Hacker, Researcher and Author.

Kali Linux DOM Based XSS Writeup

Recently, I have been on a mission to find XSS in popular security training websites, Since these are the ones who care about their security the most. I have been successful in finding in almost all of them i have tried up to date, This one was a bit interesting to i thought to write a post on it, Basically it was not a reflected/stored xss, however it was a DOM based XSS, similar to the one i found in Microsoft. Unlike others, this particular XSS occurs in client side javascript.

In order to provide features to the users lots of webmasters/Vendors are moving their code towards client side, the data is embedded in the DOM and before it's reflected back to the user it is not filtered out, which results in a DOM based XSS. The main cause of this vulnerabilities are dangerous Sinks. DOM based XSS wiki is a good source where you would find dangerous sources and sinks.

On checking out the source of kali.org, i immediately found out that i was running wordpress version 3.5.1, The version is the latest version of the wordpress and has no known public vulnerabilities till date, therefore i moved towards testing plugins.

I tested couple of plugins, however did not find any one of them vulnerable, by analyzing the source more deeply i found a pretty interesting plugin "WP-Pretty Photo" which caught my interest. Which is a jquery based lightbox for wordpress platform.

Next i performed a detailed analysis on the prettyphoto.js file, hunting for DOM based XSS. After my analysis i managed to construct a valid payload to trigger the DOM based XSS. You can find my detailed analysis about the prettyphoto.js DOM xss vulnerability here.



Some debugging with chrome JS console, led me to the line 79 of the jquery.prettyPhoto.js, the line of code which was responsible for the cause of the DOM Based XSS.


It was also obvious from the code that it required us ! sign to successfully execute the javascript.

The input inside the hashrel was not filtered out before it was being displayed to the user, which resulted in the DOM Based XSS.

The Fix

The following url discusses, about the fix:


If, this was not enough for you, then listen to this, Offensive-security team was very awesome in a sense, that they gave me a free voucher for their famous certification PWB 3.0.

I was really surprised to see that Dominator was not detecting it which is the only good tool for finding DOM Based XSS leaving IBM javascript scan apart, in past i have tried dominator against various websites suffering from DOM Based XSS and have found that, at some spots it's very good and at some spots it needs much improvement. Here is the screenshot:

I would like that every one would be act the same way i did and responsibly disclose every issue you find.


  1. So, it's a random XSS in a plugin and actually there are lot of vulnerabilities in wordpress version 3.5.1 and in this case vulnerability is due to plugin (not a vulnerability in wordpress as you said). As it a not much used public, only few websites use it. You will find vulnerabilities like this in every 3rd plugin of wordpress.

    Sorry to say this but this article could have ended in 5 lines.

    1. Whoever commented this, I believe is a noob or else jelous on Rafay.
      Atleast he spend his time to disclose the bug with details and his methods.This could certainly help a lot of budding web app researchers. These days people are so narrow minded to share knowledge. I would appreciate Rafay's write-up.

  2. Thanks for your comment, Answers in lines:

    // So, it's a random XSS in a plugin and actually there are lot of vulnerabilities in wordpress version 3.5.1 and in this case vulnerability //

    Please, let me know some high risk vulnerabilities in 3.5.1.

    //Sorry to say this but this article could have ended in 5 lines. //

    Ever read a research or white paper?, It's a single topic and in depth information, The thing here is the target audience, the methodology is important. I was requested by lots of readers, In case if you are not following me on fb, you won't know. I can go on and on, but there is no point to debate, you are entitled to your own opinions.

  3. What email to report security vulnerability in offensive security bro?

  4. To be very clear, i understood this post partially. To fully understood this post, what knowledge should i have (JS/CSS/HTML) or which tool should i use..??

  5. Thanks Ajin,

    I really appreciate your comment.

  6. Nice find and the PWB course is awesome. It's not easy but well worth the effort.


    Yes, that is the reason why i would do it later this year.

    Also, it would be a pleasure if you could write a guest post here.

  8. Great Work.Keep It Up

  9. Grt work Rafay Baloch sir :) and thnx for sharing with this method thank you so much and someone jealous from you so ignore him sir just keep it going sir ...:)
    Thank You

  10. preciso de ajuda em alguns config


© 2016 All Rights Reserved by RHA Info Sec. Top

Contact Form


Email *

Message *

Powered by Blogger.