DOMXSS Extensions

DOM XSS Scanners

1	untrusted types	extension	2021	446
5	eval villain	extension	2021	33
6	ttt-ext	extension	2019	65
2	finDOM-XSS	shell	2021	264
3	domdig	puppeteer	2021	216
4	crosser	puppeteer	2020	27

Extensions Architecture

manifest.json | background.js | content.js | console.stack

Storage

browser.storage.local.get (8|3)
browser.storage.local.set (4|1)
chrome.storage.onChanged.addListener (5)
chrome.storage.sync.(set|get)

Runtime

Analyze

chrome.webRequest.onBeforeRequest.addListener (2) | chrome.webRequest.onBeforeSendHeaders.addListener

UI

browser.browserAction.setTitle (2) | browser.browserAction.setIcon (2)
chrome.browserAction.setBadgeText (2) | chrome.browserAction.onClicked.addListener
chrome.devtools.panels.create (1) | chrome.notifications.create (1)
browser.commands.onCommand.addListener (1)

Flow

Config

Eval villain

DOM

92 document.getElementById ( ' nba ' )
68 document.createElement
34 window.name
31 document.write() | 14 document.writeln()
14 location.hash | 10 location.search | 2 location.toString
12 window.addEventListener | 10 document.addEventListener | 2 window.dispatchEvent
8 window.close | 1 window.open
8 document.cookie | 6 document.orgCookie
4 document.domain | 4 document.origin
4 document.head | 3 document.body
5 document.documentElement.appendChild | 1 document.body.removeChild | 1 document.body.appendChild
4 window.postMessage
4 document.querySelectorAll
4 document.documentElement
2 window.unescape()
2 window.setTimeout | 2 window.setInterval
2 document.execCommand | 2 document.designMode
2 window.getSelection()
2 window.top
2 window.eval()