postMessage gadgets
Map every listener and every wildcard sender. Origin checks that use indexOf or startsWith, plus a DOM or auth sink, are the classic SPA gadget.
Skill: JavaScript and client trust
Ask: Which source reaches which sink, and which of those sinks is behind an origin check?
Stop: You have line numbers for the listener or sink, and you have not claimed execution from a pattern match.
Practice the class in the browser: PortSwigger Web Security Academy. The lab is theirs. This page is the stop condition and the disclosures.
Checklists
- JavaScript review - Treat the frontend as source. Most P1s on modern apps start here.
Disclosures
No public card yet.
Playbooks
- postMessage & DOM gadgets - Map every message listener and every wildcard sender. SPA auth and payment widgets live and die here.
Tools
- jsluice - Extracts URLs, paths, and secrets from JavaScript by parsing the AST (not regex) - far more accurate than LinkFinder for modern bundles.
Questions
Wildcard targetOrigin?
A smell, not automatically XSS. You need a listener that trusts the data and a sink.
null origin?
Sandboxed iframes. Many allowlists forget null.
This page is the linked pack hunt_brief("postmessage") returns on the MCP connector. Authorized testing only.