Web message settings - Port Swigger
Summary: PortSwigger's DOM Invader tool includes web message settings that, when enabled, replace message origins with a fake origin starting and ending with the true domain name, letting it identify event handlers that validate origins with flawed logic or regular expressions such as startsWith() or endsWith(). Other settings inject a canary into message data, group identical messages, generate and send its own messages to identified event listeners, and report when a page sends URL data in a web message to a different origin.
What's compelling: Origin checks built on startsWith() or endsWith() can be bypassed by a crafted origin, and a page that sends URL data to another origin can expose sensitive data such as OAuth tokens to an attacker who embeds it in an iframe with an event listener.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026