Introducing DOM invader - A new tool within Burp Suite

DOM Invader is a new extension to Burp Suite's embedded browser - which enables you to find DOM XSS as if it were reflected XSS. Find out more at: https://portswigger.net/blog/introduc...

Key to this is DOM Invader's augmented DOM - which provides you with a convenient tree view of all sources and sinks. That means no more painful hunting through minified JavaScript. And on top of this, DOM Invader makes postmessage interception and resending much less cumbersome, too.

Timestamps:
0:00 Introducing DOM Invader
03:55 How to do a stack trace
04:43 Injecting a canary into a URL
06:00 Injecting canary into forms
08:06 Auto fire events and redirection prevention
09:39 Highlighting canaries
11:03 Message interception
13:30 Spoofing an origin
16:14 Generating automated messages
17:33 Replaying messages
18:36 Building a proof of concept