Collaborate Disseminate
I have two websites.
Both websites sit on the same hosting environment.
I have broad control over the hosting environment.
One website is a Drupal website and the other is a static (plain HTML website).
I try to iframe-embed one of the HTM… Continue reading I have two websites. I try to iframe from one to another but I get "iframe refused to connect"
If a potential attacker was able to upload a cross-origin <iframe> element to your website as a post of some sort, what could they actually do through it? I know that cross-origin <iframe> elements are able to do simple stuff l… Continue reading What XSS attacks could somebody perform through an iframe?
I have a site that have SSO resolved in a way of opening identity provider in iframe to access it. I have CSP to ‘self’ but it didn’t work, adding the implicit url also fails. SSO does not work and I keep getting this confusing message:
R… Continue reading Refused to frame url despite having it in frame-ancestors [migrated]
I am looking to figure out how to create an iFrame tag without any spaces. I have found an input on a Bug Bounty program that reflects my input back into the page, and allows me to escape double quotes and an angle bracket. The page has X… Continue reading Can you have an <iframe> tag with no spaces?
We are implementing clickjacking protection on our website as follows:
By default every page on our site has frame-ancestors self
We have a list of pages that are specifically designed to be embeddable in 3rd party apps, so those pages do… Continue reading do I need CSP: frame-ancestors on a redirect page?
I am trying to do this jQuery XSS challenge here by PortSwigger.
They have a good walkthrough for XSS attacks, however I could not find anything on jQuery, which is also a programming language I have no experience in.
The description of th… Continue reading XSS against jQuery PortSwigger challenge
How can I change the value of src parameter inside the iFrame tag with programs like wfuzz or fuff?
For example I have an iFrame on the server like this:
iframe.php
<html>
<head><title>attack to iFrame</title></h… Continue reading bruteforce attack inside iFrame
I run a site that displays user-generated SVGs. They are untrusted, so they need to be sandboxed.
I currently embed these SVGs using <object> elements. (Unlike <img>, this allows loading external fonts. And unlike using an <… Continue reading What sandbox does an <object> element run in? Can this sandbox be configured?
For a social networking site example.com, users all have their own domains. How can you keep someone seamlessly authenticated across all domains?
For the main site, example.com, I am currently using:
<?php
session_start();
//han… Continue reading What’s the best way to handle authentication across multiple different domains under the same service?
If your internet traffic had an eavesdropper and you access a website using HTTPS from my understanding they would know the domain name (hostname) that you visit (as well as some other things), but if after logging into that first site (wh… Continue reading Would a hostname from an HTTPS iframe leak if loaded after a successful connection with another HTTPS hostname which displayed the iframe