Questions tagged [iframe]
The HTML Inline Frame Element is a nested browsing context, embedding another HTML page into the current page.
75
questions
0
votes
1answer
60 views
Drive by download with iframes
Does the definition of a drive by download include malicious execution of an unaccepted downloaded file or is the unaccepted download of a file the drive by download by itself? I didn't find a good/...
0
votes
0answers
43 views
What to consider for determining something as a security flaw?
Recently, I found an iframe injection vulnerability on a website. This website allows users to create projects and name them. So I successfully injected an iframe on the naming function that can ...
2
votes
1answer
55 views
Why we should not allow our pages to be loaded through Iframe by unknown hosts?
One of OWASP recomendations is to set the header X-Frame-Options to allow our pages to be loaded in Iframes only by sameorigin.
One reason is because of phishing attacks, ok I understand. But if I ...
0
votes
0answers
28 views
Preventing Quota Theft of Embedded Service without API Key
The way the service works is that the user can embed content on their site, that is served from my servers. Usage is tracked in "views", or how many times the src endpoint inside of the <iframe> ...
1
vote
1answer
84 views
preventing cross iframe key logging in javascript
We have a web application, where other partners can include their pages as iframes. We implemented a server-to-server way of authenticating users for the iframes, but one partner doesn't want to ...
0
votes
1answer
78 views
security issues related to setting cookie using an <img> tag
Site A will be having an <img> tag with src= attribute as an absolute URL pointing to site B.
Site B will return an image response, and in that response a cookie will be set (cookie of Site B's ...
1
vote
1answer
82 views
Will this sandbox my user's javascript from my web IDE properly?
I'm working on an IDE that should run a user's JavaScript in the Browser. I don't want to just eval arbitrary code, especially as code may be shared between users. From here and other sources, I ...
1
vote
1answer
372 views
XSS in iframe can't access document cookies
I know of a website, lets call it website.com, that has these vulnerabilities:
iframe injection: I can inject an iframe with a src attribute, but cannot inject any script directly. Lets say that this ...
1
vote
1answer
81 views
PCI DSS SAQ A compliance with WooCommerce and 3rd party payment gateways - possible? [closed]
I am considering using Wordpress, WooCommerce, third party payment processor and different plugins for an ecommerce store.
I have trouble figuring out if it is possible to do all that and to be PCI ...
1
vote
1answer
146 views
Why are js libraries designed to be loaded in iframe?
I am developing a JavaScript library which users would include in their website. a common theme across 3rd party libraries is that they are loaded in a n iframe. (ex you tube) . Is there any specific ...
1
vote
1answer
101 views
Why is not checking the origin of postMessage insecure?
Typically, within the onmessage handler, you would have something like this:
window.onmessage = function(e) {
if (e.origin != "www.example.com")
return;
//Do stuff
};
The check for e....
2
votes
0answers
151 views
iframes, user generated content and scripts
Currently, we have a small personal project which is meant to allow people to create 'profiles' in HTML/CSS. We aim to put all this generated content within a sandboxed iframe. The next point in ...
2
votes
1answer
309 views
Content Security Policy: postMessage into foreign iframe
Assume we have a webpage with sensitive data. The page uses a marketing partner advertisingpartner.com which collects data via third-party cookies in a foreign iframe. We have applied a relatively ...
1
vote
0answers
211 views
How to whitelist an iframe and script of some other source embeded/ called by an iframe that is whitelisted in the CSP?
For example I am having an iframe with src https://iframe1.com which is listed in my content security policy. If the whitelisted iframe calls some iframe from another source like https://iframe2.com, ...
0
votes
0answers
33 views
JS window.confirm cross domain security?
I have wrote an assignment for a course I am studying regarding social plugins like what you get with Facebook/Twitter, etc. With these platforms the user is directed to a seperate tab/window to ...
2
votes
0answers
38 views
Collecting PII in an iframe on any website. Is it Safe?
I am building a chrome extension that allows users to submit a form on any website. Once a user would visit a certain website, extension would open iframe on that website and ask user for some PII in ...
0
votes
0answers
63 views
Clickjacking when essential JavaScript code accesses attribute of 'top'?
