From 189ace915866ca01ac642269d3618622e3a715fc Mon Sep 17 00:00:00 2001 From: HackTricks News Bot Date: Thu, 7 Aug 2025 01:45:59 +0000 Subject: [PATCH 1/2] Add content from: Research Update: Enhanced src/pentesting-web/xss-cross-site-... --- .../iframes-in-xss-and-csp.md | 93 ++++++++++++------- 1 file changed, 59 insertions(+), 34 deletions(-) diff --git a/src/pentesting-web/xss-cross-site-scripting/iframes-in-xss-and-csp.md b/src/pentesting-web/xss-cross-site-scripting/iframes-in-xss-and-csp.md index cb00123d3..b0795ab99 100644 --- a/src/pentesting-web/xss-cross-site-scripting/iframes-in-xss-and-csp.md +++ b/src/pentesting-web/xss-cross-site-scripting/iframes-in-xss-and-csp.md @@ -64,7 +64,7 @@ Therefore it’s possible to bypass the CSP of a page with: + content="script-src 'sha256-iF/bMbiFXal+AAl9tF8N6+KagNWdMlnhLqWkjAocLsk'" /> - - - ``` - -- Another iframe that actually has the user logged in (without the `credentialless` flag). - -Then, from the XSS it's possible to access the other iframe as they have the same SOP and steal the cookie for example executing: - -```javascript -alert(window.top[1].document.cookie); +```html + ``` ### fetchLater Attack @@ -219,7 +241,10 @@ Check the following pages: ../postmessage-vulnerabilities/steal-postmessage-modifying-iframe-location.md {{#endref}} + + +## References + +* [PortSwigger Research – Using form hijacking to bypass CSP (March 2024)](https://portswigger.net/research/using-form-hijacking-to-bypass-csp) +* [Chrome Developers – Iframe credentialless: Easily embed iframes in COEP environments (Feb 2023)](https://developer.chrome.com/blog/iframe-credentialless) {{#include ../../banners/hacktricks-training.md}} - - - From 831661ebb6ced266899423e586316fa3373860b6 Mon Sep 17 00:00:00 2001 From: SirBroccoli Date: Mon, 18 Aug 2025 15:50:48 +0200 Subject: [PATCH 2/2] Update iframes-in-xss-and-csp.md --- .../iframes-in-xss-and-csp.md | 28 +++++++++++++++++-- 1 file changed, 25 insertions(+), 3 deletions(-) diff --git a/src/pentesting-web/xss-cross-site-scripting/iframes-in-xss-and-csp.md b/src/pentesting-web/xss-cross-site-scripting/iframes-in-xss-and-csp.md index b0795ab99..6f76847f7 100644 --- a/src/pentesting-web/xss-cross-site-scripting/iframes-in-xss-and-csp.md +++ b/src/pentesting-web/xss-cross-site-scripting/iframes-in-xss-and-csp.md @@ -199,10 +199,32 @@ window.top[1].document.cookie = 'foo=bar'; // write alert(window.top[2].document.cookie); // read -> foo=bar ``` -To embed 3rd-party content in pages that already enforce COEP you can now simply use: +- Exploit example: Self-XSS + CSRF -```html - +In this attack, the attacker prepares a malicious webpage with 2 iframes: + +- An iframe that loads the victim's page with the `credentialless` flag with a CSRF that triggers a XSS (Imagin a Self-XSS in the username of the user): + ```html + + +
+ + + +
+ + + + ``` + +- Another iframe that actually has the user logged in (without the `credentialless` flag). + +Then, from the XSS it's possible to access the other iframe as they have the same SOP and steal the cookie for example executing: + +```javascript +alert(window.top[1].document.cookie); ``` ### fetchLater Attack