Questions tagged [iframe]
The HTML Inline Frame Element is a nested browsing context, embedding another HTML page into the current page.
102
questions
0
votes
1
answer
109
views
XSS against jQuery PortSwigger challenge
I am trying to do this jQuery XSS challenge here by PortSwigger.
They have a good walkthrough for XSS attacks, however I could not find anything on jQuery, which is also a programming language I have ...
- 171
0
votes
0
answers
34
views
bruteforce attack inside iFrame
How can I change the value of src parameter inside the iFrame tag with programs like wfuzz or fuff?
For example I have an iFrame on the server like this:
iframe.php
<html>
<head><title&...
- 221
1
vote
1
answer
45
views
What sandbox does an <object> element run in? Can this sandbox be configured?
I run a site that displays user-generated SVGs. They are untrusted, so they need to be sandboxed.
I currently embed these SVGs using <object> elements. (Unlike <img>, this allows loading ...
- 113
0
votes
0
answers
185
views
What's the best way to handle authentication across multiple different domains under the same service?
For a social networking site example.com, users all have their own domains. How can you keep someone seamlessly authenticated across all domains?
For the main site, example.com, I am currently using:
&...
- 1
11
votes
3
answers
2k
views
Would a hostname from an HTTPS iframe leak if loaded after a successful connection with another HTTPS hostname which displayed the iframe
If your internet traffic had an eavesdropper and you access a website using HTTPS from my understanding they would know the domain name (hostname) that you visit (as well as some other things), but if ...
- 119
0
votes
0
answers
119
views
Selective frame busting without HTTP headers
Why... Just Why...
Due to Shopify being unwilling to modify security headers further then removing them, the Cloudflare "Orange-to-Orange" problem (since Shopify uses Cloudflare as well), ...
- 21
0
votes
2
answers
179
views
abiliity to change elements in HubSpot iFrame forms
I recently started working on adding custom code to HubSpot forms after their form is loaded via an iFrame. Initially, I was using the following code to access the iFrame to change it:
var form = ...
- 103
13
votes
2
answers
3k
views
How do I safely host third-party Javascript code in an iframe?
I'm building a website where users, among other things, can add embeds (YouTube, Google Forms, Airtable...) and show those embeds to other people. Embeds are snippets of HTML that can include <...
- 243
0
votes
1
answer
503
views
Why some payment methods allow being embedded in an iframe and some don't?
Let's take some examples:
Pay Pal, Apple Pay (examples via Saferpay) - will not load in an iFrame
Visa Checkout, Stripe (example), Saferpay (link above) - credit card data can be input in an iFrame
...
- 163
1
vote
1
answer
613
views
srcdoc attribute of iframes as a source of XSS attacks
I am trying to implement a case where a user provides us some html code which is then stored in our database. We then retrieve the HTML from our database as a string. (We have no control over the user ...
- 11
0
votes
1
answer
330
views
Is frame busting javascript required despite x-frame-options
I am using x-frame-options sameorigin header to prevent some of my websites from being loaded in iframes. Is this a foolproof method to prevent iframe loading?
There have been several old threads on ...
- 107
4
votes
1
answer
672
views
How to create a secure embeddable HTML form?
I have an https website and I want to let other websites embed one of the pages on my website that lets users of my service log in and submit a form, similar to Paypal's payment iframe or Plaid's Link....
- 143
12
votes
4
answers
3k
views
How does collecting sensitive data using iframes increase security?
So this approach seems to be rather popular, particularly among payment processors that provide javascript integrations.
The added layer of security that "fields in iframe" brings also ...
- 222
1
vote
1
answer
408
views
cant a CSRF token be stolen using iframe?
from what I understand a common approach to storing a CSRF token would be:
the client retrieves from the server a CSRF token
the token is stored in an input element inside the form like this:
<...
- 13
1
vote
0
answers
128
views
Prevent XSS in 3rd party (self hosted) application
We have an application which have purchased from a 3rd party and host in our own environment. The application consists of its own UI and back-end, and is included in our own application through an ...
- 11
2
votes
0
answers
96
views
Should i login to my ebanking account through frames in another website?
During a credit card payment to site X , it asks me to login to my ebanking account through a frame in a site that handles that transaction in order to implement a more secure authentication (3d ...
- 21
2
votes
0
answers
204
views
Can this recommended OWASP framekiller code for protecting browsers that don't support X-Frame-Options be circumvented?
