Cross-Origin Client-Side Messaging and DOM Gadgets

Climb the layer above DOM XSS — see how attacker-influenced data crosses origins through an insecure postMessage handler, how named HTML elements clobber the globals a page trusts, and how a weak Content-Security-Policy still lets a "blocked" script run — then learn the controls that close each gadget.

Advanced lesson — optional for first-year students. This lesson assumes you are comfortable with lessons 1–4 in this category, the browser security model, and basic JavaScript — specifically event listeners, variable scope, and the window object. If you have just finished the Clickjacking lesson and are new to the field, a good time to return is after completing input-validation-output-encoding, the Authentication & Credentials category, and at least one scripting lesson. Those build the JavaScript and HTTP fluency this lesson requires; attempting it before then is likely to be frustrating rather than instructive.

You already know dom-xss: attacker-controlled data flows from a source (the URL, a form field) into a dangerous sink (innerHTML, eval) and executes. This lesson is the layer above that — the client-side gadgets that let an attacker reach a sink even when the obvious source is closed off, or that defeat the defence meant to stop the script.

Three gadgets dominate modern client-side testing:

**Insecure postMessage** — a page registers a message listener to receive data from another window/frame, but **forgets to check event.origin**. Any site can now message it, and if the handler sinks event.data into innerHTML/eval, that is cross-origin XSS.
DOM clobbering — when you can inject markup but not script (a sanitiser strips <script> and on*), you inject named HTML elements (<a id=x>, <form name=y>) that become properties on window/document and shadow the global the page trusts — turning a "harmless" HTML injection into a logic hijack or an XSS gadget.
CSP bypass — a Content-Security-Policy is supposed to stop injected script from running. A weak policy (unsafe-inline, a wildcard host, a JSONP endpoint on an allow-listed origin, a missing base-uri/object-src) leaves a gap the same injection sails through.

Authorised targets only. Sending cross-origin messages to a live handler, injecting clobbering markup, and probing a CSP are active attacks on a running app. Use only a lab you own or are explicitly authorised to test — a PortSwigger Web Security Academy DOM/postMessage/CSP lab, or NovaCart's own DOM-XSS challenge for the sink step. Review hacking-ethics-and-authorization first. Because NovaCart has a native DOM-XSS sink but no native postMessage/clobbering/CSP-bypass challenge, this lesson combines its NovaCart material with an authorised external lab. The PortSwigger Web Security Academy labs require a free account at portswigger.net — register before starting the hands-on step.

In this lesson you will:

See how attacker-influenced data crosses origins through a message handler and why "it is client-side" is not a defence.
Learn DOM clobbering — how named elements become globals and form gadget chains.
Learn CSP fundamentals and the common bypasses that turn a blocked XSS into a working one.
Take away the durable fixes: **validate event.origin**, avoid HTML/eval sinks, and ship a strict nonce-based CSP with object-src 'none' and base-uri 'none'.

Click Continue when you are ready.

Cross-Origin Client-Side Messaging and DOM Gadgets

Advanced lesson — optional for first-year students. This lesson assumes you are comfortable with lessons 1–4 in this category, the browser security model, and basic JavaScript — specifically event listeners, variable scope, and the window object. If you have just finished the Clickjacking lesson and are new to the field, a good time to return is after completing input-validation-output-encoding, the Authentication & Credentials category, and at least one scripting lesson. Those build the JavaScript and HTTP fluency this lesson requires; attempting it before then is likely to be frustrating rather than instructive.

Three gadgets dominate modern client-side testing:

**Insecure postMessage** — a page registers a message listener to receive data from another window/frame, but **forgets to check event.origin**. Any site can now message it, and if the handler sinks event.data into innerHTML/eval, that is cross-origin XSS.
DOM clobbering — when you can inject markup but not script (a sanitiser strips <script> and on*), you inject named HTML elements (<a id=x>, <form name=y>) that become properties on window/document and shadow the global the page trusts — turning a "harmless" HTML injection into a logic hijack or an XSS gadget.
CSP bypass — a Content-Security-Policy is supposed to stop injected script from running. A weak policy (unsafe-inline, a wildcard host, a JSONP endpoint on an allow-listed origin, a missing base-uri/object-src) leaves a gap the same injection sails through.

Authorised targets only. Sending cross-origin messages to a live handler, injecting clobbering markup, and probing a CSP are active attacks on a running app. Use only a lab you own or are explicitly authorised to test — a PortSwigger Web Security Academy DOM/postMessage/CSP lab, or NovaCart's own DOM-XSS challenge for the sink step. Review hacking-ethics-and-authorization first. Because NovaCart has a native DOM-XSS sink but no native postMessage/clobbering/CSP-bypass challenge, this lesson combines its NovaCart material with an authorised external lab. The PortSwigger Web Security Academy labs require a free account at portswigger.net — register before starting the hands-on step.

In this lesson you will:

See how attacker-influenced data crosses origins through a message handler and why "it is client-side" is not a defence.
Learn DOM clobbering — how named elements become globals and form gadget chains.
Learn CSP fundamentals and the common bypasses that turn a blocked XSS into a working one.
Take away the durable fixes: **validate event.origin**, avoid HTML/eval sinks, and ship a strict nonce-based CSP with object-src 'none' and base-uri 'none'.

Click Continue when you are ready.