postMessage() III

Bookmarked!

This exercise covers how insecure calls to the JavaScript function postMessage() can be used to trigger a Cross-Site Scripting

PRO Medium < 1 Hr. 1027 Orange Badge

Course

This course covers the exploitation of an application using <code>addEventListener()</code> without verifying the origin of the message, making it vulnerable to Cross-Site Scripting (XSS). You'll learn how to convert a self-XSS into an XSS using an iframe and postMessage().

Skills covered

Injection Authentication Client Side

Included with PRO

Full course content 2 videos Common mistakes

This lab is free this month. Register to start hacking.