DOM-Based XSS

Industry (dynamic) assessment almost always remains blind to the wealth of client side functionality modern applications contain. Be it locally databased client information, state (DOM) manipulation, or scripted requests driving further server interaction, tools overlook this important functionality. Static analysis has not been an effective supplement to this dynamic analysis gap because they struggle to cobble together and model how client-side Javascript might behave. 

In this paper, Ksenia and Travis explore this important exposure in pursuit of how testing might improve to address it. sws.ec/1IYz8Vb