GODSON'S BLOG
← Back to Writeups

Tagged: #dom-clobbering

2 writeups
Client-Side / DOM

DOM Clobbering - Clobber Undefined Variables!

A TamilCTF web challenge with HTML injection but a tight CSP — instead of chasing script execution, we DOM-clobber two undefined debug variables (DEBUG_MODE, DEBUG_LOGGING_URL) referenced by app.js to redirect the admin bot's cookie exfiltration to our own domain.

#ctf#dom-clobbering#csp-bypass
Mar 28, 2022 · 7 min read
Client-Side / DOM

An Art of DOM Clobbering 🎭

A deep dive into DOM Clobbering from first principles — how id/name attributes create references on window and document, why window properties can't be overridden but document properties can, and how to chain clobbering across multiple levels using nested iframes.

#dom-clobbering#javascript#fundamentals
Jul 21, 2021 · 13 min read