# Mapungufu ya PostMessage ## Mapungufu ya PostMessage
Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)! Njia nyingine za kusaidia HackTricks: * Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)! * Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com) * Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee * **Jiunge na** πŸ’¬ [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks\_live)**.** * **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
### [WhiteIntel](https://whiteintel.io)
[**WhiteIntel**](https://whiteintel.io) ni injini ya utaftaji inayotumia **dark-web** ambayo inatoa huduma za **bure** za kuangalia ikiwa kampuni au wateja wake wamedukuliwa na **malware za kuiba**. Lengo kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulio ya ransomware yanayotokana na malware za kuiba taarifa. Unaweza kutembelea tovuti yao na kujaribu injini yao **bure** kwa: {% embed url="https://whiteintel.io" %} --- ## Tuma **Ujumbe wa PostMessage** **PostMessage** hutumia kazi ifuatayo kutuma ujumbe: ```bash targetWindow.postMessage(message, targetOrigin, [transfer]); # postMessage to current page window.postMessage('{"__proto__":{"isAdmin":True}}', '*') # postMessage to an iframe with id "idframe" document.getElementById('idframe').contentWindow.postMessage('{"__proto__":{"isAdmin":True}}', '*') # postMessage to an iframe via onload ``` Kwa **maelezo zaidi**: * Kiungo kwa ukurasa kuhusu [**uchafuzi wa prototype**](../deserialization/nodejs-proto-prototype-pollution/) * Kiungo kwa ukurasa kuhusu [**XSS**](../xss-cross-site-scripting/) * Kiungo kwa ukurasa kuhusu [**uchafuzi wa prototype wa upande wa mteja hadi XSS**](../deserialization/nodejs-proto-prototype-pollution/#client-side-prototype-pollution-to-xss) ## Marejeo * [https://jlajara.gitlab.io/web/2020/07/17/Dom\_XSS\_PostMessage\_2.html](https://jlajara.gitlab.io/web/2020/07/17/Dom\_XSS\_PostMessage\_2.html) * [https://dev.to/karanbamal/how-to-spot-and-exploit-postmessage-vulnerablities-36cd](https://dev.to/karanbamal/how-to-spot-and-exploit-postmessage-vulnerablities-36cd) * Kwa mazoezi: [https://github.com/yavolo/eventlistener-xss-recon](https://github.com/yavolo/eventlistener-xss-recon) ### [WhiteIntel](https://whiteintel.io)
[**WhiteIntel**](https://whiteintel.io) ni injini ya utaftaji inayotumia **dark-web** ambayo inatoa huduma za bure za kuangalia ikiwa kampuni au wateja wake wameathiriwa na **malware za kuiba**. Lengo kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulio ya ransomware yanayotokana na programu hasidi za kuiba taarifa. Unaweza kutembelea tovuti yao na kujaribu injini yao **bure** kwa: {% embed url="https://whiteintel.io" %}
Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na htARTE (HackTricks AWS Red Team Expert)! Njia nyingine za kusaidia HackTricks: * Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)! * Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com) * Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee * **Jiunge na** πŸ’¬ [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks\_live)**.** * **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.