Security article

DOM XSS using web messages and a JavaScript URL

DOM XSS using web messages and a JavaScript URL: This lab demonstrates a DOM-based redirection vulnerability that is triggered via web messaging. • PortSwigger • DOM, XSS • dom, dom-based

2022-12-055 tags

Lab: DOM XSS using Web Messages and a JavaScript URL

🎯 Objective

This lab demonstrates a DOM-based redirection vulnerability that is triggered via web messaging.

Goal:

Construct an HTML page on the exploit server.
Exploit the vulnerability so that the browser calls the print() function.

🧭 Background

The vulnerability arises from insecure handling of postMessage events.
If messages from untrusted origins are not properly validated, attackers can inject malicious payloads such as javascript: URLs.

🔎 Step 1: Understanding Event Listeners

First, I created a PoC page to understand how window.addEventListener('message', ...) works:

<html>
  <title>Test</title>
  <body>
    <div>
      <h1>LISTENER</h1>
      <p></p>
    </div>
    <script>
      window.addEventListener('message', function(e) {
        var origin = e.origin;

        // Origin validation
        if (origin !== 'http://localhost') return;

        document.getElementsByTagName('p')[0].innerHTML =
          'Message from Björntjänsteman: ' + e.data;

        console.log('Message test ' + e.data);
      }, false);
    </script>
  </body>
</html>

← Back to overview