Given a website which doesn't use any protection specifically against Clickjacking (no X-Frame-Options or CSP), but which does access an attribute of top in essential JavaScript code, eg:
// http://...
0
votes
1answer
2k views
How to get the cookie of embedded iframe
I'm embedding an iframe on my site
< iframe id="demo" src="https://example.com" >
example.com has a cookie (not a http-only cookie)
How can I get the cookie?
15
votes
3answers
481 views
Are browser wrappers in software bad for users?
These days I see a lot of browser wrappers in software. For example:
when you purchase something in the Steam desktop application and use PayPal, you enter your PayPal security details in a browser ...
4
votes
2answers
7k views
Use XSS vulnerability in iframe to compromise parent?
I have a site, let's call it parent.com, that embeds a third party plugin from child.com in an iframe. I have found a XSS vulnerability on child.com.
The embedded page from child.com contains a form ...
4
votes
1answer
802 views
How do I control multiply-nested embedding of my iframe?
Domain example1.com embeds my iframe.
Domain example2.com embeds an iframe served from example1.com.
I would set X-Frame-Options: ALLOW FROM *.example1.com as well as Content-Security-Policy with ...
6
votes
1answer
3k views
What's the alternative of content security policy (CSP) header in Internet Explorer IE?
As mentioned in the Content Security Policy documentation & from the "supported browsers" page on the CSP site, CSP is not supported in Internet Explorer.
So, if we want to support CSP in our ...
1
vote
0answers
74 views
Protect website against attacks with iframe for user generated javascript?
I'm creating a small playground for people to write and test out their JavaScript on my website. I know websites like jsfiddle already exist but it's just for fun and for the sake of trying something ...
1
vote
1answer
1k views
Can website get hacked by iframe injection?
My website has been hacked. I am observing how hacker accesses my site. Though I have been using bindparam to prevent from sql injection and direct access restriction for backdoor attack, hacker's ...
1
vote
0answers
2k views
How to bust frame busting code without sandbox
Posted this on stackoverflow, but people are apparently scared of exploit code over there. I have the following index.html page that contains an iframe.
<body>
<iframe id="other" src="...
0
votes
2answers
33 views
HTTP request from Embeds Trackable
I'm pretty new here so please be gentle with me, a security newb.
I have a website where I want to have a user fill out a form. This form already exists on another website I own (that has greater ...
8
votes
1answer
25k views
How to confirm that an embedded iframe can read cookies from parent?
I have this html code that I may put on my site that we are evaluating for security purposes. It's code is essentially this:
<iframe src="https://glenpierce.github.io/" sandbox=
"allow-scripts ...
1
vote
1answer
126 views
Can malicious sites use session data from iframes?
Let's say I have logged in to my site Genuine Site. Malicious Site has an iframe embedding Genuine Site. Will the embedded iframe in the Malicious site have access to my login credentials from Genuine ...
0
votes
1answer
444 views
Website Security Breach from an Iframe
I know my website is being breached by a third-party web application under the following scenario:
My users put credentials to my site into a third-party web application
The third-party web ...
0
votes
1answer
2k views
Do we need to set the X-Frame-Options header for JS files too?
I have added the X-Frame-Options header for my HTML files from web server itself. Do I still need to add it for other static files like CSS and JS( which I serve from cloudfront/s3) ?
4
votes
1answer
118 views
iframe Checkout Procedure
I'm working for a company that wants to allow anyone to embed an iframe in which users can buy products on potentially any site. So it would be a typical use case for users to enter in their credit ...
6
votes
2answers
424 views
AVG detects Kaspersky update files as infected (trojan, infected, malware)
(Note: update at end of Q)
On a Mac, I am using AVG as the primary AV. In addition to this, I have a few scanners (Bitdefender and Malwarebytes) that I update and use periodically. Recently I decided ...
1
vote
1answer
86 views
Security questions - SSL secured payment iframe on an SSL secured site
Sorry if this has been answered before, I couldn't really find this exact example and I wanted to get a clearer answer for a client.
I understand that an iframe with a https payment portal on a http (...
1
vote
0answers
532 views
How does this XSS Payload work? [closed]
I recently found this payload on a security website. I tested it out and basically it just gave me a blank box. How does it work?
