Plug-n-Hack allows you to monitor client (browser) events in order to help test HTML5 applications.
As it means changing the response this functionality has to be manually enabled.
To receive client events:
In this case ‘active’ clients are pages that are currently open in a browser tab.
You can edit and resend any event via a right click menu item as long as the original client is active.
You can also intercept and change postMessages on the fly.
Client messages are intercepted if the ‘break on all requests’ button is selected on the top level toolbar.
You can also set custom client breakpoints via a button on the Clients tab.
You can fuzz postMessages in the same way as any other message - highlight the string you want to fuzz in the Request tab, right click and select “Fuzz”.
This option will only be available if the relevant browser still has that page open,as PnH sends the payloads to the browser.
Standard ‘XSS’ payloads can be used to detect DOM XSS vulnerabilities, but you will need to manually monitor the UI to see if any of them are successful.
PnH also adds a Custom fuzzing file called “PlugnHack DOM XSS Oracle”.
This method invokes the ZAP API which in turn flags the relevant attack in the UI - these are confirmed DOM XSS vulnerabilities, although (as always) you should check that they can really be exploited in the application you are testing without a tool like ZAP.