A grammar-based DOM fuzzer that generates HTML, CSS, and JavaScript test cases to find security vulnerabilities in web browsers.
Domato is a DOM fuzzer developed by Google for security research. It generates randomized HTML, CSS, and JavaScript files using a grammar-based engine to test web browsers for vulnerabilities like memory corruption and logic bugs. It has been used to find numerous CVEs in browsers like Safari, Chrome, Firefox, and Internet Explorer.
Security researchers and browser developers focused on finding and fixing vulnerabilities in DOM engines and web standards implementations.
It provides a highly customizable, grammar-driven approach to fuzzing that can model complex web content interactions, making it more effective than random mutation-based fuzzers for discovering deep browser bugs.
DOM fuzzer
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Allows fine-grained control over test case structure using .txt grammar files for HTML, CSS, and JavaScript, enabling targeted fuzzing of specific DOM features as detailed in the syntax sections.
The grammar.py library is application-agnostic, making it adaptable for fuzzing other structured data formats beyond DOM, as noted in the code organization section.
Supports embedding custom Python code in grammars for dynamic value generation and context-aware logic, enhancing fuzzing precision through functions defined with !begin and !end commands.
Has discovered numerous CVEs in major browsers like Safari, Chrome, and Firefox, demonstrating real-world effectiveness in finding memory corruption and logic bugs, as listed in the Bug Showcase.
Creating effective grammars requires deep knowledge of DOM specifications and the custom syntax, including attributes like nonrecursive and beforeoutput, which can be a barrier to entry for new users.
Relies solely on grammar-based generation without integrating runtime feedback or code coverage, potentially missing bugs that feedback-driven fuzzers like AFL could catch more efficiently.
Adapting the engine for non-DOM targets or advanced scenarios requires significant Python coding and grammar customization, as admitted in the extensibility note, increasing initial effort.