postMessage gadgets
Map every listener and every wildcard sender. Origin checks that use indexOf or startsWith, plus a DOM or auth sink, are the classic SPA gadget.
Playbooks
- postMessage & DOM gadgets - Map every message listener and every wildcard sender. SPA auth and payment widgets live and die here.
- Advanced JavaScript Analysis - Turn shipped JavaScript into a bounded, evidence-led map of client attack paths: collect only in-scope artifacts, recover source where exposed, trace controllable data to real sinks or authorization decisions, then validate the smallest safe chain.
Gadgets
- postMessage wildcard - Listener with origin '*' or a weak startsWith check plus a DOM / auth sink is a classic SPA gadget.
Questions
Wildcard targetOrigin?
A smell, not automatically XSS. You need a listener that trusts the data and a sink.
null origin?
Sandboxed iframes. Many allowlists forget null.
This page is the public form of hunt_brief("postmessage") on the MCP connector. Authorized testing only.