---
title: "Discussion on \"DOM XSS to Account Takeover: Not-So-Dirty Dancing in GIS SDK\" | Hashnode"
description: "Discussion on \"DOM XSS to Account Takeover: Not-So-Dirty Dancing in GIS SDK\". Discover how a clever DOM XSS bypass led to an automated account takeover by exploiting OAuth flows in GIS SDK"
url: "https://hashnode.com/posts/not-so-dirty-dancing-in-gis-sdk/6935b9294a0453e1cf983805"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [DOM XSS to Account Takeover: Not-So-Dirty Dancing in GIS SDK](https://blog.voorivex.team/not-so-dirty-dancing-in-gis-sdk?utm_source=hashnode&utm_medium=feed)

Discover how a clever DOM XSS bypass led to an automated account takeover by exploiting OAuth flows in GIS SDK

Dec 7, 2025 · 10 min read · blog.voorivex.team  
Updated Mar 26  
Read the article

-   [#oauth2](https://hashnode.com/tag/oauth2)
-   [#xss](https://hashnode.com/tag/xss)
-   [#account-takeover](https://hashnode.com/tag/account-takeover)
-   [#exploit](https://hashnode.com/tag/exploit)

## Written by

[HamidSj](https://hashnode.com/@Pitok)

@Pitok · Milano, Italy

  
[View profile](https://hashnode.com/@Pitok)

Software Engineer | Security Researcher

## Responses 6

Markdown supported · ⌘↵ to post

[Adam Noverian](https://hashnode.com/@Swipez)

[Dec 24, 2025](https://hashnode.com/posts/not-so-dirty-dancing-in-gis-sdk/6935b9294a0453e1cf983805/comment/694b5d338bb582cdf3a2563b)

On first image. How did you find that code? Didn't regex like that happen on backend?

[Avaz](https://hashnode.com/@nullavaz)

[Dec 10, 2025](https://hashnode.com/posts/not-so-dirty-dancing-in-gis-sdk/6935b9294a0453e1cf983805/comment/69398868e52b4dcff750a18e)

Nice writeup XD

[AmirAli Kariminasab](https://hashnode.com/@TrueLonely)

[Dec 9, 2025](https://hashnode.com/posts/not-so-dirty-dancing-in-gis-sdk/6935b9294a0453e1cf983805/comment/6937ca72e187949e5f2abafc)

That was a much-needed write-up! I really liked your eye for detail.

[Elyas Dehaty](https://hashnode.com/@elyasdehati)

[Dec 8, 2025](https://hashnode.com/posts/not-so-dirty-dancing-in-gis-sdk/6935b9294a0453e1cf983805/comment/69372ee732d28f8ef67d5a7f)

سلام چطور میتوانم درس صنف های تان اشتراک کنم؟

[loghman nematzadeh](https://hashnode.com/@loqmann)

[Dec 7, 2025](https://hashnode.com/posts/not-so-dirty-dancing-in-gis-sdk/6935b9294a0453e1cf983805/comment/6935d39b415b78007044d5fd)

Extremely elegant, comprehensive, and perfectly written. 🔥🔥🔥

[VCODER](https://hashnode.com/@vc0d3r)

[Dec 7, 2025](https://hashnode.com/posts/not-so-dirty-dancing-in-gis-sdk/6935b9294a0453e1cf983805/comment/6935bf119f6c54d920700211)

Nice writeup and excellent work 👏🔥