hi i'm really stucked in this challenge from root-me, so i need to take advantage of the xss found in $("#chatbox").append("You: "+$("#input").val().replace('<','').replace('>','')+"\n") using an iframe but i don't know how to do that because of cross origin frame. I think that i have to use iframe.contentWindow.postMessage() to target the the event listener " input.keydown " but i'm not sure about that because i didn't found anything that could help me to do that. Sorry for my english not my native language
$(function () {
var input = $('#input');
window.WebSocket = window.WebSocket || window.MozWebSocket;
if (!window.WebSocket) {
alert('Sorry, but your browser doesn\'t support WebSocket.')
window.location.href="/"
return;
}
var connection = new WebSocket('ws://'+window.location.hostname+'/ws');
connection.onopen = function () {};
connection.onerror = function (error) {
alert("An error occured, you will reload the page for you to access a new room !")
location.reload()
};
connection.onmessage = function (message) {
$("#chatbox").append("You: "+$("#input").val().replace('<','').replace('>','')+"\n")
$("#chatbox").append("\nBot: "+message["data"].replace('<','').replace('>','')+"\n-------------------------------------------------------------\n")
$('#chatbox').scrollTop($('#chatbox')[0].scrollHeight);
$("#input").val("")
};
connection.onclose = function(message) {
$('#chatbox').append("--------------------------END OF COMMUNICATION--------------------------")
}
input.keydown(function(e) {
if (e.keyCode === 13) {
var msg = $("#input").val();
if (!msg) {
return;
}
connection.send(msg);
}
});
});
so i created an iframe from my page like you see above
<body>
<p id="para"></p></body>
<script>
var iframe = document.createElement('iframe');
iframe.src = 'http://ctf02.root-me.org/room';
iframe.height = '90%';
iframe.width = '90%';
iframe.onload = actions;
document.getElementsByTagName('body')[0].appendChild(iframe);
function actions(){
setTimeout(function() { get_cookie();}, 5000);
}
function get_cookie(){
}
</script>
and the website inside the iframe is using this code to display the input value and the websocket server response in the #chatbox :
$(function () {
var input = $('#input');
window.WebSocket = window.WebSocket || window.MozWebSocket;
if (!window.WebSocket) {
alert('Sorry, but your browser doesn\'t support WebSocket.')
window.location.href="/"
return;
}
var connection = new WebSocket('ws://'+window.location.hostname+'/ws');
connection.onopen = function () {};
connection.onerror = function (error) {
alert("An error occured, you will reload the page for you to access a new room !")
location.reload()
};
connection.onmessage = function (message) {
$("#chatbox").append("You: "+$("#input").val().replace('<','').replace('>','')+"\n")
$("#chatbox").append("\nBot: "+message["data"].replace('<','').replace('>','')+"\n-------------------------------------------------------------\n")
$('#chatbox').scrollTop($('#chatbox')[0].scrollHeight);
$("#input").val("")
};
connection.onclose = function(message) {
$('#chatbox').append("--------------------------END OF COMMUNICATION--------------------------")
}
input.keydown(function(e) {
if (e.keyCode === 13) {
var msg = $("#input").val();
if (!msg) {
return;
}
connection.send(msg);
}
});
});
so i want to modify the value of the #input and send keydown from my page