<iframe src=j
	a
		...
0
votes
1answer
180 views
What Kind of Site Would I Need To DDOS
Recently I heard about Distributed Denial of Service and Denial of Service attacks and to see how this worked, I made a quick script (this is not a debug thing, I have an actual question about Cyber ...
3
votes
1answer
1k views
X-Frame-Options Absent but cant load the page in iframe
I am trying to find the reason that a certain webpage is not getting iframed even when X-Frame-Options header is absent.
Observation:
When I write an HTML with iframe tag pointing to the URL and save ...
2
votes
1answer
115 views
With HTTPS, can I reliable know client domain for authenticating them against my API
I am having a hard time coming up with the best title for this question, but let me explain my situation:
I have a chat-room-as-a-service app similar to Intercom. Anyone can load the chat in an ...
5
votes
2answers
2k views
Is there any security difference between login via iFrame, Pop-up, or redirect?
There seems to be a number of techniques to authenticate a person on the web. Most commonly there are
Javascript Pop-ups (Google, Firefox Persona, Disqus, etc)
HTTP Redirects (OAuth, Facebook)
...
0
votes
3answers
7k views
How to avoid clickjacking in HTML and Javascript
I tried to put the following code in HTML but it is not helping me avoid me the clickjacking:
meta http-equiv="X-Frame-Options" content="DENY"
I wrote the following code in Javascipt:
if (self == ...
1
vote
1answer
2k views
Is the src of an iframe safe for user input?
<iframe sandbox="allow-scripts allow-same-origin"
src="javascript:alert(1)">
I would like to know if the src attribute of an iframe is safe for user input ?
I found this question, but my ...
1
vote
0answers
2k views
Secure a page in iFrame from being used outside
In a secured area of a partner site we would like to embed an iFrame. The partner will generate a hash (accessToken) that will form a part of iFrame's src, e.g. <iframe src="our-domain.com?hash={...
1
vote
1answer
292 views
what happens if browser doesn't support X-FRAME-OPTIONS
What happens if browser doesn't support X-FRAME-OPTIONS?
Does it render the uri referenced by the iframe OR it doesn't render anything in this case?
3
votes
1answer
2k views
How can I restrict my iframe to only use local content?
How can I restrict my iFrame to use only local (i.e. not from other websites) content? My question is the reverse of the question as how to restrict other sites from using my site in an iframe.
I am ...
0
votes
1answer
1k views
x-frame-options header doesn't prevent showing site in iframe
For my site I see that among response headers there is X-Frame-Options: SAMEORIGIN. Still I can preview my site in iframe of some different site, for instance here. But I expected not to. I assume ...
3
votes
5answers
323 views
Malicious Software alert from US Department of Health and Human Services
I have received a mail from a certain Security Incident Response Team on behalf of a US Department and it says,
The below URL is currently being used to deliver a payload of malicious software to a ...
6
votes
3answers
8k views
How to avoid the cross-frame scripting attack over core php we application
I have developed one web application that is in core-php as per the client's requirement. My client conducted a vulnerability test, and found a Cross-Frame Scripting as a vulnerability at hard level.
...
9
votes
1answer
5k views
Security about window.opener and iframes
I have 3 domains : domainA domainB domainC
If I set target="_blank" on domainA with a link to domainC, domainC can access a bunch of property of domainA. That's why I use target="_blank" rel="...
11
votes
2answers
4k views
Iframe inheriting parent's Content Security Policy
I have a parent page that has a Content Security Policy on it. The main purpose of CSP is not to prevent XSS, but to prevent network access. This page has to run some user generated/submitted HTML/CSS/...
0
votes
1answer
304 views
Stealing client certificate using Cross Frame Scripting
An application asks for userID and then it asks for the client certificate to authenticate. All the pages of the application are vulnerable to XFS. Now an attacker can get userID using XFS, but can it ...
2
votes
1answer
113 views
Is it a security risk that browsers can freely get images (and/or other resources) cross-domain?
Same origin policy protects us from malicious site manipulating the data on our trusted site by not allowing requests that would send the auth cookie e.g. But if I understand correctly images, scripts,...
