DOMinator

DevTools for DOM XSS hunting: capture postMessage traffic, audit listener origin checks, trace taint into sinks, replay payloads.

DOMinator shows you the cross window/frame communication happening behind the current tab, and whether any of it is dangerous. Every postMessage a window or frame sends or receives is recorded with its origin, its frame and the file and line that sent it. For each message handler it shows the kind of origin check the handler performs — none, strict, or bypassable, such as a prefix match — and marks the flow as confirmed when a value from a message reaches a sink like innerHTML. Open the DOMinator panel in DevTools to inspect a message, replay it with an edited payload and a chosen origin, or pause it in the handler before it is delivered. Or click the extension icon to see the messages for the current tab. Nothing leaves your browser: no account, no server, no analytics. Replay and probing send payloads into the page you have open in DevTools, so use DOMinator only on sites you own or are authorised to test. *** https://github.com/vinothsparrow/DOMinator Free. Open-source with public license (MIT) *** Privacy policy: https://vinothsparrow.github.io/DOMinator/privacy.html Project changelog: https://github.com/vinothsparrow/DOMinator/releases Contributors @ Github: https://github.com/vinothsparrow/DOMinator/graphs/contributors