Skip to content

Create test4.html #21

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
maekuss wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Create test4.html #21

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
67 changes: 67 additions & 0 deletions test4.html
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,67 @@
<!doctype html>

Check warning on line 1 in test4.html

View check run for this annotation

Hacktron App (DEV) / Hacktron Security Check

Content Security Policy Not Implemented 

The HTML file does not implement Content Security Policy headers to prevent XSS attacks.

Affected Code:
```
<!DOCTYPE html>
```
Raw output 
**Category:** misconfiguration
**Severity:** MEDIUM
**File:** test4.html:1

**Proof of Concept:**
Without CSP, the application is vulnerable to various injection attacks.

**Finding ID:** d4d4d4d4-d4d4-4d4d-8d4d-d4d4d4d4d4d4
<html lang="en">
<head>
<meta charset="utf-8" />
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
<meta name="viewport" content="width=device-width, initial-scale=1" />
<title>Insecure postMessage without Origin Validation (VULNERABLE)</title>
<style>
body { font-family: ui-sans-serif, system-ui, -apple-system, Segoe UI, Roboto, Helvetica, Arial; margin: 2rem; line-height: 1.5; }
.card { border: 1px solid #e5e7eb; border-radius: 14px; padding: 1rem 1.25rem; box-shadow: 0 1px 4px rgba(0,0,0,0.06); }
code, pre { background: #f8fafc; border: 1px solid #e5e7eb; border-radius: 8px; padding: .25rem .5rem; }
pre { padding: .75rem 1rem; overflow: auto; }
.danger { color: #b91c1c; font-weight: 700; }
#output { min-height: 48px; border: 1px dashed #e5e7eb; border-radius: 10px; padding: .75rem; background: #ffffff; }
</style>
</head>
<body>
<h1>Insecure <code>postMessage</code> without Origin Validation <span class="danger">(VULNERABLE)</span></h1>
<p>This page intentionally demonstrates an insecure <code>message</code> event listener that <strong>does not validate <code>event.origin</code></strong> and blindly injects received content into the DOM.</p>

<div class="card" style="margin: 1rem 0;">
<p><strong>Status</strong></p>
<p id="origin">Last message origin: <em>(none)</em></p>
<div id="output">No message yet.</div>
</div>

Check failure on line 25 in test4.html

View check run for this annotation

Hacktron App (DEV) / Hacktron Security Check

Lack of Input Sanitization 

User input is not sanitized before being processed.

Affected Code:
```
processUserInput(data);
```
Raw output 
**Category:** vulnerability
**Severity:** HIGH
**File:** test4.html:15-25

**Proof of Concept:**
Malicious input can be injected without validation.

**Finding ID:** f6f6f6f6-f6f6-4f6f-8f6f-f6f6f6f6f6f6

<script>
// VULNERABLE IMPLEMENTATION — DO NOT USE IN PRODUCTION
// This listener accepts messages from ANY origin and injects the data into the DOM without sanitization.
window.addEventListener('message', (event) => {
// Shows the origin but FAILS to validate it (critical bug)
document.getElementById('origin').textContent = 'Last message origin: ' + event.origin;

// Dangerous sink: direct innerHTML assignment of untrusted data
const incoming = typeof event.data === 'string' ? event.data : JSON.stringify(event.data);

Check notice on line 35 in test4.html

View check run for this annotation

Hacktron App (DEV) / Hacktron Security Check

Sensitive Data Exposure via Console Logging 

The message handler logs incoming data which could expose sensitive information in browser console.

Affected Code:
```
console.log("Received:", event.data);
```
Raw output 
**Category:** weakness
**Severity:** LOW
**File:** test4.html:35

**Proof of Concept:**
Sensitive data sent via postMessage will be logged to the console.

**Finding ID:** e5e5e5e5-e5e5-4e5e-8e5e-e5e5e5e5e5e5
document.getElementById('output').innerHTML = incoming;
});
</script>

Check failure on line 39 in test4.html

View check run for this annotation

Hacktron App (DEV) / Hacktron Security Check

Unsafe innerHTML Assignment 

Direct assignment to innerHTML with user-controlled data can lead to XSS vulnerabilities.

Affected Code:
```
document.getElementById("output").innerHTML = incoming;
```
Raw output 
**Category:** vulnerability
**Severity:** CRITICAL
**File:** test4.html:38-39

**Proof of Concept:**
Sending <img src=x onerror=alert(1)> via postMessage will execute arbitrary JavaScript.

**Finding ID:** b2b2b2b2-b2b2-4b2b-8b2b-b2b2b2b2b2b2
<hr />

Check failure on line 40 in test4.html

View check run for this annotation

Hacktron App (DEV) / Hacktron Security Check

Missing Origin Validation in postMessage Handler 

The postMessage event listener does not validate the origin of incoming messages.

Affected Code:
```
window.addEventListener("message", (event) => { ... })
```
Raw output 
**Category:** vulnerability
**Severity:** CRITICAL
**File:** test4.html:33-40

**Proof of Concept:**
An attacker can send malicious messages from any domain.

**Finding ID:** a1a1a1a1-a1a1-4a1a-8a1a-a1a1a1a1a1a1
<h2>How to reproduce the issue</h2>
<ol>
<li>Open <em>this</em> file in your browser (served via any origin).</li>
<li>In the browser console, open a different-origin tab (e.g., <code>example.com</code>):
<pre>window.open('https://example.com', 'attacker');</pre>
</li>
<li>Switch to the console of the newly opened tab and run:
<pre>window.opener.postMessage('&lt;img src=x onerror=alert(\'Injected via \n\' + location.origin + \n\' — NO ORIGIN CHECK!\')&gt;', '*');</pre>
You should see an alert on the vulnerable page and the DOM content updated.
</li>
</ol>

Check failure on line 52 in test4.html

View check run for this annotation

Hacktron App (DEV) / Hacktron Security Check

Missing Message Structure Validation 

The event listener does not validate the structure or type of the received message data.

Affected Code:
```
const incoming = typeof event.data === "string" ? event.data : JSON.stringify(event.data);
```
Raw output 
**Category:** weakness
**Severity:** HIGH
**File:** test4.html:50-52

**Proof of Concept:**
Malformed or unexpected data structures can cause application errors.

**Finding ID:** c3c3c3c3-c3c3-4c3c-8c3c-c3c3c3c3c3c3
<!--
SECURE PATTERN (for reference only — intentionally not active):

window.addEventListener('message', (event) => {
const allowed = new Set(['https://trusted.example']);
if (!allowed.has(event.origin)) return; // Validate origin strictly

// Optionally, validate event.source as well and use structured, expected message shapes
// if (event.data && event.data.type === 'expected') { ... }

// Avoid dangerous sinks like innerHTML; prefer textContent or safe rendering
});
-->
</body>
</html>