Vulnerable S1

Support widget

The portal embeds a third-party chat widget in an iframe. The widget talks back with postMessage, and the portal drops whatever arrives straight into the DOM.

window.addEventListener("message", function(event) {
  document.getElementById("output").innerHTML = event.data;
});

let victimWindow = window.opene(victimSite);
victimWindow.postMessage('<script>alert("ROOTAST")</script>', "*");

Two details the writeup glosses over.
• window.opene is a typo — the real API is window.open.
• innerHTML does not run <script> elements. A payload dropped into innerHTML needs an event handler (<img onerror>, <svg onload>) or a script-capable sink. Switch the sink below to watch the difference live.

Sink under test

Widget output

Raw payload received

—

Your session

Set as a cookie so an injected script can steal it.

account: demo.user@acme.test
role: customer
cookie: …

Embedded widget