see that theres a img src. We see that it ends on quotations, meaning we need to escape out of those quotations. \
 

<figure><img src="/files/Q9wtxvp19apZfAYbCzue" alt=""><figcaption></figcaption></figure>

We'll need to use either one of these to make it work. We need to close the tag, and insert another tag, hence the ">\<svg> would be the only one that could work here.&#x20;