• Enabling cross-site scripting XSS via an iframe

    Posted by Jeff at 1:24pm on October 19, 2008 under the following categories: JavaScript.

    Communication from an iframe that has content from a domain other than the one the iframe is contained within is a constant source of frustration - as browsers prevent this kind of activity due to built-in security policies. Here is a technique to perform cross-site scripting (XSS) in just such an environment with example code and a real-world example.