Scribd
Upload
136 views2 pages

Essential JS Security Checklist

The document provides a checklist of DOM-based vulnerabilities in JavaScript including DOM-based DOS, client-side SQL injection, open redirection, link manipulation, cookie manipulation, JavaScript injection, local file-path manipulation, and Ajax request-header manipulation.

Uploaded by

setyahangga3
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
136 views2 pages

Essential JS Security Checklist

The document provides a checklist of DOM-based vulnerabilities in JavaScript including DOM-based DOS, client-side SQL injection, open redirection, link manipulation, cookie manipulation, JavaScript injection, local file-path manipulation, and Ajax request-header manipulation.

Uploaded by

setyahangga3
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

JS Checklist

This is a small JS checklist that helped me score a few bounties with DOM-based
vulnerabilities.
If this helped you, know that there’s a way to automate this using
Nova Security Scanner.

DOM-based DOS can be induced if user-input lands in requestFileSystem() or


RegExp()

Client-side SQLi can exist if user-input lands in executeSql() (database is created


via the var db = openDatabase() function, and later called via [Link](function(tx)
{[Link]("...")}) )

DOM-based open redirection can exist if user-input lands into one of the following
sinks:
location
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]()
[Link]()
open()
[Link]
[Link]()
[Link]()
[Link]()
$.ajax()

DOM-based link manipulation can be caused by one of the following sinks:


[Link]
[Link]
[Link]

JS Checklist 1
DOM-based cookie manipulation can exist if arbitrary user-input gets injected
inside the [Link] sink

DOM-based javascript injection can be caused if arbitrary user-input ends in one


of the following sinks:
eval()
Function()
setTimeout()
setInterval()
setImmediate()
execCommand()
execScript()
msSetImmediate()
[Link]()
[Link]()

DOM-based local file-path manipulation can be induced by one of the following


sinks:
[Link]()
[Link]()
[Link]()
[Link]()
[Link]()
[Link]()

DOM-based Ajax request-header manipulation can be caused by one of the


following sinks:
[Link]()
[Link]()
[Link]()
[Link]()
$.globalEval()

Follow @0xblackbird on Twitter for more like this!

JS Checklist 2

You might also like