Episode 8: PostMessage Bugs, CSS Injection, and Bug Drops
Critical Thinking - Bug Bounty Podcast
00:00
CSS Injection: How to Use It to Send Post-Messages
The post-message API is kind of like an API for the client side web page. If you've got event listeners on there, those are like the endpoints that you can call. Once you get a reference to the window object, you can send the post-message and interact with them. Check out what messages are being sent your post- message and find some bugs. CSS injection: You can use three or four different waysYou can escape Unicode and like write the same thing. A lot of times these aren't taken into consideration when blacklisting CSS.
Transcript
Play full episode
