# DOM XSS ## DOM based XSS - DVNA **Step 1:** Let's Register a user on the application at `http://192.168.31.112:9090/register`. Enter the details and click submit. Intercept this request using Burp **Step 2:** Modify the name parameter in the intercepted POST request's body to `%3Cimg+src%3D%22a%22+onerror%3Dalert%28%27XSS1111%27%29%3E` and turn the intercept off. A user will be created on the application ![](/files/-LWqCdwXUM79X_rjwe2x) **Step 3:** Navigate to `http://192.168.31.112:9090/app/admin/users`. You'll see an alert on the page because the XSS payload injected through `name` is executed. The `name`parameter is used to create a user profile and the user details are inserted into the vulnerable page by an XHR request that retrieves the user details ![](/files/-LWqCh7P4_ne_BtaJzIJ) --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://infosecgirls.gitbook.io/infosecgirls-training/appsec/web-application-pentesting/a7-cross-site-scripting/dom-xss.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.