Skip to content
/ posta Public
forked from benso-io/posta

🐙 Cross-document messaging security research tool powered by https://enso.security

Notifications You must be signed in to change notification settings

S365x/posta

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

58 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Posta


enso.security - Posta

Posta is a tool for researching Cross-document Messaging communication. It allows you to track, explore and exploit postMessage vulnerabilities, and includes features such as replaying messages sent between windows within any attached browser.

Main Page

Prerequisites

  • Google Chrome / Chromium
  • Node.js (optional)

Installation

Development Environment

Run Posta in a full development environment with a dedicated browser (Chromium):

  1. Install Posta
    git clone https://github.com/benso-io/posta
    cd posta
    npm install
  2. Launch the dedicated Chromium session using the following command:
    node posta <URL>
  3. Click on the Posta extension to navigate to the UI

Dev mode includes a local web server that serves a small testing site and the exploit page. When running in dev mode, you can access the exploit page at http://localhost:8080/exploit/

Chrome Extension

Run Posta as a Chrome / Chromium Extension:

  1. Clone the repo:
    git clone https://github.com/benso-io/posta.git
  2. Navigate to chrome://extensions
  3. Make sure Developer mode is enabled
  4. Click on Load unpacked
  5. Choose the chrome-extension directory inside Posta and upload it to your browser
  6. Load the extension
  7. Pin the extension to your browser
  8. Browse to the website you would like to examine
  9. Click on the Posta extension to navigate to the UI

Tabs

In the Tabs section we can find our main Origin, with the iframes it hosts and communicates with through the session. We can choose the specific frame by clicking on it, and observe the postMessages related to that frame only.

Tabs

Messages

In the Messages section, we can inspect all postMessage traffic being sent from the origin to its iframes, and vice versa. We can select specific communication for further examination by clicking on it. The Listeners area presents the code which is in charge of handling the communication, we can click and copy its contents for JS code observation.

Messages Listeners

Console

In the console section, we can modify the original postMessage traffic, and replay the messages with the tampered values which will be sent from the Origin to its iframe.

We should make tests and see if we can affect the behavior of the website by changing the postMessage content. If we manage to do so, it's time to try and exploit if from a different Origin, by clicking "Simulate exploit".

Console Buttons

Exploit

Click on the "host" button inorder to navigate to the exploitation window.

Host

In the Exploit section, Posta will try and host the specified origin as an iframe in order to initiate postMessage communication. Most of the time we won't be able to do so, due to X-Frame-Options being enabled on the origin website.

Therefore, in order to continue with our exploitation, we'll need to gain communication reference with our Origin by initiating the window.open method, which can be achieved by clicking on "Open as tab".

We have the console to our right which will help us modify and craft our specified payloads and test them in Cross-Origin Communication, initiated by clicking on the Exploit button.

Exploit Content

Authors

About

🐙 Cross-document messaging security research tool powered by https://enso.security

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • JavaScript 97.4%
  • SCSS 2.2%
  • Other 0.4%