PimpMyCaido #1: Hunt client-side vulnerabilities with DOMLogger++

August 6, 2026

PimpMyCaido: DOMLogger++, Caido extension

DOMLogger++ is a browser extension and companion Caido plugin that monitors, intercepts and debugs JavaScript sinks in real time.

Traditional proxy-based analysis excels at inspecting HTTP traffic. However, client-side vulnerabilities such as DOM-based XSS, prototype pollution and client-side path traversal can easily fly under the radar because they exist entirely within the browser’s JavaScript execution context.

Developed by @kevin_mizu, DOMLogger++, bridges this gap by hooking into JavaScript sinks (such as innerHTML, eval, document.write, location, or postMessage events) and sending its findings via webhook to Caido. There, findings are stored in a local SQLite database and displayed through a powerful dashboard featuring advanced search, filtering, enhanced stack traces and AI-powered exploitability scoring.

Key features of DOMLogger++ for Caido

  • Real-time sink monitoring – captures JS sink invocations (innerHTML, eval, fetch, postMessage...) as you browse, zero manual instrumentation required
  • Advanced search & autocomplete – query language with operators such as sink.tag.eq:"XSS" AND sink.data.cont:"<script>". Click any field to filter findings instantly
  • AI exploitability scoring – OpenRouter integration (100+ models supported), with each finding scored 1 to 5 using custom conditional prompts tailored to different vulnerability classes
  • Enhanced stack traces – one-click enrichment pulls relevant source code from Caido's HTTP cache and replaces minified stack frames with readable context
  • Debug canary – click a finding’s URL to generate a ?domloggerpp-canary= link that triggers a breakpoint at the exact sink invocation
  • Project & session management – Isolated databases per target, recording sessions to scope findings, bulk ops (export, delete, AI score)

Getting started with DOMLogger++

Follow these three steps to connect the DOMLogger++ browser extension to Caido and start capturing findings.

Step 1: Install the browser extension

Install DOMLogger++ from your browser’s extension store:

Step 2: Install the Caido plugin

In Caido, select Plugins in the sidebar and open the Community Store. Search for ‘DOMLogger++’ and click ‘Install’.

Step 3: Link the extension to Caido

In the DOMLogger++ browser extension settings, open the Caido section, enter your Caido instance URL (eg http://localhost:8080) and complete the authentication flow. Once connected, enable the Caido webhook – this sends findings from the browser extension to the Caido plugin. You can also configure a custom webhook URL in the Webhook section if you want to send findings to another tool or endpoint.

Hooking configurations

DOMLogger++ ships with pre-built JavaScript ON configs in the extension’s repository that define which JavaScript sinks to monitor. Load them in the browser extension under Hooking Settings:

  • GLOBAL.json – recommended base config. It defines no hooks of its own but adds noise filtering through !match and !matchTrace denylists for common third parties). It also enables canary alerts and strips content-security-policy and x-frame-options headers. Load it alongside a sink config
  • dom-invader.json – broad XSS sink coverage, including innerHTML, outerHTML, iframe src and srcdoc, script src/text, insertAdjacentHTML, setAttribute, eval, Function, setTimeout, setInterval and the full jQuery sink set
  • leverage-innerHTML.json – deeper source-to-sink tracing for innerHTML with DOM clobbering sources, canary-gated to cut noise
  • leverage-xss.json – post-exploitation, not sink detection. It hooks document.cookie, localStorage.getItem and sessionStorage.getItem to monitor what an XSS could exfiltrate
  • cspt.json – detects potential client-side path traversal through fetch, XMLHttpRequest.open, navigator.sendBeacon and HTMLScriptElement.src
  • cspp.json – detects potential client-side prototype pollution
  • postmessages.json – monitors window.postMessage calls and message event listeners for potential cross-origin postMessage attacks
  • dompurify-bypass-replace.json – targets potential DOMPurify sanitiser bypass patterns

These configs are only a starting point – you can (and should) adapt them to the target’s stack. For example, you can combine sinks from different configs, add custom match filters to reduce noise, or use hookFunction to inspect arguments before they are logged. See the sanitiser bypass case study below for a practical example.

