Introduction

Sboxr DOM is a dedicated tool for DOM Security Analysis that can automatically detect over 30 DOM Security Issues.

It is pronounced as S-BOXER

Web security tools overwhelmingly focus on server-side vulnerabilities. The client-side JS code has become very complex and feature-rich in most modern web applications. So a dedicated tool is needed to analyze this just like there are dedicated tools for analyzing the security of mobile apps. Client-side security analysis usually only goes as far as looking for a few variants of DOM XSS. Any further analysis requires a lot of expertise and is usually very time and effort intensive.

This is where Sboxr comes in, right from covering the more obscure variants of DOM XSS to entirely new categories of issues. It will significantly increase your test coverage while simultaneously reducing the time and effort involved.

‚Äč

The list of DOM Security Issues found by Sboxr are:

#

Issue

Type

Category

1

Data from attacker controllable navigation based DOM properties is executed as HTML

Error

Code Execution

2

Data from attacker controllable navigation based DOM properties is executed as JavaScript

Error

Code Execution

3

Data from attacker controllable URL based DOM properties is executed as HTML

Error

Code Execution

4

Data from attacker controllable URL based DOM properties is executed as JavaScript

Error

Code Execution

5

Non-HTML format Data from DOM storage is executed as HTML

Warning

Code Execution

6

Non-JavaScript format Data from DOM storage is executed as JavaScript

Warning

Code Execution

7

HTML format Data from DOM storage is executed as HTML

Info

Code Execution

8

JavaScript format Data from DOM storage is executed as JavaScript

Info

Code Execution

9

Data from user input is executed as HTML

Warning

Code Execution

10

Data from user input is executed as JavaScript

Warning

Code Execution

11

Non-HTML format Data taken from external site(s) (via Ajax, WebSocket or Cross-Window Messages) is executed as HTML

Error

Code Execution

12

Non-JavaScript format Data taken from external site(s) (via Ajax, WebSocket or Cross-Window Messages) is executed as JavaScript

Error

Code Execution

13

HTML format Data taken from external site(s) (via Ajax, WebSocket or Cross-Window Messages) is executed as HTML

Warning

Code Execution

14

JavaScript format Data taken from external site(s) (via Ajax, WebSocket or Cross-Window Messages) is executed as JavaScript

Warning

Code Execution

15

Non-HTML format Data taken from across sub-domain (via Ajax, WebSocket or Cross-Window Messages) is executed as HTML

Warning

Code Execution

16

Non-JavaScript format Data taken from across sub-domain (via Ajax, WebSocket or Cross-Window Messages) is executed as JavaScript

Warning

Code Execution

17

HTML format Data taken from across sub-domain (via Ajax, WebSocket or Cross-Window Messages) is executed as HTML

Info

Code Execution

18

JavaScript format Data taken from across sub-domain (via Ajax, WebSocket or Cross-Window Messages) is executed as JavaScript

Info

Code Execution

19

Non-HTML format Data taken from same domain (via Ajax, WebSocket or Cross-Window Messages) is executed as HTML

Warning

Code Execution

20

Non-JavaScript format Data taken from same domain (via Ajax, WebSocket or Cross-Window Messages) is executed as JavaScript

Warning

Code Execution

21

HTML format Data taken from same domain (via Ajax, WebSocket or Cross-Window Messages) is executed as HTML

Info

Code Execution

22

JavaScript format Data taken from same domain (via Ajax, WebSocket or Cross-Window Messages) is executed as JavaScript

Info

Code Execution

23

Weak Hashing algorithms are used

Error

Cryptography

24

Weak Encryption algorithms are used

Error

Cryptography

25

Weak Decryption algorithms are used

Error

Cryptography

26

Cryptographic Hashing Operations were made

Info

Cryptography

27

Encryption operations were made

Info

Cryptography

28

Decryption operations were made

Info

Cryptography

29

Potentially Sensitive Data is leaked (via HTTP, Ajax, WebSocket or Cross-Window Messages)

Error

Data Leakage

30

Potentially Sensitive Data is leaked through Referrer Headers

Error

Data Leakage

31

Data is leaked through HTTP

Warning

Data Leakage

32

Data is leaked through WebSocket

Warning

Data Leakage

33

Data is leaked through Cross-Window Messages

Warning

Data Leakage

34

Data is leaked through Referrer Headers

Warning

Data Leakage

35

Potentially Sensitive Data is stored on Client-side Storage (in LocalStorage, SessionStorage, Cookies or IndexedDB)

Warning

Data Storage

36

Data is stored on Client-side Storage (in LocalStorage, SessionStorage, Cookies or IndexedDB)

Info

Data Storage

37

Cross-window Messages are sent insecurely

Error

Communication

38

Cross-site communications are made

Warning

Communication

39

Communications across sub-domains are made

Warning

Communication

40

Same Origin communications are made

Info

Communication

41

JavaScript code is loaded from Cross-site Sources

Warning

JS Code

42

JavaScript code is loaded from across sub-domains

Info

JS Code

43

JavaScript code is loaded from Same Origin

Info

JS Code