E-DOM
DOM Invader
Client-side testing tool built into Burp Suite's embedded browser for finding DOM XSS and DOM clobbering.
OVERVIEW
DOM Invader is a browser-instrumentation tool built directly into Burp Suite's embedded Chromium browser (enabled per-tab from Burp's extension settings, first released in Burp 2021.7) that automates client-side taint tracing: it injects canary values into every DOM XSS source it recognizes (URL, location.hash, postMessage, web storage, and more) and watches whether that value reaches a dangerous sink (innerHTML, eval, document.write, and similar) unsanitized, then reports the exact source-to-sink path.
Beyond DOM XSS, it also has a dedicated scanner for DOM clobbering — a technique for overwriting global JavaScript variables using HTML markup, which is far harder to spot by reading source manually. The client-side taint-tracing view works in both Community and Professional; some auxiliary features (like the postMessage interception log) are more useful when paired with Burp's other Pro-only tooling covered in the base Burp Suite entry on this site.
USE CASES
Practical use cases
- 01
Tracing whether a URL fragment, postMessage payload, or web-storage value reaches a dangerous DOM sink unsanitized.
- 02
Finding DOM clobbering opportunities where injected HTML can overwrite a global JavaScript variable an app trusts.
- 03
Auditing single-page applications where the vulnerable logic lives entirely in client-side JavaScript with no server round-trip to inspect.
- 04
Confirming a DOM XSS candidate found via static source review by watching the actual taint flow execute in the browser.
QUICK START
When client-side JavaScript is worth auditing for DOM XSS, to trace tainted input from a source to a dangerous sink inside the browser itself.
- Confirm client-side testing against the target's production JavaScript is within scope.
- Open the target in Burp's embedded browser and enable DOM Invader from the Burp extension icon.
- Enable the source and sink categories relevant to the app (or leave all enabled for a first pass).
- Browse and interact with the app normally, letting DOM Invader inject canaries as it discovers sources.
- Review flagged source-to-sink paths in the DOM Invader panel and manually confirm exploitability with a real payload.
BEFORE YOU RUN IT
What to check before running it
It's disabled by default per-tab because canary injection can interfere with other testing activity happening in the same browser tab — enable it deliberately, not as a default-on setting.
A flagged source-to-sink path is a candidate, not a confirmed vulnerability — encoding, CSP, or a sanitizer further down the chain can still block real exploitation.
It only sees what Burp's embedded browser executes; client-side logic gated behind a different browser engine or a native mobile WebView needs separate coverage.