HACKING postMessage() FOR BEGINNERS!

Hi! I'm a pentester and a bug bounty hunter who's learning everyday and sharing useful resources as I move along. Subscribe to my channel because I'll be sharing my knowledge in new videos regularly.
SIGN UP ON Intigriti:
go.intigriti.co...
BUY ME A COFFEE:
www.buymeacoff...
SOCIAL MEDIA:
Follow me on Twitter: / farah_hawaa
Follow me on Instagram: / farah_hawaa
Connect with me on LinkedIn: / farah-hawa-a012b8162
TIME STAMPS:
0:43 Same-Origin Policy
1:14 When is postMessage() used
2:26 Parent window code
3:16 Child window code
4:11 Bug 1- Sender's origin not validated:
5:32 Bug 2- Target origin not specified:
postMessage() LABS:
github.com/t4k...
github.com/shu...
RESOURCES FOR postMessage():
developer.mozi...
www.mcafee.com...
jlajara.gitlab...
/ exploiting-post-messag...
Video editor: www.fiverr.com...

[@funnyshortsfrominternet8897]

I always underestimated your videos..But after watching this video i am humbled ..Thanks for sharing the knowledge

[@Sypacks]

great video. and you blink a lot. 😂😂

[@karthikkarthik-kf6bb]

😅😂

[@kinodertoten9059]

Is the sister of nullbyte lol

[@0xSN1PE]

@@kinodertoten9059 just the comment i was looking for

[@shanudevraj4236]

Wtf u noticed Bro😂✌🏻

[@karansh491]

Nullbyte's sister LOL 🤣

[@InderjitSingh-ig1wu]

Awesome video 🤙 Unique content 💯 Make a detailed video on buffer overflows with crystal clear concepts . It will help a alot.

[@rakeshlamber1441]

I also searched this topic for many days but didn't meet my expectations. There is no detailed video on buffer overflows concepts for newbies and it's a demandable and important topic . I hope mam will make video on this topic

[@TrackingAcademy]

Alright. I have been surfing to find a solution for 2 days now. And I'm glad I was able to scroll all the way down to your videos. Great 👍

[@FarahHawa]

Glad I could help!

[@aresgamer2413]

I have just entered into cyber security anf its just helping me alot thanks a lot for such type of videos...please dont stop sharing your knowledge to us.😊

[@galvanisingwarrior9092]

How did u started doing it ??

[@0xx039]

Thanks for it! Never thought of learning about postMessages this is nice introduction for me start

[@hritikdj]

Clear and concise explanation of the postMessage function and its bugs, Thanks for putting it all together 🙏🏻 Keep up the up good work 🙌🏻

[@FarahHawa]

Glad it helped! :)

[@yashgoti6276]

Great work man Just one suggestion keep background sound low, so we can here you out clearly.

[@MuhammadLab]

Now, I'm kinda start love your videos

[@ygp47]

simply and clearly explained. thanks

[@rachitjain5008]

Thanks Miss Farah, I loved what you are doing. I hardly wait for your next video please recommend some resources from where I can learn.

[@johnsnow1062]

Thanks @farah and @intigrity. Well explained lesson. plz keep up the good work.

[@parabbmishraa]

Thanx a lot ma'am You always post crystal clear concept videos and your style is also awesome .... It leaves no doubt !! 👍👍

[@FarahHawa]

I’m so happy to hear that!! Thank you for watching ☺️

[@terjanq]

2:32 there is a little error in postMessage origin, the protocol is missing. Fortunetaly, browsers should throw on this, because this a common mistake :)

[@FarahHawa]

Noted. Thanks for pointing it out!

[@mfajarf0106]

terimakasih telah membantu saya dalam kesulitan menggunakan postmessage

[@gopalsinghr.]

Crystal Clear explanation thanks for sharing

[@domaincontroller]

00:45 Same-Origin Policy 01:14 When PostMessage() is used

[@irph2]

Well done with Videos, keep up the good works, and that vase behind you is beautiful!

[@nasirwar346]

Thank You for this Beautiful Video .

[@mishuchowdhury1156]

Make a video about recon & methodology 🙂

[@doceeo3213]

As cool as all time :) Btw will you please make video on your methodology or how do you approach a target.......and some waf bypass techniques...pls !!

[@abhidey7299]

Awesome video, very informative. Thankyou for sharing such valuable info.

