Tag Info

Hot answers tagged


One iframe does a GET on the page with the password and sends this password via html5 windows.postMessage() to another iframe (sourcing the attacker's site) which takes this password and sends it off to the hacker's site via a query parameter in an http get to a hacker's web service. postMessage is done with Javascript. This means one can not force a ...


If origin was spoofed in this context, this would be down to a flaw in the particular browser that had been exploited. There have been such flaws in the past, such as this one on Safari. So assuming the user is using a fully patched browser and no zero day flaws exist (!) then your method of verifying the origin cannot be spoofed within the browser when ...

Only top voted, non community-wiki answers of a minimum length are eligible