Difference Between Reflected XSS and Reflected-DOM XSS
What's the difference between Reflected XSS (RXSS) and Reflected-DOM XSS (RDOMXSS)? After some research, I think it can be concluded that Reflected-DOM XSS is:
Similarities:
- The value is reflected by the target application
Characteristics That Are Present in RDOMXSS and Not In RXSS:
- Does not use include any HTML tags such as
<img>or<script> - Directly reflected into a JavaScript Block/JavaScript Event Handler (
onload/onbody/etc.) - Reflected into a HTML tag - Example
<input id="vuln" value="Injected">where insecure JavaScript performs an insecure operation such aseval(document.getElementById("vuln"));
Questions:
- Is Data Reflected In JavaScript Block (XSS) considered as RDOMXSS? Injecting
"; eval(alert(document.domain));//results in an alert.
<script>
var a = "<XSS Injection>";
</script>
- Is Data Reflected In JavaScript Handlers (XSS) Like onload/onerror/onclick considered as RDOMXSS? Injecting
alert(document.domain)results in an alert.
<body onload="<XSS Injection>"></body>
- Is Data Reflected In a HTML Tag
<input id="vuln" value="Injected">where insecure JavaScript performs an insecure operation such aseval(document.getElementById("vuln"));considered as RDOMXSS? Injectingalert(document.domain)results in an alert.
<input id="123" value="<XSS Injection>">
<script>
eval(document.getElementById("123").value);
</script>
Appendix
What is a Document Object Model - https://www.w3.org/TR/WD-DOM/introduction.html
The Document Object Model (DOM) is a programming API for HTML and XML documents. It defines the logical structure of documents and the way a document is accessed and manipulated. With the Document Object Model, programmers can create and build documents, navigate their structure, and add, modify, or delete elements and content. Anything found in an HTML or XML document can be accessed, changed, deleted, or added using the Document Object Model.
What is a HTML DOM - https://www.w3schools.com/js/js_htmldom.asp
The HTML DOM is a standard object model and programming interface for HTML. It defines:
- The HTML elements as objects
- The properties of all HTML elements
- The methods to access all HTML elements
- The events for all HTML elements
From Question 1 (What is a Document Object Model), The Document Object Model (DOM) is a programming API for HTML and XML documents. which JavaScript is a subset of DOM.
From Question 2 (What is a HTML DOM), HTML DOM is a standard object model and programming interface for HTML. It defines The events for all HTML elements which includes onload/onclick/onerror. In other words: The HTML DOM is a standard for how to get, change, add, or delete HTML elements.
Note: Do not confuse the line "The HTML elements as objects" as "HTML Tags", to extrapolate, it means, "A HTML DOM is an object model and programming interface which defines HTML elements AS OBJECTS which can be accessed, changed, deleted, or added using the Document Object Model".
