Skip to content

Category: Tools and Techniques

Posts in this category are about tools and techniques that I find useful during a Penetration Test

Exploiting xdLocalStorage (localStorage and postMessage)

Some time ago I came across a site that was using xdLocalStorage after I had been looking into the security of HTML5 postMessage. I found that the library had several common security flaws around lack or origin validation and then noticed that there was already an open issue in the project for this problem, added it to my list of things to blog about and promptly forgot about it.

This week I have found the time to actually write this post which I hope will prove useful not only for those using xdLocalStorage, but more generally for those attempting to find (or avoid introducing) vulnerabilities when Web Messaging is in use.