Is there any way to access the contents of a cross domain iframe

Question

I found that a subdomain of a site leaks all cookies of the site due to improper error handling. Now, I found that this site does not have X-Frame Options Header in it. So, I put this subdomain in the iframe tag and it starts working. However, is there any way to access the contents inside it? Or any other way to exploit this as an account takeover?

Answer 1

Is there any way to access the contents of a cross domain iframe

Not programmatically (see below for another approach), as the same origin policy will not allow this. If it did, that would be cause for alarm, not just in your situation. An attacker could steal CSRF tokens and perform arbitrary actions, read all data the user has access to, etc.

I found that a subdomain of a site leaks all cookies of the site due to improper error handling

This definitely violates best practices, but I wouldn't see it as a vulnerability. Preventing this is more a defense in depth issue (similar to httponly cookies).

Or any other way to exploit this as an account takeover?

You can combine the clickjacking issue with the cookie disclosure issue to potentially get a user to disclose the cookies to you by presenting a fake captcha with pieces of the cookie.

Basically, you create a bunch of little iframes - each containing one character of the cookie -, which you can then rearrange and distort so they look like a captcha. You then get the session cookie when a user "solves" the captcha.

Depending on the length of the session ID, more than one captcha may be required.

See this paper for a detailed description and this article for a real-world example.