DOM element relationships

The classic DOM element relationship test found in the blog post https://portswigger.net/research/dom-clobbering-strikes-back

Created byjoaxcar

Created Apr 10, 2024

Updated May 28, 2025

Detecting browser...

CategoryDOM Behavior

VisibilityPublic

TypeXSS

CharsetUTF-8

$[data1] placeholderhtml

$[data2] placeholderhtml

Template used:

<$[data1] id="x$[i]"><$[data2] id="y$[j]"></$[data2]></$[data1]>

Code used after fuzz:

document.getElementById('x$[i]') && x$[i].y$[j] && log('$[data1]->$[data2]')

Sample payloads

<form->button id="x0">< id="y0"></></form->button>

<form->fieldset id="x0">< id="y0"></></form->fieldset>

<form->img id="x0">< id="y0"></></form->img>

<form->input id="x0">< id="y0"></></form->input>

<form->object id="x0">< id="y0"></></form->object>

<form->output id="x0">< id="y0"></></form->output>

<form->select id="x0">< id="y0"></></form->select>

<form->textarea id="x0">< id="y0"></></form->textarea>