Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Query on a Lab

Faisal | Last updated: Oct 17, 2021 01:21PM UTC

Hi, I was solving a lab and was not able to solve it so I had a look at the solution. I solved the lab by looking at the solution but I have a question. How will be the exploit deliver to the victim in a real case scenario? When testing an application for a reflected XSS we send the URL to the victim to get the alert in the victim browser but here is an iframe. How will this be delivered? Reference: https://portswigger.net/web-security/dom-based/controlling-the-web-message-source/lab-dom-xss-using-web-messages Please reply to my query I need an answer to this. Thanks

Ben, PortSwigger Agent | Last updated: Oct 18, 2021 01:48PM UTC

Hi Faisal, The Exploit Server is just something that we use in our Web Academy in order to make delivering exploits easier for the user. Some of the topics covered would require you to host exploits for victim users to access - we simulate this with the Exploit Server and dummy victim users. In a real world scenario you would likely have to have your own server setup in order to host and deliver exploits. Have you read the following from the learning materials: https://portswigger.net/web-security/dom-based/controlling-the-web-message-source This, alongside the solution in the lab itself, provides information as to how the exploit is being delivered.

Faisal | Last updated: Oct 19, 2021 12:58PM UTC

I know how the exploit server works for the port swigger. I just want to ask how will the iframe be delivered to the victim. I know in the real world I will have to set up my own server but in this particular case will the iframe payload be delivered by .HTML page? Like in a CSRF attack we craft an HTML page and save it in a file with .HTML extension and deliver it to the victim. Like that how will this payload be delivered? <iframe src="https://your-lab-id.web-security-academy.net/" onload="this.contentWindow.postMessage('<img src=1 onerror=print()>','*')"> Suppose I am the victim here How will you deliver me the attack surface?

Ben, PortSwigger Agent | Last updated: Oct 20, 2021 07:50AM UTC

Hi Faisal, You would need to host the exploit in the usual fashion. There are some interesting walkthroughs/discussions on how to exploit postMessage in the following articles: https://gupta-bless.medium.com/exploiting-postmessage-ca65b9ac90a6 https://labs.detectify.com/2016/12/15/postmessage-xss-on-a-million-sites/ https://infosecwriteups.com/exploiting-post-message-to-steal-users-cookies-7df43a00289a https://blog.yeswehack.com/yeswerhackers/introduction-postmessage-vulnerabilities/

Faisal | Last updated: Dec 04, 2021 03:26PM UTC