Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Exploiting the DVWA's stored XSS option, I'm using the following payload: <iframe src="url">.

I'd like to know why do some sites work but others don't when using this payload.

For example: <iframe src="">works, however <iframe src="">does not work (it shows an empty box). This site doesn't work either.

share|improve this question
up vote 7 down vote accepted

This can be controlled with the following HTTP header:

Header set X-Frame-Options 

It has the following options:

  • DENY: Stops all framing
  • SAMEORIGIN: Stops framing except for the same website that delivered the page itself. (Allowing to frame pages served from with X-Frame-Options set to this value)

If we look at google:

root@bt:~# telnet 80
Connected to
Escape character is '^]'.
GET / HTTP/1.1

HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Set-Cookie: PREF=ID=33213a21c9470cd8:FF=0:TM=1372280788:LM=1372280788:S=uhe-vKiypMTkoLNP; expires=Fri, 26-Jun-2015 21:06:28 GMT; path=/;
Set-Cookie: NID=67=pl37RO9ptszDuKjsU8ysb4W3bkos7KK0u28rPbWdM-hJsNo_gS_XFd1dtWSHM7zAeDjITumqHWIw6P836EqfGSZk51m7nioFM6SrQHZzVVEHgDjXL1CpTmGRrdjP4d_L; expires=Thu, 26-Dec-2013 21:06:28 GMT; path=/;; HttpOnly
P3P: CP="This is not a P3P policy! See for more info."
Date: Wed, 26 Jun 2013 21:06:28 GMT
Server: gws
Content-Length: 218
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN   <----

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<H1>302 Moved</H1>
The document has moved
<A HREF="">here</A>.

We can see that they have set the X-Frame-Options have been set to SAMEORIGIN. This is preventing you from iFraming the website.

share|improve this answer

Websites commonly use iframe breakers written in JavaScript or the X-Frame-Options header to prevent being iframed.

In the case of, the latter is the case:

fabian ~% curl -I | grep Frame
X-Frame-Options: SAMEORIGIN
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.