Case study: Hunting DOM-based XSS

Imagine you're testing a modern web application that uses client-side routing, dynamically renders data from URL fragments and processes user input through several JavaScript layers. Load GLOBAL.json (base filtering) together with dom-invader.json (broad XSS sink coverage), browse the application and filter:

1sink.tag.eq:"DOM" AND sink.data.cont:"<"

DOMLogger++ logs every dangerous sink write, such as innerHTML, eval or document.write, together with the associated data and full stack trace. Press Ctrl+T to enhance the trace. The plugin pulls the relevant JavaScript source from Caido’s HTTP cache and replaces the minified stack frames with readable, syntax-highlighted code. You can now read the exact code path from user-controlled input to sink, confirm there’s no sanitisation, and craft your payload.

Case study: Hunting client-side path traversal

Load cspt.json to monitor fetch, XMLHttpRequest.open, navigator.sendBeacon and HTMLScriptElement.src.

This config also demonstrates some of DOMLogger++’s more advanced capabilities: using globals to define blocklists and an executable regex match (exec:) that dynamically compares words from the current URL (params, hash, path) against the fetch target path. When a match is found, DOMLogger++ sends a browser notification via alert.notification.

Browse the application and filter:

1sink.tag.eq:"CSPT"

Any finding here means user-controlled input is reaching a URL sink – so check whether it is sanitised before you build a payload.

DOMLogger++ lets you go further: click the finding to inspect the full data and stack trace, hit Ctrl+T to enhance the trace with actual source code from Caido's HTTP cache, then jump to Caido's Replay tab to craft and test your path traversal payload.

Case study: tracing a sanitiser bypass

DOMLogger++ ships with dompurify-bypass-replace.json, a config that hooks DOMPurify.sanitize, String.prototype.replace/replaceAll, and innerHTML to trace the full sanitisation chain. It uses a canary system to log only calls related to your input, filtering out noise.

Load it, browse the target, and filter:

1sink.tag.eq:"REPLACE" OR sink.tag.eq:"XSS"

DOMLogger++ shows the entire data flow: every .replace() call with its regex and replacement string, then the final innerHTML assignment. This allows you to see exactly what transformations happen after sanitisation – and spot where dangerous HTML gets re-introduced. The stack trace points you to the exact line in the source code.

All pre-built configs can be adapted to your target – combine sinks, add custom match filters, or write entirely new configs from scratch.

Case study: AI-powered triage at scale

Hundreds of findings? Configure OpenRouter in the AI tab by selecting an API key, model and temperature). Then you can create User Prompts with conditions and template variables such as {sink}, {data}, {trace} and {href}. Findings matching a condition are automatically scored from 1 to 5. Filter with sink.aiScore.eq:"5" to jump straight to critical findings.

Create multiple prompts per vulnerability class – each with its own condition and tailored instructions so the AI calibrates severity correctly.

Useful tips

  • Keyboard shortcuts make everything faster: Ctrl+F to search, Ctrl+R to refresh, Ctrl+I to send to AI, Ctrl+T to enhance traces, Ctrl+S to export, Ctrl+Space to toggle recording
  • Projects keep your work organized. Each Caido project gets its own isolated findings database - switch projects when switching targets to avoid noise
  • Recording sessions let you isolate findings from a specific testing phase. Start a recording before testing a feature, stop it when done
  • Bulk operations save time at scale: Ctrl+A to select all, then batch-delete, batch-score with AI, or batch-export
  • The debug canary is underrated: clicking a finding's URL copies it with a ?domloggerpp-canary=<key> parameter. Open it with DOMLogger++ in debug mode to hit a breakpoint exactly at the sink invocation
  • Pattern scanning: found a vuln in one endpoint? Search sink.sink.eq:"innerHTML" AND sink.data.cont:"your_pattern" to find the same pattern across the entire target

References & further reading