> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/portswigger-web-academy/xss/dom-based-xss/dom-invader.md).

# DOM Invader

DOM Invader is a browser-based tool that helps you test for DOM XSS vulnerabilities using a variety of sources and sinks, including both web message and prototype pollution vectors. It is available exclusively via Burp's built-in browser, where it comes preinstalled as an extension.

We will be testing all of the tools - including live scan on one of the Reflected DOM Labs 

<figure><img src="/files/PRw4X3Ap1brjANwPVa4T" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/xomAzCfMnabAxkYX0qlD" alt=""><figcaption></figcaption></figure>

We can also look in the console to see the file itself:<br>

<figure><img src="/files/jdWFi2fJeZqbLecInRkS" alt=""><figcaption></figcaption></figure>

There's also an exploit button that targets that specific attack.&#x20;

<figure><img src="/files/tJfo7mM6yCasZo15TEgv" alt=""><figcaption></figcaption></figure>

If we look at the live scan: we can also see that it detected the same issue:<br>

<figure><img src="/files/cjIbYycX3shQkQfM0blM" alt=""><figcaption></figcaption></figure>