DOM-based cookie manipulation

Platform: PortSwigger | Category: DOM-based vulnerabilities | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, DOM-based vulnerabilities

Summary

Walkthrough of the PortSwigger Web Security Academy lab DOM-based cookie manipulation (DOM-based vulnerabilities). This lab demonstrates a dom-based vulnerabilities vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — DOM-based vulnerabilities

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

Lab Description :

Overview :

DOM-based cookie manipulation -

DOM-based cookie-manipulation vulnerabilities arise when a script writes attacker-controllable data into the value of a cookie.

If JavaScript writes data from a source into document.cookie without sanitizing it first, an attacker can manipulate the value of a single cookie to inject arbitrary values: document.cookie = 'cookieName='+location.hash.slice(1);

If the website unsafely reflects values from cookies without HTML-encoding them, an attacker can use cookie-manipulation techniques to exploit this behavior.

Solution :

Key Takeaways / Lessons

• Understanding DOM-based vulnerabilities detection and exploitation is crucial for web security.
• Always validate and sanitize user input; implement proper access controls.
• This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

---

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: DOM-based cookie manipulation