postMessage() IV

Bookmarked!

This exercise covers how insecure calls to the JavaScript function postMessage() can be used to leak sensitive information when a listener does not filter the Origin and X-Frame-Options is used

PRO Medium < 1 Hr. 1019 Orange Badge

Course

This course details the exploitation of an application using <code>addEventListener()</code> without verifying the origin of the message. By leveraging this vulnerability, you can get an administrator to leak confidential information via the "Sharing" functionality.

Skills covered

Injection Authentication Client Side Operating System Network

Included with PRO

Full course content 1 video Common mistakes

This lab is free this month. Register to start hacking.