PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Framing without iframes

portswigger.net | research | #firefox | #xss | #iframes | #cheat-sheet | #embed | #tabindex
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Chrome allows framing sites via param tags inside object and embed's code attribute; Firefox now matches Chrome's tabindex onfocus behaviour. Vectors documented in the XSS cheat sheet.
Published
Collected

Related coverage

research · portswigger.net
New crazy payloads in the URL Validation Bypass Cheat Sheet
URL Validation Bypass Cheat Sheet adds IP formats — partial decimal, mixed encodings, IPv6 — and a userinfo payload that makes Spring misparse hosts, enabling SSRF and open redirect.
research · portswigger.net
Concealing payloads in URL credentials
Payloads concealed in URL credentials stay invisible in Chrome and Firefox address bars, persisting through same-origin navigation; document.URL exposes them, enabling DOM XSS and clobbering.
research · portswigger.net
Introducing the URL validation bypass cheat sheet
PortSwigger launches the URL Validation Bypass Cheat Sheet, consolidating payloads for SSRF, CORS misconfiguration and open redirect testing, with three contexts and Intruder-friendly wordlists.
research · portswigger.net
onwebkitplaybacktargetavailabilitychanged?! New exotic events in the XSS cheat sheet
The XSS cheat sheet adds exotic event vectors: Safari-only onwebkitplaybacktargetavailabilitychanged for audio/video, heavy-interaction onpointercancel and the widely usable autofocus attribute.
research · portswigger.net
Our favourite community contributions to the XSS cheat sheet
A rundown of the seven best community submissions to PortSwigger's XSS cheat sheet: shorter Vue and AngularJS vectors, the obscure onbeforeinput event, and a WAF-evading base64-encoded payload.
research · portswigger.net
Bypassing Firefox's HTML Sanitizer API
Gareth Heyes bypassed Firefox's HTML Sanitizer API: SVG 'use' elements importing same-origin absolute URLs still executed JavaScript, even for uploads protected with Content-Disposition: attachment.
Back