Attacker
S2
Attack from a trusted domain's subdomain
This page runs at https://attacker.trusted-domain.pmlab.amir.baby — a
subdomain of the domain the portal trusts. In the real world that subdomain is
yours because you found XSS on it, or because a dangling DNS record handed it over.
let victimWindow = window.opene(victimSite);
victimWindow.postMessage("<script>alert('ROOTAST')</script>", "https://trusted-domain.com");
const victimWindow = window.open(VICTIM_URL);
// post when the portal has loaded — a message posted to a window that is
// still loading is delivered to the blank document and lost
victimWindow.addEventListener("load", () => victimWindow.postMessage(PAYLOAD, "https://victim.pmlab.amir.baby"));
The target origin is a claim, not proof.
Note on the target origin. The writeup prints the trusted domain as the target origin, which only delivers if the receiver is hosted there. In this lab the portal lives on
postMessage(data, "https://trusted-domain.pmlab.amir.baby") does
not make the message come from that origin — it only asks the browser to
deliver it there. The receiver sees event.origin set to the
sender's real origin
(https://attacker.trusted-domain.pmlab.amir.baby), which is why the receiver
has to check it.
Note on the target origin. The writeup prints the trusted domain as the target origin, which only delivers if the receiver is hosted there. In this lab the portal lives on
https://victim.pmlab.amir.baby, so that is the target
origin used here. Try the button below that uses the writeup's literal value and
watch nothing arrive — the browser silently drops it.
Two targets
Ready.
Payload
Victim in a frame
The portal runs on https://victim.pmlab.amir.baby.