Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I found one of the website is loading all shopping websites in their own domain.

Eg . www.domain.com having links like ,

www.shoppingsite1.com , www.shoppingsite2.com ,www.shoppingsite3.com ....

if we click on shoppingsite1.com it leads to www.domain.com/iframe/shoppingsite1

and loads the shoppingsite1.com inside this domain.

if some one purchase the product from shoppingsite1.com . Is it possible for domain.com to caputer all user data including payment credentials.

share|improve this question
    
Bear in mind that this sort of configuration is widely required for 3rd-party payment systems. Payment processors will offer a checkout card details iframe to a different site in conjunction with tokenization to reduce the merchant's PCI scope. –  gowenfawr Oct 7 '13 at 13:38

2 Answers 2

up vote 1 down vote accepted

No, as long as the CORS Access-Control-Allow-Origin is at its default restrictive value. This prevents the outer website from accessing the framed website via Javascript/etc.

CSRF attacks are still possible, though most sites protect themselves from this.

Note that you should be sure that the iframe is indeed on the correct domain (right click>view frame info on chrome) and is not being phished.

share|improve this answer
    
So is it illegal to load some own's domains into another domain even or without their knowledge –  Ragavendran Ramesh Oct 8 '13 at 4:56
    
@RagavendranRamesh Not in general, but some sites may have a content policy that disallows that. –  Manishearth Oct 8 '13 at 5:18

There are the issues Manishearth raised but also the possibility that as the site is loaded in an iframe they could overlay their own text fields over credit card input fields for example.

It's like a slight variation of a clickjacking attacking and whilst the host site isn't stealing data from the site they are framing, they're just tricking you into inserting it into the host site instead.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.