Course

This course delves into the exploitation of web applications that use `addEventListener()` without proper origin verification. The vulnerability allows for cross-origin communication via the `postMessage` method, enabling attackers to manipulate the behavior of a victim's browser. Through practical steps and examples, you will learn how to create a malicious HTML page that opens the vulnerable application in an iframe and sends a crafted `postMessage` to exploit the vulnerability.

The course is based on content from EdOverflow's Bug Bounty Wiki and Detectify Labs, offering a comprehensive guide on how to identify and exploit this type of vulnerability. You will follow a structured approach: studying `postMessage` usage, creating a malicious page, baiting the victim, and finally retrieving the leaked key. Additionally, the course emphasizes the importance of checking the origin of events to prevent such vulnerabilities.