Posted this on stackoverflow, but people are apparently scared of exploit code over there. I have the following index.html page that contains an iframe.

    <iframe id="other" src="http://www.example.com" width="1250" height="500"></iframe>

    <iframe id="evil" src="busted_page.html" width="500" height="500">

    <style type="text/css">
        #other { position: absolute; top: 50px; left: 50px;}
        #evil {position: absolute; top: 50px; left: 50px; opacity: 0.7;}

The busted_page.html contains the following script:

<script>if(top != self) top.location.href = location.href;</script>

I have a Chrome Extension that I'm trying to bypass this frame busting with using a content script run at document_end. I can access the DOM of the index.html page before the frame is loaded, but I don't know how to bust the frame busting.

I've tried:

 top.location.href = document.location.href

And several variations of that, but the page just keep re-loading that way. I've tried passing in an argument to the iframe src:

iframe.src += "?v=<script>if";

But that doesn't work either. I've researched how to do this here, but haven't had any luck. How can I actually do this?

  • You could use the help of Chrome's XSS auditor. So, if you point your iframe's src to; busted_page.html?x=<script>if(top != self) top.location.href = location.href;</script> The busting script is blocked by XSS auditor and the page becomes framable. – 1lastBr3ath Jun 16 '18 at 3:24
  • @1lastBr3ath This allows the page to be framed, but the page doesn't actually render. It shows an error: 'Requests to the server have been blocked by an extension.". Is there a way to do this so busted_page.html still renders, but doesn't run the javascript inside? – 123 Jun 16 '18 at 17:11
  • Okay! It's not clear what extension is blocking the request and for what reason. Sounds like iframe's sandbox attribute is what you're looking for. – 1lastBr3ath Jun 16 '18 at 17:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.