[@mackeman1356]

would you name some available labs to practice the idea, please. and thanks for the great simplicity.

[@aryanrawat7313]

Very well explained Farah, yes and this blinking is with me tooo😉

[@rnz8449]

Very informative and simple!

[@soufianeamed217]

Hi Farah As Usual Good Topic And useful Explanation . Thnaks For Your Time . have A Good Day And Stay Safe

[@knowledgeboxbd9625]

Great job make a video about the recon and methodology ,suppose i have a target site for finding bugs so what methodology generally i have to follow for finding bugs

[@amoghdeodhar]

Amazing! unique content.. keep posting Thank you 😇😊🙌💯

[@talishgarg1151]

Amazing and unique work! Keep it up Ma'am!

[@AnkitKumar-zn5il]

Such a helpful and great video, keep making...

[@ravimakkena3271]

Sounds looks splendid

[@anujlovetube]

Genius..nice video

[@eduardoescanilla141]

A super clear and well referenced video, my congratulations to you ;)

[@generalinformation3194]

Thank you :)

[@Joyucomedy]

Can u make next video on fuzzing..!

[@RandeepVirk]

very informative. good video.

[@flashbrutal]

It's useless untill we get access any file manager to change the code,,in my opinion

[@nullpwn]

Awesome explanation

[@099watcher]

Great content, keep up the good work, We need more people like you 👍🏻. 🍰

[@FarahHawa]

Thank youuu! Glad you liked it ☺️

[@newuser2474]

Very well explained farah mam. Can you please make videos on bug bounty 🤗🤗.keep it up

[@aimalsultani650]

Well-Done

[@CarmelleCodes]

thank you for these videos, you really inspire me :)

[@FarahHawa]

Aww, thank you for watching ☺️ glad you like them 🥰

[@FarahHawa]

@Compiled Movie Hey! No, not really. The bug here is that the postMessage() method being used by the target was misconfigured and either allows: 1. Any origin to send a message to it or 2. Any target to receive a message from it. For this reason, the attacker can use these flaws and trick a user into getting XSS-ed. It does require user interaction but not physical access. And the target needs to fix this bug and that's why they pay the bug hunter for bringing this to their attention.

[@FarahHawa]

Check the description!

[@mersalmakers1577]

Wow farah... Thank you

[@hannanjamil1060]

Great content! Keep rocking!

[@boneytech3965]

Usefull video thanks farah

[@FarahHawa]

Thank you for watching! So happy you found it useful! ☺️

[@theodoreramli9182]

Beautiful & brilliant

[@shrirangkahale]

Great

[@cyrexplays5031]

Make video on endpoints and how to exploit it?

[@bejankinaveen9306]

Nice video 👍

[@Tergaurav]

Thanks for the video, more content needed with 2 video a week?

[@MaxProgramming]

Just found your channel from recommended. Are you a software tester? I am learning web development.

[@iamaprogrammer470]

I want to explore Ethelical Hacking but I don't know from where should I start ? Can u guide me?

[@itszabbs1740]

Thank You so much !!

[@AZANSHAHID]

Please make a video on directory transversal attack

[@AZANSHAHID]

@hackR i have already sign up on that. i will take a look. thanks for reply

[@alirazzaq400]

Great work!

[@Alexedits778]

nice video

[@kevinnyawakira4600]

thanks Farah

[@sheikhsoif8167]

It's a great video

[@moviesentertainment9623]

you're pretty beauty+brain rare combination of god

[@pavankumarreddy4178]

If I am not wrong u r the one who cracked oscp at young age..

[@ImranShaikh-kt7ey]

Which software you use for editing ?

[@ugroon9050]

Thanks for video but to day i found vulnerable page and create an php exploit file but it's don't work when i click the play not do a action (child page not open) can u help me (sorry for my english, engglish is not my main language :))

[@sanghadiyasunil3489]

Hello ma'am can you explaines SSRF? Make video?

[@pitchaiahmurugesan7611]

Mam pls add English subtitles

[@verdipratama]

Hey farah😚💕

[@k2kmaster462]

how many types of bug in bug bounty upload video sister

[@shreyabanerjee1684]

Hey can you tell me that if there are two os in the vm machine..will the two vm machine have the same IP address or different ip address and is there any platform where I can connect to you and ask some doubts ??it will be vey helpful for.. keep the good work up👍❤️

[@ome.mishra]

use NAT same IP ....... or bridge ........ for different ip in local network

[@rohit_ojha]

please make your own slack communitiy ma'am please......slack is a app which you can download it form playstore ma'am please make that ma'am

[@aneeshnadh5377]

Good content, It is the Dom based xss?

