4 ms·

I still don't get it. How are you getting a successful request and a page render for the 3rd party site, but not able to query the 3rd party DOM? If you phish

I still don't get it. How are you getting a successful request and a page render for the 3rd party site, but not able to query the 3rd party DOM? If you phished someone, there's probably better things you can do to lead to a fuller compromise.

shawnz 8y ago
It's described right in the article: embed the victim page in an iframe. Because of the same-origin policy you shouldn't be able to access its DOM, but with this trick, you can.
- astura 8y ago
  Shouldn't X-Frame-Options header fix this?
  - shawnz 8y ago
    Assuming you don't want your page to be embedded, sure. But what if you do?
    - astura 8y ago
      True, but that's rather uncommon nowadays.