3 ms·
> lead to real-world exploits not looking for real world exploits for free anymore 1) can be exploit for some flash callback things, isciurus will publish PoC
by homakov 14y ago
> lead to real-world exploits
not looking for real world exploits for free anymore
1) can be exploit for some flash callback things, isciurus will publish PoC later
2) yes
3) why it wasn't? i mean yes it's shitty but how it was broken?
4) I agree, but I demonstrated that even if you trust iframe you must specify receiver origin, just to be sure
- mmahemoff 14y agowindow.name was never safe because it was shared by all domains. (You could use it for cross-origin communicate, in a very lame way.)
- homakov 14y agoshared by all origin1 domains. I'm origin2 and now i can also read it. this is the hack :)
- ricardobeat 14y agowindow.name can be read by any domain, that's why it was used for cross-domain messaging before postMessage came along.