[@FarahHawa]

Yes, all of these attacks are client-side!

[@b3ast407]

Farah can you please tell how to set up labs like u to study for eg like in this video, graphql one

[@FarahHawa]

I’ve mention the GitHub repo for the lab in the description! I just followed the instructions on that to set it up.

[@b3ast407]

@@FarahHawa Thankyou for your reply, learning a lot from you.

[@faique2995]

loved it

[@MuhammadLab]

But if you put subtitle is more better

[@ReporterAji]

Hello, Madam Please create Playlist

[@RahulVerma-kr5qz]

Heyy!! Uh have good knowledge but please improve your voice quality it's not clear on this video

[@playshort9053]

Nice I like to see you we are in the same age 🌹

[@Malware01]

I'm tired from gdpr cookies

[@ghostgil7006]

Redirecting dom xss

[@manyamnandeeshreddy6153]

Great Video but please reduce the background music

[@MP-eq8fx]

Thank you for the video. Please tell can someone from non tech background enter the field of bug bounty hunting for web apps?

[@FarahHawa]

I'm from a "non-tech background" so I would say YES!!! But you have to get your basics right first.

[@MP-eq8fx]

@@FarahHawa Thank you for your reply. Its great to know that you are doing so much coming from a non-tech background. I have one request for you: Please make a video or write an article about your journey coming to tech from non-tech background, the hurdles you faced and how you overcame them. That will be a guiding post for many like me. Waiting for you reply. May God bless you. EDIT: Just saw your video about your journey into bug bounty. You said that you are into the field of IT security for 2 years. So I think that gave you hands on experience before you came to bug bounty. I wish I could get to know about the experiences of someone coming into this field without any job/education in this filed. Reason I am saying this is because in the back of my mind whenever I am reading something related to security/bug bounty, I always feel that people from IT field/ CS education know things in much more details, so what I am doing is nothing in as compared to that and this is being a big mental block for me.

[@cyethacksolutions6761]

Great content, keep making video👍 And yes you blink a lot, 😀 but still good video

[@vivekdas3807]

She blink 486 time

[@karthikkarthik-kf6bb]

U hav stopped saying ,that "I'm a bug Bounty hunter" in the beginning of the video why so?🤔

[@FarahHawa]

Nice catch 🎉

[@karthikkarthik-kf6bb]

@@FarahHawa tq 😁

[@rohit_ojha]

please make a slack community ma'am......?.

[@rizwanpathan6512]

Farah please answer my question Did we require web development knowledge ex javascript etc to hunt bugs

[@FarahHawa]

It definitely helps a lot!

[@rizwanpathan6512]

@@FarahHawa did you learn web developement In your 1st video you have tell you have worked in security field after that you have started bug hunting. In which you have work before bug hunting I hope you will answer this

[@FarahHawa]

rizwan khan maybe I haven’t worked in web development. However, I do know PHP, Python and JS which I use to make vulnerable web apps to practise sometimes and that really really helps me!

[@rizwanpathan6512]

@@FarahHawa thanks a lots for answering to my questions

[@sachinmaurya3259]

First to comment >:< Nice video

[@Joyucomedy]

We can do same this any website which has login with Google of face book ???

[@FarahHawa]

That’s true, any website that uses postMessage without these checks is vulnerable. However, oauth token leak is possible. Check this report out hackerone.com/reports/314814

[@FarahHawa]

Mohammad Owais semrush has their own oauth framework :)

[@qureshiowais6951]

remove music please

[@e1Pr0f3ss0r]

R u Indian ?

[@prashantkumar2963]

Ubuntu 20.04 no😜 me too.

[@jomarbombita5078]

Nice and cute girl🤗😁😂

[@Rohitkumar-xv7uv]

Your eyes blink so much! And this is distracting me 😂

[@laminlevrai1758]

I hack you, you hack me and let's call the end justice.

[@EXPERTAD]

980th like

[@deepwisdom431]

Actually impressed ,if u feel comfortable contact me .

[@HimanshuParmarlifestyle]

I have messaged you i hope you check it ☺️ i ain’t found your email so i just messaged you at insta . Ty for the info

[@Ankit_bhai_vlogs]

Can I contact you