| CONSOLE ERROR: line 1: Uncaught SecurityError: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match. |
| This page opens a window to "", injects malicious code, and then navigates its opener to the victim. The opened window then tries to scripts its opener after reloading itself as a javascript URL. |
| Code injected into window: |
| <script>window.location = 'javascript:\'<script>function write(target, message) { target.document.body.innerHTML = message; }setTimeout(function() {write(window.opener, \\\'FAIL: XSS was allowed.\\\');}, 100);setTimeout(function() {write(window.opener.top.frames[1], \\\'SUCCESS: Window remained in original SecurityOrigin.\\\');}, 200);setTimeout(function() { window.opener.top.postMessage(\\\'done\\\', \\\'*\\\'); }, 300);<\\\/script>\''</script> |
| |
| |
| |
| -------- |
| Frame: '<!--framePath //<!--frame0-->-->' |
| -------- |
| This page doesn't do anything special. |
| |
| -------- |
| Frame: '<!--framePath //<!--frame1-->-->' |
| -------- |
| SUCCESS: Window remained in original SecurityOrigin. |
