3 ms·

It's described right in the article: embed the victim page in an iframe. Because of the same-origin policy you shouldn't be able to access its DOM, but with thi

by shawnz 8y ago

It's described right in the article: embed the victim page in an iframe. Because of the same-origin policy you shouldn't be able to access its DOM, but with this trick, you can.

astura 8y ago
Shouldn't X-Frame-Options header fix this?
- shawnz 8y ago
  Assuming you don't want your page to be embedded, sure. But what if you do?
  - astura 8y ago
    True, but that's rather uncommon nowadays.