Feature Request: PostMessage Vulnerability Scanner for Client-Side Security Testing

[IbnB]

Summary

Add a PostMessage vulnerability scanner that detects unsafe message event listeners, tracks cross-origin communication patterns, and identifies missing origin validation to help discover client-side security vulnerabilities.

Problem Statement

PostMessage vulnerabilities are increasingly common in modern web applications but are often overlooked during security testing. These vulnerabilities can lead to DOM XSS, data leakage, and authentication bypasses. Currently, rep+ users must manually inspect JavaScript code and test PostMessage handlers, which is time-consuming and easy to miss. An automated scanner would significantly improve detection of these client-side vulnerabilities.

Proposed Solution

Core Functionality

• Listener Detection: Automatically identify all addEventListener('message') handlers
• Origin Validation Check: Detect missing or weak origin verification
• Message Flow Tracking: Map PostMessage communication between frames/windows
• Payload Testing: Generate test payloads for discovered handlers
• Exploitation Helper: Create proof-of-concept HTML for testing

Detection Capabilities

• Missing origin checks (event.origin validation)
• Wildcard origin acceptance (*)
• Unsafe message data handling (eval, innerHTML, document.write)
• Recursive PostMessage chains
• Cross-frame data leakage
• Iframe communication vulnerabilities

UI/UX Mockup

POSTMESSAGE SCANNER [NEW TAB]
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Status: 3 Vulnerable Listeners Found ⚠️

[Scan Page] [Deep Scan] [Generate PoC]

📍 Listener #1 - HIGH RISK
Location: <https://app.example.com/dashboard.js:142>
Origin Check: MISSING ❌
Data Usage: innerHTML (Dangerous)
Sample Exploit:
window.postMessage({html: ‘<img src=x onerror=alert(1)>’}, ‘*’)
[Test] [View Code] [Generate PoC]

📍 Listener #2 - MEDIUM RISK  
Location: <https://app.example.com/widget.js:89>
Origin Check: Weak (allows *.[example.com](http://example.com))
Data Usage: JSON.parse → localStorage
[Test] [View Code] [Generate PoC]

📍 Listener #3 - LOW RISK
Location: Inline <script> line 234
Origin Check: Present ✓
Data Usage: Safe (textContent)
[View Code]

[Export Findings] [Generate Report]

Technical Detection Patterns

What to Scan For

// Vulnerable patterns to detect:

// 1. No origin validation
window.addEventListener('message', function(e) {
  document.getElementById('content').innerHTML = e.data; // XSS
});

// 2. Weak origin validation
window.addEventListener('message', function(e) {
  if (e.origin.indexOf('example.com') !== -1) { // Subdomain takeover risk
    eval(e.data.code); // Code execution
  }
});

// 3. Unsafe data handling
window.addEventListener('message', function(e) {
  if (e.origin === 'https://trusted.com') {
    window.location = e.data.redirect; // Open redirect
  }
});

// 4. Wildcard targetOrigin
parent.postMessage(sensitiveData, '*'); // Data leakage

// 5. Etc...

Scanner Output Format

{
  url: "https://example.com",
  timestamp: "2024-12-22T10:00:00Z",
  listeners: [
    {
      id: "listener_1",
      location: "dashboard.js:142",
      risk: "high",
      issues: [
        "missing_origin_check",
        "unsafe_innerHTML_usage"
      ],
      codeSnippet: "window.addEventListener('message', function(e) {...",
      exploitable: true,
      poc: {
        payload: "{html: '<img src=x onerror=alert(1)>'}",
        targetOrigin: "*"
      }
    }
  ],
  senders: [
    {
      location: "frame.js:45",
      targetOrigin: "*",
      dataType: "object",
      risk: "medium"
    }
  ]
}

Implementation Approach

Phase 1: Detection

• Hook into addEventListener to track message listeners
• Parse JavaScript to identify PostMessage usage
• Analyze inline scripts in HTML responses
• Track iframe creation and communication

Phase 2: Analysis

• Static analysis for origin validation patterns
• Data flow analysis for unsafe sinks
• Cross-frame communication mapping
• Risk scoring based on vulnerability patterns

Phase 3: Exploitation

• Generate test payloads based on handler logic
• Create PoC HTML files
• Provide remediation examples
• Export findings for reporting

Integration Points

With Existing Features

1. Request Capture: Scan JavaScript files as they’re loaded
2. Response Analysis: Check inline scripts in HTML responses
3. Secret Scanner: Often PostMessage leaks tokens/keys
4. Report Generator: Include PostMessage findings in reports

Future Enhancements

• Real-time monitoring of PostMessage events
• Automated exploitation chain building
• Integration with DOM XSS scanner
• WebSocket message analysis

User Stories

As a Bug Bounty Hunter

I want to quickly identify PostMessage vulnerabilities so I can find client-side bugs that automated scanners miss.

As a Security Researcher

I want to understand PostMessage communication flow so I can identify complex vulnerability chains.

As a Developer

I want to verify my PostMessage implementations are secure before deploying to production.

PoC Generation Examples

Generated HTML for Testing

<!-- Auto-generated PoC for PostMessage vulnerability -->
<!DOCTYPE html>
<html>
<head><title>PostMessage PoC - rep+</title></head>
<body>
  <h2>PostMessage Vulnerability PoC</h2>
  <iframe id="target" src="https://vulnerable.example.com/page"></iframe>
  
  <button onclick="exploit()">Send Exploit</button>
  
  <script>
    function exploit() {
      const payload = {
        html: '<img src=x onerror=alert(document.domain)>',
        action: 'update'
      };
      
      document.getElementById('target').contentWindow.postMessage(
        payload, 
        'https://vulnerable.example.com'
      );
    }
    
    // Auto-trigger after load
    window.onload = () => setTimeout(exploit, 2000);
  </script>
</body>
</html>

Benefits

• Unique Coverage: Catches vulnerabilities most scanners miss
• Efficiency: Automated detection vs manual code review
• Educational: Helps users understand client-side attack vectors
• Comprehensive: Covers multiple PostMessage vulnerability types
• Actionable: Provides working PoCs for validation

Success Criteria

• Detects 90%+ of PostMessage listeners on a page
• Identifies missing origin validation accurately
• Generates working PoCs for vulnerable handlers
• Completes scan in <5 seconds for typical pages
• Zero false positives for proper implementations

Risk Considerations

• Scanner is passive (detection only, no automatic exploitation)
• PoCs require user action to execute
• Clear warnings about responsible disclosure
• Educational focus on securing PostMessage usage

References

• MDN - Window.postMessage()
• OWASP - HTML5 Security: PostMessage
• PortSwigger - PostMessage Vulnerabilities
• Research: PostMessage Security in Chrome Extensions

Why this is important?

** PostMessage vulnerabilities are common, high-impact, and currently lack good tooling support. This would be a differentiating feature for rep+.