I have read and seen that javascript framekiller code doesn't seem to be widely espoused as a panacea solution. It's target use case seems to primarily be for legacy browsers or old browser versions ...
- 121
0
votes
1
answer
175
views
Are there security issues around controlled cross site sharing behind SSO?
Very simply we have a ton of websites at our company behind SSO.
I am having a hard time figuring out what security issues there are if we open cross-site sharing between these sites but wanted to get ...
- 108
0
votes
0
answers
507
views
Passing confidential data to an IFrame
There are two different web applications Host and App which are hosted separatedly, i.e. in particular on different domains. App is not designed to be accessed directly. Rather users are expected to ...
- 198
1
vote
0
answers
97
views
Allowing 3rd-party cookies in major 2020 browsers [closed]
I'm trying to get 3rd party cookies to work on major mid-year 2020 browsers [1]. It's as simple as pointing an iframe to an external URL to make a cookied request and probably get the response ...
- 3,253
0
votes
1
answer
523
views
What are the security risks of allowing users to add iframes?
In my web app I'm using a good sanitizer which let's me to whitelist some specific html tags.
I'd like to allow <iframe> so that users can insert youtube videos and so on.
However I'm worried ...
- 135
0
votes
0
answers
282
views
Is it safe to embed a google form on a website without an SSL Certificate?
I designed a Google Form for a website which does not have an SSL Certificate. I have planned to embed it onto a page using an iframe tag. I am currently testing it and have published a test page with ...
user238702
1
vote
1
answer
177
views
User submitted iframes - what to watch out for?
I'm building a part of a site where users can embed Youtube videos into their profile. I'm planning to have them get the embed iframe from Youtube directly, and submit that to our server. We're then ...
- 151
1
vote
1
answer
262
views
IFrame Vulnerability Classification
I was participating in a bug bounty on a website we will call example.com, when I ran into a very strange edge case which I am not sure I should report. The website uses ads and tracking similar to ...
0
votes
1
answer
106
views
Does FB share button contain trackers?
I am considering putting a Facebook share button (shown below) on my website to encourage people to share content to their FB page.
However, I do not want cross site trackers "bloating" my website or ...
- 263
0
votes
1
answer
1k
views
WYSIWYG Rich text editor and renderer with no XSS risks
In our web app, we need to allow users to input rich text which is then presented to other users. We are looking for a simple WYSIWYG (JavaScript) editor that outputs a format which is backwards ...
- 103
0
votes
1
answer
241
views
Assuming I own the client. Is it acceptable to embed my authorization servers login page in an iframe?
We have an authorization server which exposes a login page, we would like to authenticate users in our single page app using this authorization server. My employer does not want to redirect users to ...
- 103
2
votes
2
answers
504
views
Can cross origin iframe be detected in web logs
A recent blog post shows hackers owning a web server - at least the content and injecting a web skimming attack. https://blog.malwarebytes.com/hacking-2/2020/03/criminals-hack-tupperware-website-with-...
- 21
3
votes
1
answer
1k
views
Is there any way to access the contents of a cross domain iframe
I found that a subdomain of a site leaks all cookies of the site due to improper error handling. Now, I found that this site does not have X-Frame Options Header in it. So, I put this subdomain in the ...
- 133
2
votes
1
answer
375
views
Why we should not mix http and https when using iframes?
In the administration of advanced iframe I came across following:
"Please do not use a different protocol for the iframe: Do not mix HTTP and HTTPS if possible!".
Please explain the below points.
...
- 121
0
votes
1
answer
300
views
Drive by download with iframes
Does the definition of a drive by download include malicious execution of an unaccepted downloaded file or is the unaccepted download of a file the drive by download by itself? I didn't find a good/...
- 3
0
votes
0
answers
83
views
What to consider for determining something as a security flaw?
Recently, I found an iframe injection vulnerability on a website. This website allows users to create projects and name them. So I successfully injected an iframe on the naming function that can ...
- 11
2
votes
1
answer
166
views
Why we should not allow our pages to be loaded through Iframe by unknown hosts?
One of OWASP recomendations is to set the header X-Frame-Options to allow our pages to be loaded in Iframes only by sameorigin.
One reason is because of phishing attacks, ok I understand. But if I ...
