nuclei-templates/headless/postmessage-tracker.yaml

72 lines
1.9 KiB
YAML
Raw Normal View History

2021-03-10 08:33:40 +00:00
id: postmessage-tracker
info:
name: Postmessage Tracker
2021-04-06 06:46:11 +00:00
author: pdteam
2021-03-10 08:33:40 +00:00
severity: info
reference:
- https://github.com/vinothsparrow/iframe-broker/blob/main/static/script.js
2021-03-10 08:33:40 +00:00
tags: headless,postmessage
headless:
- steps:
- action: setheader
args:
part: response
key: Content-Security-Policy
value: "default-src * 'unsafe-inline' 'unsafe-eval' data: blob:;"
2021-03-10 08:33:40 +00:00
- action: script
args:
hook: true
code: |
() => {
window.alerts = [];
2021-03-10 08:33:40 +00:00
logger = found => window.alerts.push(found);
2021-03-10 08:33:40 +00:00
function getStackTrace() {
var stack;
try {
throw new Error('');
} catch (error) {
stack = error.stack || '';
}
stack = stack.split('\n').map(line => line.trim());
return stack.splice(stack[0] == 'Error' ? 2 : 1);
2021-03-10 08:33:40 +00:00
}
var oldListener = Window.prototype.addEventListener;
2021-03-10 08:33:40 +00:00
Window.prototype.addEventListener = (type, listener, useCapture) => {
if (type === 'message') {
logger(getStackTrace());
}
return oldListener.apply(this, arguments);
};
}
2021-03-10 08:33:40 +00:00
- args:
url: "{{BaseURL}}"
action: navigate
- action: waitload
2021-03-10 08:33:40 +00:00
- action: script
name: alerts
args:
code: |
() => { window.alerts }
2021-03-10 08:33:40 +00:00
matchers:
- type: word
part: alerts
words:
- "at Window.addEventListener"
2021-03-10 08:33:40 +00:00
extractors:
- type: kval
part: alerts
kval:
- alerts
# digest: 490a0046304402203e9bd9f021bbf2a081ac817e6f8381e39f6507e40a22659ebed4a8402fea0d1202204f1d217045fc3577876bf20765baa2c6880a41fbf940c426dbdd2d96289e04e1:922c64590222798bb761d5b6d8e72950