postMessage & DOM gadgets

Tags: postmessage, dom, xss, ato

Level: advanced

Method

1. Find listeners

   addEventListener('message'), onmessage, jQuery bind. Dump origin checks.

   Tools: jsluice, sourcemapper

2. Find senders

   postMessage(..., '*'), iframe.contentWindow, window.opener, window.parent. Wildcard targetOrigin is a smell.

3. Origin checks

   === vs indexOf vs startsWith vs endsWith vs regex. https://target.com.evil.com and null origins from sandboxed iframes.

4. Sink the data

   If event.data.html / .url / .token is applied to the DOM or to auth state, you have XSS or ATO.

   Tools: Burp Suite

5. Opener chains

   An open redirect or XSS that gets window.opener to a privileged listener on another origin of the same program.

Field notes

• Always log event.origin and event.source in your notes. Reports without the origin check fail triage.
• Mobile WebViews often skip origin checks that the desktop SPA has.

References

• https://portswigger.net/web-security/dom-based/controlling-the-web-message-source