Archives

DOMinator is now public on the Chrome Web Store. It records postMessage traffic, grades each listener's origin check, traces tainted values into sinks, and builds a replay and PoC from what it finds.

This is the story of how I found $20000 Facebook DOM XSS.