At its core, DOM clobbering manipulates HTML to influence the behavior of already existing JavaScript code under situations where you don't have direct control over the JavaScript.

For this challenge, the webpage ensures that the user is not an admin before trying to dump cookies. Can you find a way to trick it into publishing the victim's cookies?

The previous challenge was a little bit contrived, as most code will not directly read from the page like that.

However, there are some cases where the HTML-accessing component is not so readily apparent. One code pattern that occasionally appears is the setting of variables as a property on the document object. As it turns out, setting the name attribute of certain HTML element types results in document.[x] returning that element rather than being initially undefined.

Can you figure out how to get the victim to send their cookies before time runs out?

Tip: Check the Additional Resources section in the introduction for possible payloads.

If designed carefully, DOM clobbering payloads can masquerade as more complex objects. In this challenge, there are some configuration settings that cannot be clobbered with a simple payload. Can you design an HTML sequence that can mimic the configuration that you need?

You saw in the previous challenge that DOM clobbering can mimic attributes of objects. With even more careful design, you can clobber even deeper objects.

Your previous solution may not work for this challenge, as you may have noticed that your strategy for controlling the attributes cannot be extended to further sub-levels. Think about what HTML elements have the capability to nest within themselves and work from there.

Now that you've gotten an understanding of DOM clobbering, let's check your understanding with more realistic scenarios.

Check out my new golf website! I'm not very good with canvases so I'm using some extra APIs to make my work easier.

So, I've fixed up my code a bit and refactored some things so that the page loads a bit faster. Hope I didn't add any other vulnerabilities...

Tip: As with all DOM clobbering vulnerabilities, look for places where global variables are passed as attributes of the window or document objects.

Ok, NOW it's fixed... right?

You have seen that with a strong content security policy in place, only specific DOM clobbering payloads are able to impact the server. This challenge has its CSP relaxed slightly to accomodate for a new design. Can you figure out a way to take advantage of the new holes opened in the page's defense?

I don't think a CSP is necessary at all... I should be good if I just sanitize the HTML, right?