Learn about Sinks

🎯 Objective

This article demonstrates how different DOM sinks (Document, Location, and Execution) can introduce DOM-based XSS vulnerabilities.

🧭 Source Code Example

The page has only one HTML element (p1) which is dynamically updated by the script block.
No external libraries are included.

🔎 1. Document Sink

The Document Sink inserts attacker-controlled data into the DOM.

• The value of the name parameter is written to the DOM via innerHTML.
• This allows injection of arbitrary HTML or event handlers.

Example attack:

https://baddomain.xyz/tests/sinks.html?name=<img src=x onerror=alert(1)>

Other Document Sinks

• innerHTML
• outerHTML
• document.write() / document.writeln()

🔎 2. Location Sink

The Location Sink uses attacker input to set the document location.

This allows redirection or execution of JavaScript via the pseudo-protocol:

https://baddomain.xyz/tests/sinks.html?redir=javascript:alert(1)

Notes

• Modern browsers may block javascript: URLs or execute them in a blank context.
• Historically, attackers used data: URIs as a bypass.

🔎 3. Execution Sink

The Execution Sink passes attacker input directly to eval.

Payload:

https://baddomain.xyz/tests/sinks.html?index=alert(1)

• The attacker-supplied index parameter is injected directly into eval.
• This results in arbitrary JavaScript execution.

Other Execution Sinks

• eval()
• setTimeout(string)
• setInterval(string)
• new Function()
• Template literals

✅ Summary

• Document Sinks → Dangerous DOM modifications (innerHTML, document.write)
• Location Sinks → Redirection and possible javascript: execution
• Execution Sinks → Direct code execution via eval, setTimeout, etc.

⚠️ These are the three main categories of sinks where DOM-based XSS vulnerabilities occur.