wstg-clnt-01-1

name	wstg-clnt-01.1
description	Testing for Self DOM-Based XSS
category	client-side
owasp_id	WSTG-CLNT-01.1
version	1.0.0
author	cyberstrike-official
tags	["client-side","javascript","dom","cors","wstg","clnt"]
tech_stack	[]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

wstg-clnt-01.1

Test ID

WSTG-CLNT-01.1

Test Name

Testing for Self DOM-Based XSS

High-Level Description

Self DOM-Based XSS (also called Self-XSS) occurs when users are tricked into executing malicious JavaScript in their own browser context. While the attack requires social engineering, it can still lead to session theft or account compromise if combined with other vulnerabilities.

---

What to Check

• Console paste protection
• Self-XSS warnings
• Input fields vulnerable to paste attacks
• Developer tools protections

---

How to Test

Step 1: Check Console Protection

// Open browser console on target site
// Check if there's a warning message about pasting code

// Sites like Facebook show:
// "Stop! This is a browser feature intended for developers..."

// Check if console commands are restricted
console.log("test")
eval("alert(1)")

Step 2: Test Input Field Exploitation

// Test if pasting scripts in input fields triggers execution
// Some apps process pasted content unsafely

// In browser console:
document.querySelector('input[type="text"]').value = "<script>alert(1)</script>"
// Check if it gets executed when form is submitted

---

Remediation

// Add console warning
if (typeof console !== "undefined") {
  .(, )
  .(, )
  .(, )
}