- 69
1
vote
1
answer
402
views
preventing cross iframe key logging in javascript
We have a web application, where other partners can include their pages as iframes. We implemented a server-to-server way of authenticating users for the iframes, but one partner doesn't want to ...
- 113
1
vote
1
answer
2k
views
security issues related to setting cookie using an <img> tag
Site A will be having an <img> tag with src= attribute as an absolute URL pointing to site B.
Site B will return an image response, and in that response a cookie will be set (cookie of Site B's ...
- 113
1
vote
1
answer
247
views
Will this sandbox my user's javascript from my web IDE properly?
I'm working on an IDE that should run a user's JavaScript in the Browser. I don't want to just eval arbitrary code, especially as code may be shared between users. From here and other sources, I ...
- 143
0
votes
1
answer
3k
views
XSS in iframe can't access document cookies
I know of a website, lets call it website.com, that has these vulnerabilities:
iframe injection: I can inject an iframe with a src attribute, but cannot inject any script directly. Lets say that this ...
1
vote
1
answer
253
views
PCI DSS SAQ A compliance with WooCommerce and 3rd party payment gateways - possible? [closed]
I am considering using Wordpress, WooCommerce, third party payment processor and different plugins for an ecommerce store.
I have trouble figuring out if it is possible to do all that and to be PCI ...
- 11
2
votes
1
answer
361
views
Why are js libraries designed to be loaded in iframe?
I am developing a JavaScript library which users would include in their website. a common theme across 3rd party libraries is that they are loaded in a n iframe. (ex you tube) . Is there any specific ...
- 125
0
votes
1
answer
536
views
Why is not checking the origin of postMessage insecure?
Typically, within the onmessage handler, you would have something like this:
window.onmessage = function(e) {
if (e.origin != "www.example.com")
return;
//Do stuff
};
The check for e....
- 243
2
votes
0
answers
277
views
iframes, user generated content and scripts
Currently, we have a small personal project which is meant to allow people to create 'profiles' in HTML/CSS. We aim to put all this generated content within a sandboxed iframe. The next point in ...
- 21
2
votes
1
answer
1k
views
Content Security Policy: postMessage into foreign iframe
Assume we have a webpage with sensitive data. The page uses a marketing partner advertisingpartner.com which collects data via third-party cookies in a foreign iframe. We have applied a relatively ...
- 166
1
vote
0
answers
375
views
How to whitelist an iframe and script of some other source embeded/ called by an iframe that is whitelisted in the CSP?
For example I am having an iframe with src https://iframe1.com which is listed in my content security policy. If the whitelisted iframe calls some iframe from another source like https://iframe2.com, ...
- 11
2
votes
0
answers
115
views
Collecting PII in an iframe on any website. Is it Safe?
I am building a chrome extension that allows users to submit a form on any website. Once a user would visit a certain website, extension would open iframe on that website and ask user for some PII in ...
1
vote
1
answer
5k
views
How to get the cookie of embedded iframe
I'm embedding an iframe on my site
< iframe id="demo" src="https://example.com" >
example.com has a cookie (not a http-only cookie)
How can I get the cookie?
- 37
16
votes
3
answers
1k
views
Are browser wrappers in software bad for users?
These days I see a lot of browser wrappers in software. For example:
when you purchase something in the Steam desktop application and use PayPal, you enter your PayPal security details in a browser ...
- 163
8
votes
2
answers
23k
views
Use XSS vulnerability in iframe to compromise parent?
I have a site, let's call it parent.com, that embeds a third party plugin from child.com in an iframe. I have found a XSS vulnerability on child.com.
The embedded page from child.com contains a form ...
- 161
7
votes
1
answer
2k
views
How do I control multiply-nested embedding of my iframe?
Domain example1.com embeds my iframe.
Domain example2.com embeds an iframe served from example1.com.
I would set X-Frame-Options: ALLOW FROM *.example1.com as well as Content-Security-Policy with ...
- 239
7
votes
1
answer
6k
views
What's the alternative of content security policy (CSP) header in Internet Explorer IE?
As mentioned in the Content Security Policy documentation & from the "supported browsers" page on the CSP site, CSP is not supported in Internet Explorer.
So, if we want to support CSP in our ...
1
vote
0
answers
212
views
Protect website against attacks with iframe for user generated javascript?
I'm creating a small playground for people to write and test out their JavaScript on my website. I know websites like jsfiddle already exist but it's just for fun and for the sake of trying something ...
- 135