Attacker origin S5

The hardened listener

The same flow with an origin allowlist, a source check and a text-only sink.

Your payload, your rules. This page sends whatever you put in the box to the application under test with postMessage. Nothing is pre-filled — the payload is yours.

The URL that carries it

crafted URL — send this through Burp, or open it

Ready.

Payload

message body (sent verbatim)

page of the application

how to reach it

target origin — empty means the application’s own origin

The application under test

Runs on https://victim.pmlab.amir.baby.

Last message received by this page

— nothing received yet —