DOM Based XSS

We have discussed about DOM Based XSS in our previous posts . An Overview is as below:

The DOM enables dynamic scripts such as JavaScript to reference components of the document such as a form field or a session cookie. The DOM is also used by the browser for security - for example to limit scripts on different domains from obtaining session cookies for other domains.

An Example of DOM based XSS attack is displayed below:

 In the Screenshot below i have uploaded a Series of images on to the test website

The URL of the image displayed here is
http://google-gruyere.appspot.com/757573336816/user/3.jpg 

Here in the address bar i have entered
http://google-gruyere.appspot.com/757573336816/user><img src=x onerror=alert(/DOM-XSS/)>


Here the URL has been modified to execute the sample script

Here as test website  couldn't find the image on the prescribed path it displayed an error , but in the process of displaying the image the script has been executed.


So in this way one can test his application for DOM based  XSS vulnerability