OLD | NEW |
1 CONSOLE ERROR: line 1: Uncaught SecurityError: Blocked a frame with origin "http
://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". P
rotocols, domains, and ports must match. | 1 CONSOLE ERROR: line 1: Uncaught SecurityError: Blocked a frame with origin "http
://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". P
rotocols, domains, and ports must match. |
2 This page opens a window to "", injects malicious code, and then navigates its o
pener to the victim. The opened window then tries to scripts its opener after do
cument.writeing a new document. | 2 This page opens a window to "", injects malicious code, and then navigates its o
pener to the victim. The opened window then tries to scripts its opener after do
cument.writeing a new document. |
3 Code injected into window: | 3 Code injected into window: |
4 <script>document.write('<script>function write(target, message) { target.documen
t.body.innerHTML = message; }setTimeout(function() {write(window.opener, \'FAIL:
XSS was allowed.\');}, 100);setTimeout(function() {write(window.opener.top.fram
es[1], \'SUCCESS: Window remained in original SecurityOrigin.\');}, 200);setTime
out(function() { if (window.testRunner) testRunner.globalFlag = true; }, 300);<\
/script>');</script> | 4 <script>document.write('<script>function write(target, message) { target.documen
t.body.innerHTML = message; }setTimeout(function() {write(window.opener, \'FAIL:
XSS was allowed.\');}, 100);setTimeout(function() {write(window.opener.top.fram
es[1], \'SUCCESS: Window remained in original SecurityOrigin.\');}, 200);setTime
out(function() { window.opener.top.postMessage(\'done\', \'*\'); }, 300);<\/scri
pt>');</script> |
5 | 5 |
6 | 6 |
7 -------- | 7 -------- |
8 Frame: '<!--framePath //<!--frame0-->-->' | 8 Frame: '<!--framePath //<!--frame0-->-->' |
9 -------- | 9 -------- |
10 This page doesn't do anything special (except signal that it has finished loadin
g). | 10 This page doesn't do anything special. |
11 | 11 |
12 -------- | 12 -------- |
13 Frame: '<!--framePath //<!--frame1-->-->' | 13 Frame: '<!--framePath //<!--frame1-->-->' |
14 -------- | 14 -------- |
15 SUCCESS: Window remained in original SecurityOrigin. | 15 SUCCESS: Window remained in original SecurityOrigin. |
OLD | NEW |