dom-based vulnerabilities

DOM-based vulnerabilities don't involve the server at all. Untrusted data (a "source" like location.hash, document.referrer, postMessage) flows through the page's JavaScript into a dangerous "sink" (innerHTML, eval, document.write, setAttribute).

The labs cover the canonical sources and sinks, taint analysis with browser DevTools, exploitation across postMessage, localStorage, hash-based routers, and DOM clobbering. Why this matters: SPAs and modern frontends ship most of their attack surface as JavaScript.