⚠ FOR SECURITY TESTING PURPOSES ONLY — DO NOT DEPLOY IN PRODUCTION
DOM Clobbering
DOM Clobbering
Named HTML elements (id/name) become properties on window and document. The app reads window.config.role to gate access — inject a form to overwrite it without any JavaScript.
> Show hints
- [1] A form with id='config' sets window.config to that element
- [2] Nested: form id='config' with input id='role' value='admin' sets config.role to the input element
- [3] The script runs AFTER injection — DOM state at execution time is what matters
- [4] Playwright: inject payload, then assert #admin-panel is visible — HTTP clients cannot see this
[1] Preset Payloads
Select a payload — the vulnerable script reads window.config after your HTML is injected.
[2] Custom Payload
[3] Sandbox DOM
Live rendered state. Playwright must observe this — it cannot be detected from HTTP responses.
[sandbox — inject a payload to run]
[4] Vulnerable Code
// VULNERABLE: no type-check on window.config
var cfg = window.config || { role: 'guest' };
var role = cfg.role ? cfg.role.toString() : 'guest';
// Attacker injects:
// <form id="config"><input id="role" value="admin"></form>
// -> window.config === <form element>
// -> window.config.role === <input element>
// -> cfg.role.toString() === "admin" <- privilege escalation