PostMessage
Writeups
- https://labs.detectify.com/security-guidance/the-pitfalls-of-postmessage/
- https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage
- https://trustfoundry.net/2024/07/30/a-quick-introduction-to-postmessage-xss/
- https://www.yeswehack.com/learn-bug-bounty/introduction-postmessage-vulnerabilities
- https://hackerone.com/reports/900619
- https://book.hacktricks.xyz/pentesting-web/postmessage-vulnerabilities
- https://hackerone.com/reports/231053
- https://hackerone.com/reports/576532
- https://hackerone.com/reports/1567186
- https://hackerone.com/reports/1031644
- https://hackerone.com/reports/217745
- https://hackerone.com/reports/423218
- https://rhynorater.github.io/postMessage-Braindump
- https://vinothkumar.me/20000-facebook-dom-xss/
- https://ndevtk.github.io/writeups/2023/08/18/extensions/
- https://web.archive.org/web/20211016075506/https://insight.claranet.co.uk/technical-blogs/hunting-postmessage-vulnerabilities
- https://medium.com/bored-engineer/xss-on-account-leagueoflegends-com-via-easyxdm-2016-75bcf9d582b5
Videos
- https://www.youtube.com/watch?v=dCco6bZhUd0
- https://youtu.be/6731qvqBlCE?t=2435
- https://www.youtube.com/watch?v=KGsktwaxsKU
Extension
Labs
- https://html5.digi.ninja/
- https://portswigger.net/web-security/dom-based/controlling-the-web-message-source/lab-dom-xss-using-web-messages
- https://portswigger.net/web-security/dom-based/controlling-the-web-message-source/lab-dom-xss-using-web-messages-and-a-javascript-url
- https://portswigger.net/web-security/dom-based/controlling-the-web-message-source/lab-dom-xss-using-web-messages-and-json-parse
Credits: https://x.com/Heli__9