← Back to index

IAST DOM XSS Module

This page lets you test IAST taint tracking from specific sources (URL query, hash, cookie, storage, window.name, textarea) into various DOM sinks (innerHTML, outerHTML, insertAdjacentHTML, document.write, DOM mutations, inline event handlers).

1. Choose and prime taint source

Payload

Active source type:

URL query (?payload=...) URL hash (#payload=...) document.cookie localStorage sessionStorage window.name textarea only (in-memory)

The IAST engine should show which source was used in each finding, e.g. hash:param:payload, query:param:payload, cookie:iast_payload, etc. Use this page to verify that your taint tracking correctly attributes each DOM sink to the selected source type.

2. Trigger DOM sinks with selected source

For each sink, click a button to inject the currently selected source value into that sink. The IAST engine should show which source and sink were used.

innerHTML

(awaiting payload)

outerHTML

Replace this element

insertAdjacentHTML

document.write

Opens a new document.write with the payload in this window.