# Bypassing SOP with Iframes - 1 {{#include ../../banners/hacktricks-training.md}} ## Iframes in SOP-1 In this [**challenge**](https://github.com/terjanq/same-origin-xss) created by [**NDevTK**](https://github.com/NDevTK) and [**Terjanq**](https://github.com/terjanq) you need you need to exploit a XSS in the coded ```javascript const identifier = "4a600cd2d4f9aa1cfb5aa786" onmessage = (e) => { const data = e.data if (e.origin !== window.origin && data.identifier !== identifier) return if (data.type === "render") { renderContainer.innerHTML = data.body } } ``` The main problem is that the [**main page**](https://so-xss.terjanq.me) uses DomPurify to send the `data.body`, so in order to send your own html data to that code you need to **bypass** `e.origin !== window.origin`. Let's see the solution they propose. ### SOP bypass 1 (e.origin === null) When `//example.org` is embedded into a **sandboxed iframe**, then the page's **origin** will be **`null`**, i.e. **`window.origin === null`**. So just by embedding the iframe via `