DEF CON 33 - AutoDetection & Exploitation of DOM Clobbering Vuln at Scale - Zhengyu Liu, Jianjia Yu

The video presents Hawk, an automated framework for detecting and exploiting DOM clobbering vulnerabilities at scale. The main goal is to identify and exploit DOM clobbering gadgets—where attacker-controlled DOM elements hijack JavaScript lookups—by combining HTML injection with precise payload generation. This enables cross-site scripting (XSS) and other attacks in real-world web applications.

Key Takeaways:
• DOM clobbering occurs when attacker-controlled HTML elements with ID/name attributes hijack JavaScript lookups (e.g., document.script), enabling arbitrary code execution 2:15.
• Existing tools fail due to dynamic JavaScript behavior and lack of control-flow constraints; Hawk overcomes this with dynamic taint tracking and symbolic DOM constraint solving 5:02.
• Hawk analyzes 5,000 websites and finds 497 exploitable DOM clobbering gadgets in popular libraries (e.g., Webpack, Astro, MathJax) and frameworks 21:15.
• Real-world end-to-end exploits are demonstrated, including 11 XSS and 1 CSRF attacks via HTML injection combined with DOM clobbering in Jupyter Lab and Canvas LMS 31:25.

Hawk’s open-source tool, dataset, and research reveal the widespread risk of DOM clobbering and provide practical pathways for zero-day discovery and exploitation.

Sources:

• 2:15 Explanation of DOM clobbering and attack chain.
• 5:02 Challenges in existing tools and Hawk’s solution.
• 21:15 Large-scale study results and gadget discovery.
• 31:25 End-to-end exploit examples in Jupyter Lab and Canvas LMS.