Having discovered the X-Frame-Options
sameorigin that stops a website from being shown in a iframe, I am trying to understand how far not having this header can go.
What I am not sure about is if it's possible to have a evil website, which a JS keylogger embedded, and embed within it an iframe with a legitimate website.
Then, the user only see the legitimate website (which is itself stored inside an iframe), however the real website is listening to what is being typed, what is being clicked on, etc via JS.
Is such a scenario possible ? The reverse seems to be true, where you inject an iframe via an XSS attack, but is this way possible ?
This answer only suggest that it is possible to do so by injecting something via XSS, in an already existing website.
This code show a JS keylogger, however testing it on a dummy website doesn't seem to work. I don't have the time to debug this further, and am only interested in knowing if it is possible. A PoC would be nice however.