I have a site, let's call it parent.com
, that embeds a third party plugin from child.com
in an iframe. I have found a XSS vulnerability on child.com
.
The embedded page from child.com
contains a form that POSTs to another page on the same domain. I can exploit the vulnerability by submitting the form. I intercept the POST request with Burp, and insert my payload into it. The payload is then executed.
My problem is that the payload runs inside the iframe on the child.com
domain. My goal is to compromise parent.com
(in order to win a bug bounty). Is it possible to use this vulnerability to accomplish that somehow? For example, can I somehow make the form submit to parent.com
instead?
example.com
. It contains an iframe with the sitethirdparty.com/
. Thethirdparty.com
page contains a form, that submits tothirdparty.com
as well. There is a XSS vulnerability in the page the form submits to. Is it correct so far? If so, what is it you want to do now? – Anders Nov 5 '18 at 15:31exampleForm.com
? And is the XSS bug in the page that displays the form, or the page that handles the submitted form? – Anders Nov 5 '18 at 16:10