Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [cross-frame-scripting]

An attack where the attacker exploits bugs in the SOP of the browser to steal data from a frame with a different origin.

0
votes
1answer
77 views

How does one exploit cross scripting?

In my computer science class, my professor provided the following example... Normally, a user would provide a link by typing the following in chatroom... [Example Website](https://example.com) And ...
1
vote
1answer
277 views

Loading a logged in page in an iframe

Suppose www.youtube.com have no X-Frame-Options set. Imagine I'm already logged in to YouTube. Now from another web page in the same browser I'm loading YouTube in an iframe, will the browser send ...
1
vote
1answer
114 views

Can malicious sites use session data from iframes?

Let's say I have logged in to my site Genuine Site. Malicious Site has an iframe embedding Genuine Site. Will the embedded iframe in the Malicious site have access to my login credentials from Genuine ...
0
votes
0answers
35 views

Browser control, Hijacking, Manipulating

Can anyone advise me on where to look to see if anything suspicious is happening on my browser... not really sure if its being controlled or not but searches i make DONT seem to be legit :/ the url ...
0
votes
0answers
296 views

Is window.postMessage origin check important for “stateless” iframe application?

So I'm creating a service that will be embedded in iframes and with web views like JxBrowser, the parent site will be able to pass in private input data with window.postMessage and receive back ...
3
votes
1answer
767 views

X-Frame-Options Absent but cant load the page in iframe

I am trying to find the reason that a certain webpage is not getting iframed even when X-Frame-Options header is absent. Observation: When I write an HTML with iframe tag pointing to the URL and save ...
5
votes
3answers
4k views

How to avoid the cross-frame scripting attack over core php we application

I have developed one web application that is in core-php as per the client's requirement. My client conducted a vulnerability test, and found a Cross-Frame Scripting as a vulnerability at hard level. ...
3
votes
2answers
806 views

Are these four HTTP headers protection against Cross-Frame Scripting enough?

I would like to ask a question what is the best protection against Cross-Frame Scripting. I have set up my web server to adding these flags into HTTP HEADER: X-Same-Domain: 1 X-Content-Type-Options: ...
-1
votes
1answer
905 views

How do configure Apache to resolve 'Missing Cross-Frame Scripting Defence' by app scan [closed]

There is an apache server hosting some website written in PHP and is accessible thru internet. How do configure the apache to resolve 'Missing Cross-Frame Scripting Defence' and can 'Missing Cross-...
3
votes
2answers
6k views

Are these both cross frame scripting attacks?

I've received a recent security review of a website which mentioned it had a cross frame scripting vulnerability. In short, it mentioned that a malicious site could load the page up in an iframe, ...