hunt-dom
覆盖前端链路，能发现服务端不可见的隐蔽漏洞。
含攻击与漏洞利用内容，禁止未授权使用
发现客户端 DOM 漏洞，如 DOM clobber、postMessage 和 ServiceWorker 滥用。
专门找客户端的 DOM 类漏洞：DOM Clobbering、postMessage 缺 origin 校验、Service Worker 被滥用、CSS 字符外泄、客户端模板注入等。用在定位 DOM-XSS、基于浏览器的认证绕过或无服务器交互的 token 泄露场景，因为这些攻击往往服务器根本看不到。特别点是攻击在受害者浏览器执行，WAF 和后端过滤常常不起作用，需要做浏览器级别的 PoC。
▸ 展开 SKILL.md 英文原文
Hunt client-side DOM vulnerabilities — DOM Clobbering (overwrite JS globals via HTML injection), PostMessage hijacking (missing origin check), Service Worker abuse (intercept requests from same-origin script), CSS Injection/Exfiltration (attribute selectors → token char-by-char via OOB), client-side template injection, dangerouslySetInnerHTML. Grounded in named public research: Gareth Heyes / PortSwigger DOM-clobbering + DOM-Invader, Michał Bentkowski DOMPurify clobbering bypasses, jQuery htmlPrefilter XSS (CVE-2020-11022 / CVE-2020-11023), d0nut CSS-exfil research. Use when hunting DOM-XSS, client-side auth bypass, or token exfiltration without server-side interaction.
帮我安装这个 skill：https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/hunt-dom/SKILL.mdcurl -fsSL "https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/hunt-dom/SKILL.md"# HUNT-DOM — DOM Clobbering / PostMessage / Service Worker / CSS Exfil ## Crown Jewel Targets DOM-based attacks execute in the victim's browser — the server often never sees the payload, so WAFs and server-side input filters do not apply. PostMessage missing-origin-check = cross-origin token theft with no XSS needed. **Highest-value chains:** - **DOM Clobbering → DOM-XSS / auth bypass** — HTML *markup* injection (no `<script>`) overwrites a JS global like `window.config` or shadows `document.getElementById`, and the app later treats that value as a URL/code → sink fires under a markup-only injection where script is filtered. - **PostMessage no origin check → session theft / DOM-XSS** — a