Exploiting web messaging implementations

on YouTube ↗58m

" summary

Explains concrete failures in postMessage implementations, shows an open‑source Chrome extension called pasta that enumerates windows listeners, captures incoming/outgoing messages and simulates exploits, and demonstrates real exploits that read and write local storage, perform CSRF, and steal cookies from major sites including a payment provider and an AliExpress sidebar which devolves into XSS. Shows attacker flows for spoofing, wildcard targetOrigin misuse, origin‑check bypasses, and working proof‑of‑concepts that extract tokens and session data.

AI-written summary · about

" chapters (7)

1. 0:00Start
2. 1:40What is Cross Document Mestaging Cross Document Messaging is the ability of two windows to send and receive messages
3. 6:32What is Cross Document Messaging Cross Document Messaging is the ability of two windows to send and receive messages
4. 8:09Cross document messaging security model
5. 14:28Potential Weaknesses
6. 16:57Weaknesses - Sender code
7. 28:47Attack flow - Sender

" related talks

• 43mAttacking Modern Web TechnologiesFrans Rosén · OWASP AppSec Europe 2018
• 42mModern web application bugsErlend Oftedal · NDC Sydney 2018
• 23mJavaScript attack surfaceDavit Karapetyan · JavaScript Summit Armenia 2023
• 34mJS Security - A Pentesters PerspectivePrasanna Kanagasabei · JSConf.Asia 2015
• 44mWhen you can't afford 0days: Client-side exploitation for the massesMichele Orru · OWASP AppSecUSA 2014
• 34m"The magic of XSS - not only in web applications"Michał Bentkowski · CONFidence 2019
• 33mHacking The Front-EndAlex Sexton · Full Stack Fest 2015
• 28mOffensive and Defensive Strategies for Client-Side JS SecurityAnand Vemuri · JSConf Budapest 2016