Critical Thinking - Bug Bounty Podcast Episode 119: Abusing Iframes from a client-side hacker
15 snips
Apr 17, 2025 Dive into the intriguing world of iframes and discover their hidden significance in web security. Learn about the vulnerabilities they pose and how attackers can exploit them through tactics like clickjacking. The discussion highlights essential attributes of iframes, along with fun facts that might surprise even seasoned security researchers. Join the conversation and uncover strategies for identifying and mitigating these risks in the ever-evolving landscape of cybersecurity.
AI Snips
Chapters
Transcript
Episode notes
Iframes and Clickjacking
- Iframes embed other pages within websites, enabling attacks like clickjacking.
- Clickjacking can be impactful if it leads to critical actions like authorization.
Effective Clickjacking Reports
- Avoid reporting clickjacking without demonstrating impact.
- Find a single point of failure click to make your clickjacking report valuable.
Frame References and PostMessages
- Frame references are crucial for client-side exploits, allowing postMessage attacks.
- PostMessages facilitate inter-frame/tab communication, an often overlooked attack surface.