DOM based XSS with iframe object and javascript url scheme

by littlelailo

Quick Demo

For a quick demo, klick here

To the victimsite

How it works

1. Create an iframe and add it to the DOM
2. Navigate to the site, where you want to run a script by changing the src attribute
3. Wait until the site is loaded
4. Change the src attribut to javascript: + your script. E.g. javascript:alert(document.title)

Why it sometimes won't work/What can website hoster do against it?

1. Your internet is to slow (because the src attribute changes after 1 second)
2. The website which get loaded into the iframe has an active frame buster
3. The x-frame-options header is set to e.g. SAMEORIGIN

Which browsers are vulnerable