3 ms·
He's traversing the site using the injected iframe. That is, there is no top-level navigation event, only an iframe navigation event. Then he's gathering inform
by javajosh 7y ago
He's traversing the site using the injected iframe. That is, there is no top-level navigation event, only an iframe navigation event. Then he's gathering information from the iframe hosted DOM and combining it in the context of the starting, main page.
I think it's kinda clever.
- oefrha 7y agoOkay, I guess the scripts are supposed to run in the same origin, not from some third party, say airovic.com. I edited my original post. It’s still more limited than puppeteer though.
- amelius 7y agoInjecting an iframe into websites could trigger an assertion error, because the iframe isn't supposed to be there.
- natzar 7y agoHi, that's right. Some sites protect html injection. Twitter protects their site very well, but if you use http tunneling they can't do nothing as you can modify X- headers.
- stockkid 7y agoInteresting, could you explain what you mean by http tunneling and how it can bypass protection against html injection?