# Dom Clobbering > DOM Clobbering is a technique where global variables can be overwritten or "clobbered" by naming HTML elements with certain IDs or names. This can cause unexpected behavior in scripts and potentially lead to security vulnerabilities. ## Summary * [Lab](#lab) * [Exploit](#exploit) * [References](#references) ## Lab * [Lab: Exploiting DOM clobbering to enable XSS](https://portswigger.net/web-security/dom-based/dom-clobbering/lab-dom-xss-exploiting-dom-clobbering) * [Lab: Clobbering DOM attributes to bypass HTML filters](https://portswigger.net/web-security/dom-based/dom-clobbering/lab-dom-clobbering-attributes-to-bypass-html-filters) * [Lab: DOM clobbering test case protected by CSP](https://portswigger-labs.net/dom-invader/testcases/augmented-dom-script-dom-clobbering-csp/) ## Exploit Exploitation requires any kind of `HTML injection` in the page. * Clobbering `x.y.value` ```html // Payload
I've been clobbered // Sink ``` * Clobbering `x.y` using ID and name attributes together to form a DOM collection ```html // Payload // Sink ``` * Clobbering `x.y.z` - 3 levels deep ```html // Payload
// Sink ``` * Clobbering `a.b.c.d` - more than 3 levels ```html // Payload // Sink ``` * Clobbering `forEach` (Chrome only) ```html // Payload
// Sink ``` * Clobbering `document.getElementById()` using `` or `` tag with the same `id` attribute ```html // Payloads clobbered clobbered // Sink ``` * Clobbering `x.username` ```html // Payload
// Sink ``` * Clobbering (Firefox only) ```html // Payload // Sink ``` * Clobbering (Chrome only) ```html // Payload // Sink ``` ## Tricks * DomPurify allows the protocol `cid:`, which doesn't encode double quote (`"`): `` ## References * [Dom Clobbering - PortSwigger](https://portswigger.net/web-security/dom-based/dom-clobbering) * [Dom Clobbering - HackTricks](https://book.hacktricks.xyz/pentesting-web/xss-cross-site-scripting/dom-clobbering) * [DOM Clobbering strikes back - @garethheyes - 06 February 2020](https://portswigger.net/research/dom-clobbering-strikes-back) * [Hijacking service workers via DOM Clobbering - @garethheyes - 29 November 2022](https://portswigger.net/research/hijacking-service-workers-via-dom-clobbering) * [Bypassing CSP via DOM clobbering - @garethheyes - 05 June 2023](https://portswigger.net/research/bypassing-csp-via-dom-clobbering)