DOM clobbering

When it applies

You can inject HTML but not script (a sanitizer blocks JS), and the application's own JavaScript reads values from named DOM elements or global properties. Clobbering turns pure markup into control over those values — often the missing link to XSS or a logic bypass.

Why it works

The browser auto-creates properties from element id/name: <a id=x> makes window.x (and document.x) reference that element. Legacy code that does var cfg = window.config || {} or document.getElementById('token') can be clobbered — you supply the element, so you control what that "variable" resolves to.