# Steal postmessage modifying iframe location
{% hint style="success" %}
Learn & practice AWS Hacking:
[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\
Learn & practice GCP Hacking: 
[**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
Support HackTricks
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
{% endhint %}
## Changing child iframes locations
Volgens [**hierdie skrywe**](https://blog.geekycat.in/google-vrp-hijacking-your-screenshots/), as jy 'n webblad kan iframe sonder 'n X-Frame-Header wat 'n ander iframe bevat, kan jy **die ligging van daardie kind iframe verander**.
Byvoorbeeld, as abc.com efg.com as iframe het en abc.com nie 'n X-Frame-header het nie, kan ek die efg.com na evil.com kruis oorsprong verander met **`frames.location`**.
Dit is veral nuttig in **postMessages** omdat as 'n bladsy sensitiewe data stuur met 'n **wildcard** soos `windowRef.postmessage("","*")`, dit moontlik is om **die ligging van die verwante iframe (kind of ouer) na 'n aanvaller se beheerde ligging te verander** en daardie data te steel.
```html
```
{% hint style="success" %}
Leer & oefen AWS Hacking:[**HackTricks Opleiding AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\
Leer & oefen GCP Hacking: [**HackTricks Opleiding GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
Ondersteun HackTricks
* Kyk na die [**subskripsie planne**](https://github.com/sponsors/carlospolop)!
* **Sluit aan by die** 💬 [**Discord groep**](https://discord.gg/hRep4RUj7f) of die [**telegram groep**](https://t.me/peass) of **volg** ons op **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Deel hacking truuks deur PRs in te dien na die** [**HackTricks**](https://github.com/carlospolop/hacktricks) en [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
{% endhint %}