Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

The extension is not detecting sinks properly #30

Open
ayadim opened this issue Oct 22, 2024 · 1 comment
Open

The extension is not detecting sinks properly #30

ayadim opened this issue Oct 22, 2024 · 1 comment
Labels
bug Something isn't working question Further information is requested

Comments

@ayadim
Copy link

ayadim commented Oct 22, 2024

Hi,
First i would like to thank you for your efforts, the extension is working but not in some cases take an example this lab,
https://portswigger-labs.net/dom-invader/testcases/augmented-dom-document-write/index.php?x=burpdomxss

even the parameter value was pass to document.write sink using backend but the extension didn't detect it?

Update: after many time restarting firefox it detect it but why is not logging requests at first not like dom-invader

Regards

@kevin-mizu
Copy link
Owner

Hi @ayadim 👋

Thanks for reporting this! However, this is a well-known issue with DOMLogger++ that I forgot to mention in the README.md :(

To explain further, this happens because document.write calls document.open, which clears all event listeners present on the document, breaking DOMLogger++.

image

I don’t have a solution for this at the moment, but I’ll update the README.md to include a warning about it and leave this issue open for now.

Cheers,
Kévin

@kevin-mizu kevin-mizu added the bug Something isn't working label Nov 6, 2024
@kevin-mizu kevin-mizu pinned this issue Nov 6, 2024
@kevin-mizu kevin-mizu added the question Further information is requested label Nov 6, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working question Further information is requested
Projects
None yet
Development

No branches or pull requests

2 participants